| |
| |||||||
Log-Analyse und Auswertung: Ungewünschte Umleitung zu bycontext.com nach CHIP.DE-DownloadWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
25.09.2014, 22:04
| #32 |
 |  Ungewünschte Umleitung zu bycontext.com nach CHIP.DE-Download Hola Cosinus,
__________________ok, habe ich gemacht. Jetzt noch ein Frst log Scan mit angeklickten Registry / Services / Drivers / Processes / Internet, viele Grüße, und herzlichen Dank bis hierher, Romanos: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-09-2014 01 Ran by Rainer (administrator) on RAINER-PC on 25-09-2014 23:05:39 Running from C:\Users\Rainer\Downloads Loaded Profile: Rainer (Available profiles: Rainer & Conny & Rainer-User & Marie-Sophie & Felix) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 8 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (AMD) C:\Windows\System32\atieclxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (TOSHIBA) C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (McAfee, Inc.) C:\Windows\System32\mfevtps.exe (Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe (McAfee, Inc.) C:\Program Files\Common Files\Mcafee\AMCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Hewlett-Packard) C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE (Microsoft Corporation) C:\Program Files\Microsoft Office\Office\FINDFAST.EXE (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (McAfee, Inc.) C:\Program Files\Common Files\Mcafee\Platform\McUICnt.exe (McAfee, Inc.) C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe (McAfee, Inc.) C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7289376 2009-03-30] (Realtek Semiconductor) HKLM\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [421888 2007-04-16] (TOSHIBA Electronics, Inc.) HKLM\...\Run: [SVPWUTIL] => C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe [438272 2008-11-21] (TOSHIBA) HKLM\...\Run: [KeNotify] => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION) HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe [1011712 2009-04-23] (TOSHIBA Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2009-04-21] (Advanced Micro Devices, Inc.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1451304 2009-03-20] (Synaptics Incorporated) HKLM\...\Run: [Toshiba Registration] => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [96144 2009-03-04] (Toshiba Europe GmbH) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-30] (Realtek Semiconductor Corp.) HKLM\...\Run: [OrderReminder] => C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe [98304 2006-01-30] (Hewlett-Packard) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.) HKLM\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.) HKLM\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.) HKLM\...\Run: [TAccessibility] => C:\Program Files\TOSHIBA\Accessibility\TAccessibility.exe [110592 2009-04-24] () HKLM\...\Run: [TCtryIOHook] => TCtrlIOHook.exe HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation) HKLM\...\Policies\Explorer: [NoCDBurning] 0 HKLM\...\Policies\Explorer: [NoFolderOptions] 0 HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKU\S-1-5-21-3586509278-78834929-860225448-1000\...\Run: [TOSHIBA Online Product Information] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [6158240 2009-03-16] (TOSHIBA) HKU\S-1-5-21-3586509278-78834929-860225448-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation) HKU\S-1-5-18\...\Run: [TOSHIBA Online Product Information] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [6158240 2009-03-16] (TOSHIBA) HKU\S-1-5-18\...\Policies\Explorer: [NoFolderOptions] 0 HKU\S-1-5-18\...\Policies\Explorer: [NoControlPanel] 0 Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe (No File) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Shortcut-Leiste.lnk ShortcutTarget: Microsoft Office Shortcut-Leiste.lnk -> C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE (Microsoft Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft-Indexerstellung.lnk ShortcutTarget: Microsoft-Indexerstellung.lnk -> C:\Program Files\Microsoft Office\Office\FINDFAST.EXE (Microsoft Corporation) Startup: C:\Users\Conny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) Startup: C:\Users\Rainer-User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM - {38AEB7B3-42CC-4C33-9290-BEA08B6FE742} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG; SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - F31624B0AF444080B7F139E05E41A758 URL = hxxp://isearch.avg.com/search?cid={72680FDB-E8CB-437D-AEE8-9F9D0761B89D}&mid=34d71d940f5847d1b30bd16a1c122099-aca251ad60a79a90d151588985182fee0518d1c3&lang=de&ds=tt014&pr=sa&d=2011-12-19 22:25:18&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms} SearchScopes: HKCU - {38AEB7B3-42CC-4C33-9290-BEA08B6FE742} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG; BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab DPF: {B07F54E6-0806-47DB-B5D8-398F240776F2} file:///E:/viewer/ORDcmViewCD.ocx DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Handler: haufereader - No CLSID Value - Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default FF Keyword.URL: hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q= FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL () FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin: @protectdisc.com/NPMPDRM -> C:\Program Files\Common Files\mpDRM\NPMPDRM.dll ( ) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\11-suche.xml FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\englische-ergebnisse.xml FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\gmx-suche.xml FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\lastminute.xml FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\webde-suche.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: WEB.DE MailCheck - C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\Extensions\toolbar@web.de [2014-09-24] FF Extension: WOT - C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-08-18] FF Extension: Ghostery - C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\Extensions\firefox@ghostery.com.xpi [2014-08-15] FF Extension: UITBAutoInstaller - C:\Program Files\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} [2014-09-25] FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2011-12-15] FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2011-12-15] FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04] Chrome: ======= CHR CustomProfile: C:\Users\Rainer\AppData\Local\Google\Chrome\User Data\Default CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2011-12-15] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S4 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] () R2 camsvc; C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [20544 2009-04-16] (TOSHIBA) R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [46448 2009-03-10] (TOSHIBA CORPORATION) S4 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [242424 2009-02-11] (WildTangent, Inc.) R2 HomeNetSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) S4 HRService; C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe [71024 2010-10-25] () S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed] R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [145568 2014-04-25] (McAfee, Inc.) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [472072 2014-06-12] (McAfee, Inc.) R2 mcpltsvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [655936 2014-07-24] (McAfee, Inc.) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169800 2014-06-20] (McAfee, Inc.) R2 mfevtp; C:\Windows\system32\mfevtps.exe [179600 2014-06-20] (McAfee, Inc.) R2 MSK80Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) S4 SXDS10; C:\Program Files\Common Files\soft Xpansion\sxds10.exe [234096 2013-10-06] (soft Xpansion) R2 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [62776 2009-04-01] (TOSHIBA Corporation) R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [176128 2009-04-24] (TOSHIBA Corporation) [File not signed] R2 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [73728 2009-03-17] (TOSHIBA Corporation) [File not signed] R2 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [656752 2009-04-15] (TOSHIBA Corporation) S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 acedrv10; C:\Windows\system32\drivers\acedrv10.sys [330144 2007-07-27] (Protect Software GmbH) R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH) R2 acehlp10; C:\Windows\system32\drivers\acehlp10.sys [251680 2007-07-27] (Protect Software GmbH) R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [62832 2014-06-20] (McAfee, Inc.) S3 FTD2XX; C:\Windows\System32\Drivers\FTD2XX.sys [29292 2004-10-15] (FTDI Ltd.) [File not signed] S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [60104 2011-01-24] (FTDI Ltd.) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [147912 2013-09-23] (McAfee, Inc.) R0 LPCFilter; C:\Windows\System32\DRIVERS\LPCFilter.sys [25896 2008-05-07] (COMPAL ELECTRONIC INC.) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-09-25] (Malwarebytes Corporation) R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [135968 2014-06-20] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [238176 2014-06-20] (McAfee, Inc.) S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [67816 2014-06-20] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [369248 2014-06-20] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [576048 2014-06-20] (McAfee, Inc.) R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [349192 2014-07-24] (McAfee, Inc.) S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [81296 2014-07-24] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [217224 2014-06-20] (McAfee, Inc.) R3 PGEffect; C:\Windows\System32\DRIVERS\pgeffect.sys [22272 2009-03-18] (TOSHIBA Corporation) R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [154272 2008-11-11] (Realtek Semiconductor Corp.) R1 RtlProt; C:\Windows\System32\DRIVERS\rtlprot.sys [25896 2007-04-23] (Windows (R) Codename Longhorn DDK provider) S3 SAFAUSB; C:\Windows\System32\Drivers\VocTrace.sys [16035 2003-12-19] (Windows (R) 2000 DDK provider) R2 TVALZFL; C:\Windows\System32\DRIVERS\TVALZFL.sys [12920 2009-03-21] (TOSHIBA Corporation) U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) S4 avgtp; \??\C:\Windows\system32\drivers\avgtpx86.sys [X] S3 catchme; \??\C:\Users\Rainer\AppData\Local\Temp\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-25 22:12 - 2014-09-25 22:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee 2014-09-25 21:35 - 2014-09-25 21:35 - 00000809 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\Program Files\CCleaner 2014-09-25 21:33 - 2014-09-25 21:33 - 04901352 _____ (Piriform Ltd) C:\Users\Rainer\Downloads\ccsetup417.exe 2014-09-25 15:38 - 2014-09-25 15:39 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-09-24 23:09 - 2014-09-09 08:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-09-24 22:56 - 2014-09-24 22:56 - 00448512 _____ (OldTimer Tools) C:\Users\Rainer\Downloads\TFC.exe 2014-09-24 21:32 - 2014-09-24 22:15 - 00000021 _____ () C:\Users\Rainer\Downloads\Fixlist.txt 2014-09-24 09:21 - 2014-09-24 09:21 - 00001880 _____ () C:\Users\Public\Desktop\Skype.lnk 2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ___RD () C:\Program Files\Skype 2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\Program Files\Common Files\Skype 2014-09-18 07:42 - 2014-09-18 07:42 - 00068225 _____ () C:\Users\Rainer\Downloads\ESET20140918.txt 2014-09-17 16:56 - 2014-09-17 16:56 - 00006428 _____ () C:\Users\Rainer-User\Downloads\Antimalware txt.txt 2014-09-16 22:16 - 2014-09-16 22:17 - 02347384 _____ (ESET) C:\Users\Rainer-User\Downloads\esetsmartinstaller_deu.exe 2014-09-12 19:41 - 2014-09-12 19:41 - 00007191 _____ () C:\Users\Rainer-User\Downloads\Malwarebytes Anti-Malware 2014 09 10.txt 2014-09-12 18:27 - 2014-09-12 18:27 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-09-12 18:26 - 2014-09-12 18:26 - 00002112 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk 2014-09-12 18:26 - 2014-09-12 18:26 - 00001037 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\OpenCandy 2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Program Files\WEB.DE MailCheck 2014-09-11 17:08 - 2013-03-02 23:24 - 00000744 _____ () C:\Users\Felix\Desktop\Tapps DE.lnk 2014-09-11 14:53 - 2014-08-19 03:46 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-11 14:53 - 2014-08-19 03:46 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-11 14:53 - 2014-08-19 03:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-09-11 14:53 - 2014-08-19 03:44 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-09-11 14:53 - 2014-08-19 03:41 - 06003200 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-11 14:53 - 2014-08-19 03:41 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll 2014-09-11 14:53 - 2014-08-19 03:41 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-11 14:53 - 2014-08-19 03:41 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-11 14:53 - 2014-08-19 03:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-09-11 14:53 - 2014-08-19 03:40 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-11 14:53 - 2014-08-19 03:40 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-09-11 14:53 - 2014-08-19 03:40 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-11 14:53 - 2014-08-19 03:39 - 11082752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-11 14:53 - 2014-08-19 03:39 - 02005504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-11 14:53 - 2014-08-19 03:39 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-11 14:53 - 2014-08-19 03:39 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-09-11 14:53 - 2014-08-19 03:39 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-11 14:53 - 2014-08-19 03:39 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-09-11 14:53 - 2014-08-19 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-11 14:53 - 2014-08-19 03:39 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-11 14:53 - 2014-08-19 03:38 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll 2014-09-11 14:53 - 2014-08-19 02:10 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-09-11 14:53 - 2014-08-19 00:33 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-11 14:53 - 2014-08-19 00:33 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-11 14:53 - 2014-08-19 00:31 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-09-11 14:53 - 2014-08-19 00:30 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-29 08:43 - 2014-08-23 03:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-29 08:43 - 2014-08-23 01:26 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-25 23:05 - 2014-08-17 22:03 - 00000000 ____D () C:\Users\Rainer\Downloads\FRST-OlderVersion 2014-09-25 23:05 - 2014-08-10 22:03 - 00022798 _____ () C:\Users\Rainer\Downloads\FRST.txt 2014-09-25 23:05 - 2014-04-29 00:09 - 01100800 _____ (Farbar) C:\Users\Rainer\Downloads\FRST.exe 2014-09-25 23:05 - 2013-11-11 00:10 - 00000000 ____D () C:\FRST 2014-09-25 22:43 - 2009-06-09 09:00 - 00000000 ____D () C:\Windows\Panther 2014-09-25 22:38 - 2012-04-04 21:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-09-25 22:34 - 2011-09-26 23:43 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-09-25 22:12 - 2014-09-25 22:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee 2014-09-25 22:12 - 2013-02-20 08:55 - 00001756 _____ () C:\Users\Public\Desktop\McAfee Internet Security.lnk 2014-09-25 21:40 - 2014-04-28 22:25 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-25 21:35 - 2014-09-25 21:35 - 00000809 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\Program Files\CCleaner 2014-09-25 21:33 - 2014-09-25 21:33 - 04901352 _____ (Piriform Ltd) C:\Users\Rainer\Downloads\ccsetup417.exe 2014-09-25 21:26 - 2008-02-24 09:46 - 01181881 ____N () C:\Windows\WindowsUpdate.log 2014-09-25 21:23 - 2014-06-22 14:29 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8e15a8ab2474.job 2014-09-25 21:23 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-25 21:23 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-09-25 21:23 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-09-25 18:32 - 2006-11-02 15:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-09-25 18:09 - 2011-12-02 22:18 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-09-25 18:06 - 2014-05-07 23:06 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-09-25 15:39 - 2014-09-25 15:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-09-25 15:25 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache 2014-09-24 23:10 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE 2014-09-24 22:56 - 2014-09-24 22:56 - 00448512 _____ (OldTimer Tools) C:\Users\Rainer\Downloads\TFC.exe 2014-09-24 22:40 - 2010-11-14 21:59 - 00000000 ____D () C:\Users\Rainer-User\AppData\Roaming\Skype 2014-09-24 22:15 - 2014-09-24 21:32 - 00000021 _____ () C:\Users\Rainer\Downloads\Fixlist.txt 2014-09-24 15:50 - 2011-11-26 10:09 - 00000000 ____D () C:\Users\Felix\AppData\Roaming\Skype 2014-09-24 09:21 - 2014-09-24 09:21 - 00001880 _____ () C:\Users\Public\Desktop\Skype.lnk 2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ___RD () C:\Program Files\Skype 2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\Program Files\Common Files\Skype 2014-09-24 09:21 - 2010-11-17 08:51 - 00000000 ____D () C:\Users\Conny\AppData\Roaming\Skype 2014-09-24 09:20 - 2010-11-14 21:59 - 00000000 ____D () C:\ProgramData\Skype 2014-09-18 07:42 - 2014-09-18 07:42 - 00068225 _____ () C:\Users\Rainer\Downloads\ESET20140918.txt 2014-09-17 18:04 - 2014-07-17 21:26 - 00000000 ____D () C:\Program Files\Opera 2014-09-17 16:56 - 2014-09-17 16:56 - 00006428 _____ () C:\Users\Rainer-User\Downloads\Antimalware txt.txt 2014-09-16 22:17 - 2014-09-16 22:16 - 02347384 _____ (ESET) C:\Users\Rainer-User\Downloads\esetsmartinstaller_deu.exe 2014-09-16 22:14 - 2011-06-23 12:41 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2014-09-15 09:06 - 2011-12-09 23:58 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-12 19:41 - 2014-09-12 19:41 - 00007191 _____ () C:\Users\Rainer-User\Downloads\Malwarebytes Anti-Malware 2014 09 10.txt 2014-09-12 18:28 - 2011-11-28 00:47 - 00000000 ____D () C:\Program Files\TuneUp Utilities 2012 2014-09-12 18:28 - 2011-11-28 00:45 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-09-12 18:27 - 2014-09-12 18:27 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-09-12 18:27 - 2011-09-13 22:46 - 00000000 ____D () C:\Users\Rainer-User\AppData\Roaming\DVDVideoSoft 2014-09-12 18:27 - 2011-02-25 21:28 - 00000000 ____D () C:\Users\Rainer-User\Documents\DVDVideoSoft 2014-09-12 18:27 - 2010-10-18 19:04 - 00000000 ____D () C:\Program Files\DVDVideoSoft 2014-09-12 18:26 - 2014-09-12 18:26 - 00002112 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk 2014-09-12 18:26 - 2014-09-12 18:26 - 00001037 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\OpenCandy 2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Program Files\WEB.DE MailCheck 2014-09-12 18:26 - 2011-09-13 22:47 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\DVDVideoSoft 2014-09-12 18:26 - 2010-10-18 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-09-12 18:26 - 2010-10-18 19:04 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft 2014-09-11 17:25 - 2008-01-21 09:16 - 01626604 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-11 15:48 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-09-11 15:09 - 2013-08-07 12:11 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-11 14:55 - 2006-11-02 12:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-09-11 14:34 - 2012-04-04 21:24 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-09-11 14:34 - 2011-06-01 22:29 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-09-09 08:24 - 2014-09-24 23:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-09-06 21:30 - 2011-12-15 01:57 - 00000000 ____D () C:\Program Files\Common Files\Mcafee 2014-08-31 13:55 - 2013-12-03 16:10 - 00001781 _____ () C:\Users\Rainer\Desktop\FOTOParadies.lnk 2014-08-31 13:55 - 2013-12-03 16:10 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FOTOParadies 2014-08-31 13:55 - 2012-09-11 21:19 - 00000000 ____D () C:\Program Files\FOTOParadies 2014-08-29 09:02 - 2006-11-02 14:47 - 00322424 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-26 17:23 - 2011-11-20 21:35 - 00000020 ____H () C:\ProgramData\PKP_DLdu.DAT 2014-08-26 17:22 - 2011-11-20 21:37 - 00000020 ____H () C:\ProgramData\PKP_DLdw.DAT ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-09-25 21:29 ==================== End Of Log ============================ |
|
25.09.2014, 23:12
| #33 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Ungewünschte Umleitung zu bycontext.com nach CHIP.DE-Download Sieht soweit ok aus
__________________ Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ |
|
05.10.2014, 22:48
| #34 |
| | Ungewünschte Umleitung zu bycontext.com nach CHIP.DE-Download Hallo Cosinus, manchmal bleibt es nach einer Tasteneingabe einfach stehen und braucht dann so 40-50 sec., um dann weiter zu machen. Malwarebytes gibt folgendes Ergebnis: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 05.10.2014 Suchlauf-Zeit: 23:20:51 Logdatei: Anti-Malware-Textdatei 2014 10 05.txt Administrator: Nein Version: 2.00.2.1012 Malware Datenbank: v2014.10.05.08 Rootkit Datenbank: v2014.09.19.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: Rainer-User Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 362262 Verstrichene Zeit: 21 Min, 50 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 2 PUP.Optional.DealKeeper.A, HKLM\SOFTWARE\Deal Keeper, , [f42861b086f676c09e0afe1d6a99d32d], PUP.Optional.BrowserGuard.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\kfepagcelbegkpkcjgfeecmlnmkedjin, , [bc6043cedd9f82b498091af2c93a8080], Registrierungswerte: 1 PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1381094394899&tguid=66920-6787-1381094394899-AF07B6AD22DF51CE02B3D1B428BA0F24&q=%s, , [72aad43d1e5e58de72ea29f904ffe61a] Registrierungsdaten: 1 PUP.Optional.SafeFinder.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}),,[08148e836f0d2b0b84fdb157a461de22] Ordner: 4 PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy, , [e7355fb27408ba7c3a01e8fa6c969070], PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\177586C2EEA542989844699BACEE36C5, , [e7355fb27408ba7c3a01e8fa6c969070], PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\8255D8B8BE3D4D2C91C3FF151064C5B9, , [e7355fb27408ba7c3a01e8fa6c969070], PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\A34781A3E41146DFADBA6A7B704BF5CD, , [e7355fb27408ba7c3a01e8fa6c969070], Dateien: 10 PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\searchplugins\SafeFinder Search.xml, , [6cb079980379c86e4af72fe6de2536ca], PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\searchplugins\SafeFinder Search.xml, , [93892ee3fe7ef3430d3439dc62a1bb45], PUP.Optional.HomeTab.A, c:\Windows\System32\Tasks\browser updater, , [100cff120676a690e233170a9e65eb15], PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), ,[8f8da76a87f564d2a2a156f0a16416ea] PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), ,[35e74bc67c00c472d371e3639075e61a] PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[d448908189f38bab75d079cdbd48966a] PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), ,[d74550c13f3de4521e256fd70afba35d] PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), ,[05176aa76616f0461331af971ce950b0] PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[ed2f9081a7d526102c19db6ba36256aa] PUP.Optional.SafeFinder.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[ba6231e0304cd85ee164c086c0454db3] Physische Sektoren: 0 (No malicious items detected) (end) Muß ich mir hier Sorgen machen? Viele Grüße und vielen Dank. |
|
05.10.2014, 23:10
| #35 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Ungewünschte Umleitung zu bycontext.com nach CHIP.DE-Download Das sind Adware-Überbleibsel und diese musst du mit MBAM auch mal entfernen!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
07.10.2014, 20:26
| #36 |
| | Ungewünschte Umleitung zu bycontext.com nach CHIP.DE-Download Hallo Cosinus, ja, täte ich gerne, aber: Wenn ich das mit MBAM alles in Quarantäne verschiebe, verlangt er, den Rechner runterzufahren. Und nach dem Hochlaufen ist das alles wieder da, und ich kann es nochmal machen. Es verschwindet nicht nachhaltig...  Grüße Romanos |
|
07.10.2014, 23:06
| #37 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Ungewünschte Umleitung zu bycontext.com nach CHIP.DE-Download Dann verrat mir mal warum dein MBAM Log nichts davon zeigt, dass die Funde entfernt werden Ich glaub hier einfach, du bedienst MBAM falsch
__________________ Logfiles bitte immer in CODE-Tags posten |
|
09.10.2014, 23:04
| #38 |
| | Ungewünschte Umleitung zu bycontext.com nach CHIP.DE-Download .... hmja, wie soll ich das machen, ich frage ja Dich, ...  heute Abend habe ich MWB nochmal laufen lassen, folgendes Ergebnis: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 18.08.2014 Suchlauf-Zeit: 21:39:23 Logdatei: Malwarebytes Anti-Malware 2014 08 18.txt Administrator: Nein Version: 2.00.2.1012 Malware Datenbank: v2014.08.18.09 Rootkit Datenbank: v2014.08.16.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: Rainer-User Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 350521 Verstrichene Zeit: 13 Min, 40 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 1 PUP.Optional.DealKeeper.A, HKLM\SOFTWARE\Deal Keeper, Löschen bei Neustart, [32df33959edd64d270b78364bc4645bb], Registrierungswerte: 1 PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1381094394899&tguid=66920-6787-1381094394899-AF07B6AD22DF51CE02B3D1B428BA0F24&q=%s, Löschen bei Neustart, [fa17e9df5526290d1bc8ac41956d9070] Registrierungsdaten: 1 PUP.Optional.SafeFinder.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}),Löschen bei Neustart,[c34e3a8e0d6e74c2346412b826deb34d] Ordner: 0 (No malicious items detected) Dateien: 12 PUP.Optional.SmartBar, C:\Windows\Installer\16f349.msi, Löschen bei Neustart, [29e8c3050d6eb284b78fd8569769e020], PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\searchplugins\SafeFinder Search.xml, Löschen bei Neustart, [6da4c008eb90d660ebc9e3fdbd45f60a], PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\searchplugins\SafeFinder Search.xml, Löschen bei Neustart, [db36fbcd9fdcfe3872423fa12fd3f709], PUP.Optional.HomeTab.A, c:\Windows\System32\Tasks\browser updater, Löschen bei Neustart, [57ba7b4d700b270f1f7df4f825dd3fc1], PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), Entfernung fehlgeschlagen,[2be606c28eedea4cb2db27de34d1b34d] PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), Entfernung fehlgeschlagen,[63aee9dfe29980b6018d52b380856799] PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), Entfernung fehlgeschlagen,[947d1dabd4a7082eccc38e77b055ab55] PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), Entfernung fehlgeschlagen,[5eb380486e0d2c0ad7b60afbde278f71] PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), Entfernung fehlgeschlagen,[ec258741463542f43c523fc6d92c0af6] PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), Entfernung fehlgeschlagen,[0b06d7f17506fb3b5f3048bd4eb7a65a] PUP.Optional.SafeFinder.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), Entfernung fehlgeschlagen,[918014b48bf09a9c652a759029dc4bb5] PUP.Optional.QuickStart.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");), Entfernung fehlgeschlagen,[c24f5276adcebc7aa9eaac5961a4629e] Physische Sektoren: 0 (No malicious items detected) (end) Ich wählte bis jetzt immer den rechten Button 'Aktionen anwenden'. Also, heute Abend wähle ich dann mal den linken Button und schicke Dir anschl. das Ergebnis, ok? Ah, ok, im Verlaufsfenster kann ich auch noch die Quarantäne anschauen und dort alles löschen. Das mache ich also auch noch... Nun ist dort auch alles leer. Bitte entschuldige, ich habe den Eindruck, daß meine fortlaufenden Fragen sehr nervend für Dich sind. Viele Grüße Romanos Hallo Cosinus, so, und dann den Rechner runter- und wieder hochgefahren, ... MWB nochmal laufen lassen, Ergebnis: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 09.10.2014 Suchlauf-Zeit: 23:15:12 Logdatei: Administrator: Nein Version: 2.00.2.1012 Malware Datenbank: v2014.10.09.11 Rootkit Datenbank: v2014.10.08.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: Rainer-User Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 361154 Verstrichene Zeit: 14 Min, 13 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 2 PUP.Optional.DealKeeper.A, HKLM\SOFTWARE\Deal Keeper, , [4b6423eff983a59108148b96c63ddd23], PUP.Optional.BrowserGuard.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\kfepagcelbegkpkcjgfeecmlnmkedjin, , [19964ec4abd144f28b930f0321e221df], Registrierungswerte: 1 PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1381094394899&tguid=66920-6787-1381094394899-AF07B6AD22DF51CE02B3D1B428BA0F24&q=%s, , [2c8321f19ddf6bcb1caf31f6ab5817e9] Registrierungsdaten: 1 PUP.Optional.SafeFinder.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}),,[0ba4e230314b1422155e8c825fa619e7] Ordner: 4 PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy, , [8c23e13198e4ea4c47790ed77e8413ed], PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\177586C2EEA542989844699BACEE36C5, , [8c23e13198e4ea4c47790ed77e8413ed], PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\8255D8B8BE3D4D2C91C3FF151064C5B9, , [8c23e13198e4ea4c47790ed77e8413ed], PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\A34781A3E41146DFADBA6A7B704BF5CD, , [8c23e13198e4ea4c47790ed77e8413ed], Dateien: 10 PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\searchplugins\SafeFinder Search.xml, , [8926cc461369ec4a02b58199f90a06fa], PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\searchplugins\SafeFinder Search.xml, , [6b44db37304c6dc92394e43645bec23e], PUP.Optional.HomeTab.A, c:\Windows\System32\Tasks\browser updater, , [119e040e49331521f492180e2cd7f10f], PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), ,[a8078e849ddf7fb7a3d30943fb0a17e9] PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), ,[96193cd61e5e2f07671036161de814ec] PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[8c2364aeadcf10267008113bbc49758b] PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), ,[2f806da51b6174c2fc7a212b9c6907f9] PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), ,[c1ee35dd9be1a393adcaf95314f1fe02] PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[dcd3b85a74083ff77bfd1438a95c817f] PUP.Optional.SafeFinder.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[d5dac64ca9d3a78fea8e222a2cd98f71] Physische Sektoren: 0 (No malicious items detected) (end) Viele Grüße Romanos |
|
17.10.2014, 13:34
| #39 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Ungewünschte Umleitung zu bycontext.com nach CHIP.DE-Download adwCleaner und JRT neu runterladen auf den Desktop. Nacheinander erneut ausführen.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
Linear-Darstellung
