Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Alles rund um Windows (https://www.trojaner-board.de/alles-rund-um-windows/)
-   -   WinSXS x86 VC++ Redistibutable: Manifestdatei fehlerhaft, Win7 SP1 lässt sich nicht installieren (https://www.trojaner-board.de/163845-winsxs-x86-vc-redistibutable-manifestdatei-fehlerhaft-win7-sp1-laesst-installieren.html)

cosinus 12.02.2015 10:27
Eine andere Reparatur als das Repairtool ist mir nicht bekannt. Darüberhinaus kenn ich nur noch die Möglichkeiten, die ja so vehement abgelehnt werden....

Was genau passiert wenn du irgendwas löschst müsste man ausprobieren...prinzipiell glaub ich aber, dass da nichts Handefestes bei raus kommt wenn man manuell im WinSXS -Moloch rumfummelt...

Kronos60 12.02.2015 12:36
Mit einem Wort: das System ist hinüber, hättest du gleich neuinstalliert dann hättest du dir schon viel Zeit erspart.

cosinus 12.02.2015 13:02
So drastisch wollte ich es nicht ausdrücken :D

Ich finde es schon gut, wenn man zuerst versucht, die Ursache zu finden um dann gezielt das Problem zu beheben...sonst kann man ja gleich ein read-only Board machen mit einem Stickythread: "Probleme mit dem Rechner? Einfach alles neu installieren :kloppen: "

Nur wie gesagt, ein anderes Repairtool ist mir nicht bekannt...

Was wir noch laufen lassen könnten wäre Combofix, ist eigentlich ein Anti-Malware-Tool, aber bevor du plattmachst...ein Versuch isses ja wert :)

Dann bitte jetzt Combofix ausführen:

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Kronos60 12.02.2015 13:12
Zitat:
Zitat von cosinus (Beitrag 1425435)
Ich finde es schon gut, wenn man zuerst versucht, die Ursache zu finden um dann gezielt das Problem zu beheben...
Ich ja auch, aber hier funktioniert so vieles nicht, das eigentlich wirklich nichts anderes mehr geht als eine Neuinstallation, aber warten wir mal Combofix ab.

fensterkreuz 12.02.2015 13:15
Natürlich ist es im Nachhinein immer ärgerlich, wenn man bemerkt, dass die Arbeit, die man hatte und die Zeit, die man in diese Arbeit gesteckt hat, für die Katz' war. Leider weiß man das eben a priori nicht. Also, wat willste machen... :-D


Ich werde Combofix gleich mal probieren, die nächste Eskalationsstufe wäre folglich das Inplace Upgrade und danach die komplette Neuinstallation. Das führt mich zur nächsten Frage: Ich werd aus den Logs von adwCleaner und JRT nicht so recht schlau: Ist das Adware-Problem damit (und speziell nach Combofix) zumindest behoben?

Kronos60 12.02.2015 13:27
Zitat:
Zitat von fensterkreuz (Beitrag 1425447)
Ich werde Combofix gleich mal probieren, die nächste Eskalationsstufe wäre folglich das Inplace Upgrade und danach die komplette Neuinstallation.
Ich würde mir das Inplace - Upgrade sparen und gleich neuinstallieren das spart Zeit.
Wegen den Logs warten wir mal die Antwort von cosinus ab.

Wenn du keine Windows 7 Home Premium mit Servicepack1 hast kannst du dir hier:
http://www.chip.de/downloads/Windows-7-Professional-incl.-SP1-64-Bit_46356878.html
die Iso downloaden.
Die bearbeitest du mit diesem:
http://code.kliu.org/misc/winisoutils/
Tool.
Dann kannst du dir die Iso, als Iso brennen oder du spielst die Iso mit diesem Tool:
http://www.heise.de/download/universal-usb-installer-1192399.html
auf einen Usb-Stick drauf.

Dann hast du das Servicepack1 auf der DVD darauf und brachst es nicht extra zu installieren das spart viel Zeit.

fensterkreuz 12.02.2015 14:00
Hier ist das Combofix-Log:

Combofix Logfile:
Code:
ComboFix 15-02-09.01 - Philipp 12.02.2015  13:22:16.1.2 - x64
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.4063.2026 [GMT 1:00]
ausgeführt von:: c:\users\Philipp\Desktop\ComboFix.exe
FW: Ad-Aware Firewall *Disabled* {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
SP: Ad-Aware Antivirus *Disabled/Outdated* {631A84A5-349B-D564-3A83-A0F22C2DF32B}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\Philipp\AppData\Local\assembly\tmp
c:\users\Philipp\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\Philipp\AppData\Roaming\.#
c:\windows\IsUn0407.exe
c:\windows\msdownld.tmp
c:\windows\security\Database\tmp.edb
c:\windows\SysWow64\tmp10E1.tmp
c:\windows\SysWow64\tmp1101.tmp
c:\windows\SysWow64\tmp4DE1.tmp
c:\windows\SysWow64\tmp730D.tmp
c:\windows\SysWow64\tmpB866.tmp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2015-01-12 bis 2015-02-12  ))))))))))))))))))))))))))))))
.
.
2015-02-12 12:39 . 2011-08-12 04:10        8862544        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{FF852E11-0CCC-4050-8BE7-0882189ED82A}\mpengine.dll
2015-02-12 12:37 . 2015-02-12 12:37        --------        d-----w-        c:\users\Default\AppData\Local\temp
2015-02-11 23:49 . 2014-12-15 03:13        11870360        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F2339FCD-8F1B-498A-886F-FB9EAC12BFC5}\mpengine.dll
2015-02-11 22:58 . 2015-02-11 23:11        --------        d-----w-        c:\windows\system32\catroot2
2015-02-11 22:50 . 2015-02-11 22:50        --------        d-----w-        c:\windows\SysWow64\wbem\Performance
2015-02-11 22:02 . 2015-02-11 22:02        --------        d-----w-        C:\RegBackup
2015-02-11 13:45 . 2015-02-11 13:49        --------        d-----w-        C:\AdwCleaner
2015-02-11 12:36 . 2015-02-11 14:01        --------        d-----w-        C:\FRST
2015-02-11 07:32 . 2015-02-11 07:32        --------        d-----w-        c:\windows\system32\appraiser
2015-02-11 05:15 . 2015-02-11 05:15        --------        d-----w-        c:\windows\system32\SPReview
2015-02-11 05:02 . 2015-02-04 03:01        1098752        ----a-w-        c:\windows\system32\aeinv.dll
2015-02-11 05:02 . 2015-01-27 23:23        1239720        ----a-w-        c:\windows\system32\aitstatic.exe
2015-02-11 05:02 . 2014-12-04 02:31        192000        ----a-w-        c:\windows\system32\aepic.dll
2015-02-11 05:02 . 2015-02-04 03:04        609280        ----a-w-        c:\windows\system32\generaltel.dll
2015-02-11 05:02 . 2015-02-04 03:03        762368        ----a-w-        c:\windows\system32\invagent.dll
2015-02-11 05:02 . 2015-02-04 03:03        414720        ----a-w-        c:\windows\system32\devinv.dll
2015-02-11 05:02 . 2015-02-04 03:03        227328        ----a-w-        c:\windows\system32\aepdu.dll
2015-02-10 18:44 . 2015-02-10 18:44        --------        d-----w-        c:\users\Philipp\AppData\Local\Skype
2015-02-10 17:52 . 2015-02-10 17:59        --------        d-----w-        c:\users\Philipp\AppData\Local\elfopatch
2015-02-10 15:31 . 2015-02-10 15:31        --------        d-----w-        c:\users\Philipp\AppData\Roaming\dvdcss
2015-02-10 15:30 . 2015-02-10 15:30        --------        d-----w-        c:\users\Philipp\AppData\Roaming\Corel
2015-02-10 15:30 . 2015-02-10 15:30        952        --sha-w-        c:\programdata\KGyGaAvL.sys
2015-02-10 15:30 . 2015-02-10 15:30        --------        d-----w-        c:\users\Philipp\Corel
2015-02-10 15:12 . 2010-01-25 07:37        504832        ----a-w-        c:\windows\system32\imapi2.dll
2015-02-10 15:12 . 2010-01-25 07:11        392192        ----a-w-        c:\windows\SysWow64\imapi2.dll
2015-02-10 14:54 . 2015-02-10 14:54        --------        d-----w-        c:\program files (x86)\Corel
2015-02-10 14:51 . 2015-02-10 15:52        --------        d-----w-        c:\programdata\Corel
2015-02-10 13:56 . 2015-02-10 13:56        --------        d-----w-        c:\users\Philipp\AppData\Local\Macromedia
2015-02-10 13:56 . 2015-02-10 13:56        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-02-10 13:56 . 2015-02-10 13:56        701616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2015-02-10 13:52 . 2015-02-10 13:52        --------        d-----w-        c:\windows\SysWow64\Adobe
2015-02-10 12:27 . 2015-02-10 12:27        --------        d-----w-        c:\users\Philipp\AppData\Roaming\PDF Architect 2
2015-02-10 12:26 . 2015-02-10 12:26        --------        d-----w-        c:\users\Philipp\AppData\Local\PDFCreator
2015-02-10 11:06 . 2015-02-10 11:06        --------        d-----w-        c:\users\Philipp\AppData\Roaming\InstallShield
2015-02-09 16:03 . 2015-02-09 16:03        --------        d-----w-        C:\c9b1b4a0d29fea6a054f
2015-02-09 15:55 . 2015-02-09 15:55        --------        d-----w-        c:\users\Philipp\AppData\Roaming\Intel
2015-02-09 15:54 . 2015-02-09 15:54        --------        d-----w-        c:\program files (x86)\Cisco
2015-02-09 15:54 . 2015-02-09 15:54        --------        d-----w-        c:\programdata\Intel
2015-02-09 15:54 . 2015-02-09 15:54        --------        d-----w-        c:\program files\Intel
2015-02-09 15:54 . 2015-02-09 15:54        --------        d-----w-        c:\program files\Common Files\Intel
2015-02-09 15:49 . 2015-02-09 15:51        --------        d-----w-        c:\program files (x86)\PDF Architect 2
2015-02-09 15:47 . 2015-02-09 15:47        --------        d-----w-        c:\programdata\PDF Architect 2
2015-02-09 15:45 . 2015-02-09 15:47        114872        ----a-w-        c:\windows\system32\pdfcmon.dll
2015-02-09 15:45 . 2015-02-09 15:53        --------        d-----w-        c:\program files\PDFCreator
2015-02-09 13:27 . 2015-02-09 13:27        --------        d-----w-        c:\users\Philipp\AppData\Roaming\Roxio Log Files
2015-02-09 13:24 . 2014-04-28 14:48        2800344        ----a-w-        c:\windows\system32\RltkAPO64.dll
2015-02-09 13:23 . 2014-04-17 16:42        1317976        ----a-w-        c:\windows\system32\MaxxAudioAPO6064.dll
2015-02-09 13:19 . 2012-06-05 12:45        237968        ----a-w-        c:\windows\system32\drivers\RtHDMIVX.sys
2015-02-09 12:46 . 2015-02-09 12:46        --------        d-----w-        c:\program files\Lavasoft
2015-02-09 12:30 . 2015-02-10 15:32        --------        d-----w-        c:\users\Philipp\AppData\Roaming\vlc
2015-02-09 12:29 . 2015-02-09 12:29        --------        d-----w-        c:\program files\VideoLAN
2015-02-09 12:08 . 2015-02-09 12:05        43064        ----a-w-        c:\windows\system32\drivers\avnetflt.sys
2015-02-09 12:05 . 2015-02-09 12:05        --------        d-----w-        c:\users\Philipp\AppData\Roaming\Avira
2015-02-09 09:23 . 2015-02-11 07:32        --------        d-s---w-        c:\windows\system32\CompatTel
2015-02-09 08:03 . 2015-02-10 21:00        --------        d-----w-        c:\programdata\Package Cache
2015-02-09 07:41 . 2015-02-09 07:41        --------        d-----w-        c:\users\Philipp\AppData\Roaming\Lavasoft
2015-02-09 07:41 . 2015-02-09 07:41        --------        d-----w-        c:\program files\Common Files\Lavasoft
2015-02-09 07:33 . 2015-02-11 05:13        --------        d-----w-        c:\windows\system32\MRT
2015-02-09 00:28 . 2014-09-15 00:44        3195392        ----a-w-        c:\windows\system32\win32k.sys
2015-02-09 00:02 . 2015-02-09 00:02        --------        d-----w-        c:\programdata\Lavasoft
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-11 05:04 . 2009-11-15 08:01        116773704        ----a-w-        c:\windows\system32\MRT.exe
2015-02-10 18:42 . 2009-11-16 18:06        386680        ----a-w-        c:\windows\system32\drivers\sptd.sys
2014-12-22 23:41 . 2009-11-24 19:26        298120        ------w-        c:\windows\system32\MpSigStub.exe
2014-11-18 13:56 . 2014-11-18 13:56        1202848        ----a-w-        c:\windows\SysWow64\FM20.DLL
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{691B33B0-B86E-47F3-81C7-56E4FE3B929C}]
2014-10-10 15:03        37928        ----a-w-        c:\program files (x86)\PDF Architect 2\creator-ie-helper.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{DEEB13D7-CEA9-45FB-B77C-E039BEC85221}"= "c:\program files (x86)\PDF Architect 2\creator-ie-plugin.dll" [2014-10-10 478760]
.
[HKEY_CLASSES_ROOT\clsid\{deeb13d7-cea9-45fb-b77c-e039bec85221}]
[HKEY_CLASSES_ROOT\PDFIEPlugin.PDFIEConverter.1]
[HKEY_CLASSES_ROOT\TypeLib\{30CEDC3C-254F-4827-9A25-A4AA041826CC}]
[HKEY_CLASSES_ROOT\PDFIEPlugin.PDFIEConverter]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
"Spotify Web Helper"="c:\users\Philipp\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2015-02-10 1676344]
"Spotify"="c:\users\Philipp\AppData\Roaming\Spotify\Spotify.exe" [2015-02-10 6737976]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2014-03-04 3696912]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-10 98304]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2015-01-19 126712]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-11-24 702768]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-1 1079584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-07-01 09:49        98304        ----a-w-        c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BFE]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BITS]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MpsSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\msiserver]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SharedAccess]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vss]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe"
"MarketingTools"=c:\program files (x86)\Sony\Marketing Tools\MarketingTools.exe
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"NBKeyScan"="c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"RemoteControl9"="c:\program files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"
"PDVD9LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD9\Language\Language.exe"
"BDRegion"=c:\program files (x86)\Cyberlink\Shared Files\brs.exe
"WEB.DE Update"=c:\program files (x86)\WEB.DE\LiveUpdate\m2LUTray.exe
.
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 PDF Architect 2;PDF Architect 2;c:\program files (x86)\PDF Architect 2\ws.exe;c:\program files (x86)\PDF Architect 2\ws.exe [x]
R3 pdfforge CrashHandler;pdfforge CrashHandler;c:\program files (x86)\PDF Architect 2\crash-handler-ws.exe;c:\program files (x86)\PDF Architect 2\crash-handler-ws.exe [x]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [x]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [x]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R4 .1258039498;1258039498;c:\program files (x86)\1258039498\Philipp1258039498L.exe;c:\program files (x86)\1258039498\Philipp1258039498L.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 LavasoftAdAwareService11;Ad-Aware Service 11;c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareService.exe;c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareService.exe [x]
S2 PDF Architect 2 Creator;PDF Architect 2 Creator;c:\program files (x86)\PDF Architect 2\creator-ws.exe;c:\program files (x86)\PDF Architect 2\creator-ws.exe [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys;c:\windows\SYSNATIVE\drivers\regi.sys [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [x]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe;c:\program files\Sony\VAIO Power Management\SPMService.exe [x]
S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys;c:\windows\SYSNATIVE\DRIVERS\SFEP.sys [x]
S3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\vuagent.exe;c:\program files\Sony\VAIO Update\vuagent.exe [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-10 13:56]
.
2015-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-28 04:38]
.
2015-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-28 04:38]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2014-05-09 13672152]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-07-24 1833504]
"AdAwareTray"="c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareTray.exe" [2014-12-18 8947008]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://go.web.de/home
mStart Page = hxxp://go.web.de/home
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchURL,(Default) = hxxp://go.web.de/suchbox/webdesuche?su=%s
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.2.1
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan.cab
FF - ProfilePath - c:\users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\GnlWzHEK.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-NBKeyScan - c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3325936630-1017222350-922930496-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-02-12  13:48:50 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-02-12 12:48
.
Vor Suchlauf: 29 Verzeichnis(se), 349.883.564.032 Bytes frei
Nach Suchlauf: 31 Verzeichnis(se), 349.117.841.408 Bytes frei
.
- - End Of File - - 33D41C8D89F262EA26B6AC4E36667B86
8F558EB6672622401DA993E1E865C861

cosinus 12.02.2015 14:25
Zitat:
FW: Ad-Aware Firewall *Disabled* {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
SP: Ad-Aware Antivirus *Disabled/Outdated* {631A84A5-349B-D564-3A83-A0F22C2DF32B}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
:eek:

Zwei Virenscanner?! Bitte mal alles deinstallieren. Beides taugt nicht viel aber sind potentielle Störkandidaten für die SP1-Install!!

fensterkreuz 12.02.2015 14:41
Ich werde entgegen Kronos' Rat mal ein Inplace Upgrade starten, *nachdem* ich die Virenscanner deinstalliert habe. :-p By the way: Ad-Aware läuft in diesem Falle, anders als Avira, nicht realtime mit.

Welcher (Freeware?)-Virenscanner wird von den Profis empfohlen?


@Kronos: Die Installations-DVD und die Iso liegen mir vollumfänglich vor. :-)

cosinus 12.02.2015 15:18
Hau doch mal erst Avira und de Ad-Aware weg....vllt ist das ein Zufallstreffer :D

fensterkreuz 13.02.2015 03:18
Ich hatte wohl die Hand schneller am Abzug als du mich warnen konntest...

Das Inplace Upgrade ist mittlerweile durchgelaufen und ich hab noch ein paar Updates installiert. Hier ist mal ein neues aber gekürztes FRST, mach achte besonders auf Zeile fünf! :applaus:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-02-2015
Ran by Philipp (administrator) on PHILIPP-VAIO on 13-02-2015 02:34:10
Running from C:\Users\Philipp\Desktop
Loaded Profiles: Philipp (Available profiles: Philipp)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Spotify Ltd) C:\Users\Philipp\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-08-03] (Alps Electric Co., Ltd.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672152 2014-05-09] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-07-24] (Realtek Semiconductor Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-10] (Advanced Micro Devices, Inc.)
Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X]
HKU\S-1-5-21-3325936630-1017222350-922930496-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-3325936630-1017222350-922930496-1000\...\Run: [Spotify] => C:\Users\Philipp\AppData\Roaming\Spotify\Spotify.exe [6737976 2015-02-10] (Spotify Ltd)
HKU\S-1-5-21-3325936630-1017222350-922930496-1000\...\Run: [Spotify Web Helper] => C:\Users\Philipp\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-02-10] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3325936630-1017222350-922930496-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.web.de/home
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3325936630-1017222350-922930496-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3325936630-1017222350-922930496-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.web.de/home
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {10740E9E-D0A0-40E6-96CD-FB8CD206656C} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {57F52502-BDED-FDD7-0423-6082F8A06F93} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {61C9CA60-FDF7-4486-A7F3-119C3435378B} URL = hxxp://search.1und1.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {71477CCD-BFF5-49B0-A38F-81E56D105462} URL = hxxp://suche.gmx.net/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {9ED2C43A-B711-41A9-828F-A0FB125F4620} URL = hxxp://go.web.de/suchbox/amazon/?keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {F552487D-6416-4302-84A8-018BB61CBD6C} URL = hxxp://go.web.de/suchbox/smartshopping/?searchText={searchTerms}&mc=searchplugin@suche@msie.suche@preisvergleich
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: PDF Architect Helper -> {691B33B0-B86E-47F3-81C7-56E4FE3B929C} -> C:\Program Files (x86)\PDF Architect 2\creator-ie-helper.dll (pdfforge GmbH)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File
Toolbar: HKLM-x32 - PDF Architect Toolbar - {DEEB13D7-CEA9-45FB-B77C-E039BEC85221} - C:\Program Files (x86)\PDF Architect 2\creator-ie-plugin.dll (pdfforge GmbH)
Toolbar: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM-x32 {28B66320-9687-4B13-8757-36F901887AB5} hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/canvasx.cab
DPF: HKLM-x32 {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan.cab

FireFox:
========
FF ProfilePath: C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\GnlWzHEK.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll (pdfforge GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\GnlWzHEK.default\Extensions\abs@avira.com [2015-02-09]
FF HKLM-x32\...\Firefox\Extensions: [pdf_architect_2_conv@pdfarchitect.org] - C:\Program Files (x86)\PDF Architect 2\resources\pdfarchitect2firefoxextension
FF Extension: PDF Architect 2 Creator - C:\Program Files (x86)\PDF Architect 2\resources\pdfarchitect2firefoxextension [2015-02-09]

Chrome:
=======
CHR Profile: C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-09]
CHR Extension: (Google Docs) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-09]
CHR Extension: (Google Drive) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-09]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-10]
CHR Extension: (YouTube) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-09]
CHR Extension: (Google-Suche) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-09]
CHR Extension: (Google Tabellen) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-09]
CHR Extension: (Avira Browserschutz) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-09]
CHR Extension: (Google Wallet) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-09]
CHR Extension: (Google Mail) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-09]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738856 2014-10-10] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [74496 2010-09-27] (Sony Corporation)
R2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
S3 Vcsw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [312136 2010-09-27] (Sony Corporation)
R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [845312 2010-08-11] (Sony Corporation) [File not signed]
R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1642544 2014-02-28] (Sony Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2015-02-13] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2015-02-13] (Disc Soft Ltd)
R2 risdptsk; C:\Windows\System32\DRIVERS\risdsn64.sys [76288 2009-07-31] (REDC)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

(gekürzt wegen des Inplace Upgrades)

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-13 02:32 - 2012-03-26 20:52 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Spotify
2015-02-13 02:32 - 2009-11-16 19:06 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2015-02-13 02:31 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-02-13 02:29 - 2010-03-28 15:47 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-13 02:29 - 2009-07-14 05:45 - 00025984 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-13 02:29 - 2009-07-14 05:45 - 00025984 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-13 02:29 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-02-13 02:27 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-13 02:27 - 2009-07-14 05:51 - 00722414 _____ () C:\Windows\setupact.log
2015-02-13 02:27 - 2009-07-14 05:45 - 03043576 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-13 02:26 - 2011-05-19 20:51 - 00901802 _____ () C:\Windows\PFRO.log
2015-02-13 02:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System
2015-02-13 02:17 - 2009-07-14 19:18 - 00000000 ____D () C:\Program Files\Windows Journal
2015-02-13 02:17 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Defender
2015-02-13 02:17 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2015-02-13 02:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-13 01:44 - 2010-03-28 15:47 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-13 00:07 - 2009-07-14 18:58 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2015-02-13 00:07 - 2009-07-14 18:58 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2015-02-13 00:07 - 2009-07-14 06:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-12 23:39 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2015-02-12 23:39 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Portable Devices
2015-02-12 23:39 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2015-02-12 23:39 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\DVD Maker
2015-02-12 23:39 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Sidebar
2015-02-12 23:39 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Portable Devices
2015-02-12 23:39 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2015-02-12 23:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\sppui
2015-02-12 23:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Setup
2015-02-12 23:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2015-02-12 23:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\migwiz
2015-02-12 23:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\manifeststore
2015-02-12 23:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-02-12 23:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\AdvancedInstallers
2015-02-12 23:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\servicing
2015-02-12 23:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sppui
2015-02-12 23:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Setup
2015-02-12 23:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\oobe
2015-02-12 23:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\migwiz
2015-02-12 23:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\manifeststore
2015-02-12 23:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-02-12 23:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-02-12 23:28 - 2009-07-14 03:36 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\msclmd.dll
2015-02-12 23:28 - 2009-07-14 03:36 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msclmd.dll
2015-02-12 17:57 - 2009-11-17 11:30 - 00000000 ___RD () C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spiele
2015-02-12 17:46 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\restore
2015-02-12 17:45 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-02-12 17:44 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-02-12 17:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Recovery
2015-02-12 17:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Windows NT
2015-02-12 17:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-12 17:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Registration
2015-02-12 17:22 - 2011-07-23 08:39 - 00000000 ____D () C:\Windows\System32\Tasks\Sony Corporation
2015-02-12 17:22 - 2009-10-21 18:08 - 00000000 ____D () C:\Windows\System32\Tasks\SONY
2015-02-12 17:17 - 2009-07-14 05:46 - 00004141 _____ () C:\Windows\DtcInstall.log
2015-02-12 17:17 - 2009-07-14 04:20 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-02-12 17:17 - 2009-07-14 04:20 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-02-12 17:17 - 2009-07-14 04:20 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-02-12 17:17 - 2009-07-14 04:20 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-02-12 17:16 - 2009-11-12 16:49 - 00000000 ____D () C:\Users\Philipp\Tracing
2015-02-12 17:16 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-02-12 17:15 - 2011-10-01 11:50 - 00000000 ____D () C:\Users\Philipp\Documents\Stronghold 2
2015-02-12 17:15 - 2011-07-25 20:35 - 00000000 ____D () C:\Users\Philipp\Documents\Symantec
2015-02-12 17:15 - 2011-06-13 00:24 - 00000000 ____D () C:\Users\Philipp\Documents\onkel peter
2015-02-12 17:15 - 2011-06-09 08:30 - 00000000 ____D () C:\Users\Philipp\Documents\Nero
2015-02-12 17:15 - 2010-07-24 11:19 - 00000000 ____D () C:\Users\Philipp\Documents\restore
2015-02-12 17:15 - 2010-04-08 12:25 - 00000000 ____D () C:\Users\Philipp\Documents\iMacros
2015-02-12 17:15 - 2010-02-23 18:25 - 00000000 ____D () C:\Users\Philipp\dwhelper
2015-02-12 17:15 - 2009-11-17 11:53 - 00000000 ____D () C:\Users\Philipp\Documents\WebCam Media
2015-02-12 17:15 - 2009-11-17 09:58 - 00000000 ____D () C:\Users\Philipp\Documents\My Games
2015-02-12 17:15 - 2009-11-17 09:49 - 00000000 ____D () C:\Users\Philipp\Documents\NFS ProStreet
2015-02-12 17:15 - 2009-11-16 11:50 - 00000000 ____D () C:\Users\Philipp\Documents\InterVideo
2015-02-12 17:15 - 2009-11-15 11:34 - 00000000 ____D () C:\Users\Philipp\Documents\Philipp
2015-02-12 17:15 - 2009-11-12 16:50 - 00000000 ____D () C:\Users\Philipp\Documents\Picture Motion Browser
2015-02-12 17:14 - 2011-02-21 21:04 - 00000000 ____D () C:\Users\Philipp\Documents\Adobe
2015-02-12 17:14 - 2010-12-05 16:23 - 00000000 ____D () C:\Users\Philipp\Documents\ifolor Designer Dateien
2015-02-12 17:14 - 2010-07-24 11:31 - 00000000 ____D () C:\Users\Philipp\Documents\Fotobuch Thailand_mcf-Dateien
2015-02-12 17:14 - 2010-04-24 10:40 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Tific
2015-02-12 17:14 - 2010-03-28 15:50 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\skypePM
2015-02-12 17:14 - 2010-03-28 15:46 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Skype
2015-02-12 17:14 - 2010-03-13 21:07 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Opera
2015-02-12 17:14 - 2010-02-08 11:01 - 00000000 ____D () C:\Users\Philipp\Documents\Eidos
2015-02-12 17:14 - 2009-12-30 15:08 - 00000000 ____D () C:\Users\Philipp\Documents\Fax
2015-02-12 17:14 - 2009-12-15 09:03 - 00000000 ____D () C:\Users\Philipp\Documents\Call of Duty Save
2015-02-12 17:14 - 2009-11-22 20:10 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Template
2015-02-12 17:14 - 2009-11-18 20:27 - 00000000 ___RD () C:\Users\Philipp\AppData\Roaming\SecuROM
2015-02-12 17:14 - 2009-11-17 12:12 - 00000000 ____D () C:\Users\Philipp\Documents\Euro Truck Simulator
2015-02-12 17:14 - 2009-11-16 21:32 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\TuneUp Software
2015-02-12 17:14 - 2009-11-16 21:15 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Nero
2015-02-12 17:14 - 2009-11-16 12:06 - 00000000 ____D () C:\Users\Philipp\Documents\CyberLink
2015-02-12 17:14 - 2009-11-12 16:25 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Sony Corporation
2015-02-12 17:13 - 2012-03-26 20:53 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Spotify
2015-02-12 17:13 - 2011-01-12 10:14 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\elsterformular
2015-02-12 17:13 - 2010-12-01 20:27 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\ifolor
2015-02-12 17:13 - 2010-04-24 10:40 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Symantec
2015-02-12 17:13 - 2009-12-15 21:22 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Nero
2015-02-12 17:13 - 2009-12-15 21:18 - 00000000 ____D () C:\Users\Philipp\AppData\Local\PowerCinema
2015-02-12 17:13 - 2009-12-06 10:19 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\InterVideo
2015-02-12 17:13 - 2009-11-17 11:52 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\ArcSoft
2015-02-12 17:13 - 2009-11-17 11:41 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\FarmingSimulator2008
2015-02-12 17:13 - 2009-11-17 09:49 - 00000000 ____D () C:\Users\Philipp\AppData\Local\PunkBuster
2015-02-12 17:13 - 2009-11-16 20:04 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Omnifone_Ltd
2015-02-12 17:13 - 2009-11-16 19:45 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Mozilla
2015-02-12 17:13 - 2009-11-16 19:06 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\DAEMON Tools Lite
2015-02-12 17:13 - 2009-11-16 12:06 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\CyberLink
2015-02-12 17:13 - 2009-11-16 12:06 - 00000000 ____D () C:\Users\Philipp\AppData\Local\PowerDVDCox
2015-02-12 17:13 - 2009-11-16 12:06 - 00000000 ____D () C:\Users\Philipp\AppData\Local\PowerDVDCinema
2015-02-12 17:13 - 2009-11-13 21:28 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Macromedia
2015-02-12 17:13 - 2009-11-12 16:33 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Google
2015-02-12 17:13 - 2009-11-12 16:33 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\Adobe
2015-02-12 17:13 - 2009-11-12 16:27 - 00000000 ____D () C:\Users\Philipp\AppData\Roaming\ATI
2015-02-12 17:13 - 2009-11-12 16:27 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Sony_Corporation
2015-02-12 17:13 - 2009-11-12 16:25 - 00000000 ____D () C:\Users\Philipp\AppData\Local\VirtualStore
2015-02-12 17:10 - 2012-03-16 22:31 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Facebook
2015-02-12 17:10 - 2010-02-08 11:23 - 00000000 ____D () C:\Users\Philipp\AppData\Local\CrashDumps
2015-02-12 17:10 - 2010-02-08 10:57 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Downloaded Installations
2015-02-12 17:10 - 2009-11-17 11:53 - 00000000 ____D () C:\Users\Philipp\AppData\Local\ArcSoft
2015-02-12 17:10 - 2009-11-16 20:21 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Ahead
2015-02-12 17:10 - 2009-11-16 20:08 - 00000000 ____D () C:\Users\Philipp\AppData\Local\DFX
2015-02-12 17:10 - 2009-11-16 19:30 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Microsoft Help
2015-02-12 17:10 - 2009-11-16 12:12 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Cyberlink
2015-02-12 17:10 - 2009-11-14 21:12 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Adobe
2015-02-12 17:10 - 2009-11-12 16:40 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Microsoft Games
2015-02-12 17:10 - 2009-11-12 16:33 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Google
2015-02-12 17:10 - 2009-11-12 16:27 - 00000000 ____D () C:\Users\Philipp\AppData\Local\Broadcom
2015-02-12 17:10 - 2009-11-12 16:27 - 00000000 ____D () C:\Users\Philipp\AppData\Local\ATI
2015-02-12 16:58 - 2011-12-19 18:56 - 00000000 ____D () C:\Windows\system32\Macromed
2015-02-12 16:58 - 2011-06-24 19:03 - 00000000 ____D () C:\Windows\system32\EventProviders
2015-02-12 16:58 - 2009-11-17 11:39 - 00000000 ____D () C:\Windows\SysWOW64\AGEIA
2015-02-12 16:58 - 2009-11-16 19:23 - 00000000 ____D () C:\Windows\SysWOW64\spool
2015-02-12 16:58 - 2009-10-21 17:36 - 00000000 ____D () C:\Windows\{AEC0FEE6-3A76-44E1-97A2-5DA325DFC41C}
2015-02-12 16:58 - 2009-10-21 17:34 - 00000000 ____D () C:\Windows\SysWOW64\Macromed
2015-02-12 16:58 - 2009-08-18 17:58 - 00000000 ____D () C:\Windows\SysWOW64\SDA
2015-02-12 16:58 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sysprep
2015-02-12 16:58 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-12 16:57 - 2009-08-18 17:47 - 00000000 ____D () C:\Windows\InstDrvs
2015-02-12 16:57 - 2009-07-14 19:18 - 00000000 ____D () C:\Windows\ShellNew
2015-02-12 16:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system
2015-02-12 16:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Resources
2015-02-12 16:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\LiveKernelReports
2015-02-12 16:55 - 2012-03-25 15:10 - 00000000 ____D () C:\Users\Public\Downloads\Norton
2015-02-12 16:55 - 2011-10-08 16:24 - 00000000 ____D () C:\ProgramData\Firefly Studios
2015-02-12 16:55 - 2011-06-24 20:03 - 00000000 ____D () C:\Windows\CheckSur
2015-02-12 16:55 - 2011-01-12 10:14 - 00000000 ____D () C:\ProgramData\elsterformular
2015-02-12 16:55 - 2010-11-22 14:47 - 00000000 ____D () C:\ProgramData\Sun
2015-02-12 16:55 - 2010-07-23 22:11 - 00000000 ____D () C:\ProgramData\tmp
2015-02-12 16:55 - 2010-07-23 22:11 - 00000000 ____D () C:\ProgramData\hps
2015-02-12 16:55 - 2010-02-15 17:06 - 00000000 ____D () C:\ProgramData\DVD Shrink
2015-02-12 16:55 - 2010-02-08 10:38 - 00000000 ____D () C:\Windows\65F1CF6331E0450B96F34A88BE7361A6.TMP
2015-02-12 16:55 - 2010-01-01 20:51 - 00000000 ____D () C:\ProgramData\IEConfiguration1und1
2015-02-12 16:55 - 2009-11-24 09:57 - 00000000 ____D () C:\ProgramData\Symantec
2015-02-12 16:55 - 2009-11-24 09:57 - 00000000 ____D () C:\ProgramData\Norton
2015-02-12 16:55 - 2009-11-17 11:52 - 00000000 ____D () C:\ProgramData\ArcSoft
2015-02-12 16:55 - 2009-11-16 21:31 - 00000000 __SHD () C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2015-02-12 16:55 - 2009-11-16 21:31 - 00000000 ____D () C:\ProgramData\TuneUp Software
2015-02-12 16:55 - 2009-11-16 20:19 - 00000000 ____D () C:\ProgramData\Nero
2015-02-12 16:55 - 2009-11-16 20:06 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Roaming\Winamp
2015-02-12 16:55 - 2009-11-16 20:06 - 00000000 ____D () C:\Users\HomeGroupUser$
2015-02-12 16:55 - 2009-11-16 20:06 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Winamp
2015-02-12 16:55 - 2009-11-16 20:06 - 00000000 ____D () C:\Users\Gast
2015-02-12 16:55 - 2009-11-16 20:06 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Winamp
2015-02-12 16:55 - 2009-11-16 20:06 - 00000000 ____D () C:\Users\Administrator
2015-02-12 16:55 - 2009-11-16 20:06 - 00000000 ____D () C:\ProgramData\DFX
2015-02-12 16:55 - 2009-11-16 19:27 - 00000000 ____D () C:\ProgramData\FLEXnet
2015-02-12 16:55 - 2009-11-16 19:05 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2015-02-12 16:55 - 2009-11-16 12:02 - 00000000 ____D () C:\ProgramData\CyberLink
2015-02-12 16:55 - 2009-11-15 09:00 - 00000000 ____D () C:\ProgramData\CanonBJ
2015-02-12 16:55 - 2009-10-21 18:02 - 00000000 ____D () C:\ProgramData\Uninstall
2015-02-12 16:55 - 2009-10-21 18:02 - 00000000 ____D () C:\ProgramData\Sonic
2015-02-12 16:55 - 2009-10-21 18:02 - 00000000 ____D () C:\ProgramData\Skype
2015-02-12 16:55 - 2009-10-21 18:01 - 00000000 ____D () C:\ProgramData\MusicStation
2015-02-12 16:55 - 2009-10-21 17:54 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-12 16:55 - 2009-10-21 17:52 - 00000000 ____D () C:\ProgramData\SiteAdvisor
2015-02-12 16:55 - 2009-10-21 17:42 - 00000000 ____D () C:\ProgramData\McAfee
2015-02-12 16:55 - 2009-10-21 17:41 - 00000000 ____D () C:\ProgramData\Google
2015-02-12 16:55 - 2009-10-21 17:38 - 00000000 ____D () C:\ProgramData\ATI
2015-02-12 16:55 - 2009-10-21 17:31 - 00000000 ____D () C:\ProgramData\Adobe
2015-02-12 16:55 - 2009-08-18 19:12 - 00000000 ____D () C:\ProgramData\Sony Corporation
2015-02-12 16:55 - 2009-07-14 19:18 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-02-12 16:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Cursors
2015-02-12 16:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2015-02-12 16:54 - 2010-03-28 15:45 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-02-12 16:54 - 2010-02-05 19:39 - 00000000 ____D () C:\Program Files (x86)\Ubi Soft
2015-02-12 16:54 - 2009-12-18 10:43 - 00000000 ____D () C:\Program Files (x86)\SmartDVDCreator
2015-02-12 16:54 - 2009-11-16 19:57 - 00000000 ____D () C:\Program Files (x86)\Winamp
2015-02-12 16:54 - 2009-10-21 18:12 - 00000000 ____D () C:\Program Files (x86)\Windows Live SkyDrive
2015-02-12 16:54 - 2009-10-21 18:12 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2015-02-12 16:54 - 2009-10-21 18:09 - 00000000 ____D () C:\Program Files (x86)\VAIO FW screensavers
2015-02-12 16:54 - 2009-10-21 18:09 - 00000000 ____D () C:\Program Files (x86)\Sony Corporation
2015-02-12 16:54 - 2009-10-21 17:30 - 00000000 ____D () C:\Program Files (x86)\Sony
2015-02-12 16:54 - 2009-08-18 18:53 - 00000000 ____D () C:\Program Files (x86)\Realtek
2015-02-12 16:53 - 2012-05-22 02:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-02-12 16:53 - 2011-07-05 21:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2015-02-12 16:53 - 2011-07-05 21:49 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2015-02-12 16:53 - 2011-07-05 21:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2015-02-12 16:53 - 2010-07-23 21:51 - 00000000 ____D () C:\Program Files (x86)\Pixum
2015-02-12 16:53 - 2010-04-16 19:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-12 16:53 - 2010-02-08 10:51 - 00000000 ____D () C:\Program Files (x86)\OpenAL
2015-02-12 16:53 - 2009-11-16 20:19 - 00000000 ____D () C:\Program Files (x86)\Nero
2015-02-12 16:53 - 2009-11-16 19:43 - 00000000 ____D () C:\Program Files (x86)\MSECache
2015-02-12 16:53 - 2009-10-21 18:01 - 00000000 ____D () C:\Program Files (x86)\MusicStation
2015-02-12 16:53 - 2009-10-21 17:56 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2015-02-12 16:53 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2015-02-12 16:52 - 2011-03-25 10:26 - 00000000 ____D () C:\Program Files (x86)\McAfee Security Scan
2015-02-12 16:49 - 2011-10-02 20:21 - 00000000 ____D () C:\Program Files (x86)\IKEA HomePlanner
2015-02-12 16:49 - 2010-12-01 20:27 - 00000000 ____D () C:\Program Files (x86)\ifolor
2015-02-12 16:49 - 2009-12-27 20:47 - 00000000 ____D () C:\Program Files (x86)\Maxis
2015-02-12 16:49 - 2009-11-16 19:53 - 00000000 ____D () C:\Program Files (x86)\Lavalys
2015-02-12 16:49 - 2009-10-21 17:41 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-12 16:49 - 2009-08-18 17:59 - 00000000 ____D () C:\Program Files (x86)\InstallShield Installation Information
2015-02-12 16:49 - 2009-08-18 17:49 - 00000000 ____D () C:\Program Files (x86)\Intel
2015-02-12 16:45 - 2011-06-09 09:46 - 00000000 ____D () C:\Program Files (x86)\Franzis
2015-02-12 16:43 - 2011-10-01 11:39 - 00000000 ____D () C:\Program Files (x86)\Firefly Studios
2015-02-12 16:43 - 2011-01-12 10:13 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2015-02-12 16:43 - 2010-02-15 17:06 - 00000000 ____D () C:\Program Files (x86)\DVD Shrink
2015-02-12 16:42 - 2010-12-07 19:20 - 00000000 ____D () C:\Program Files (x86)\dm
2015-02-12 16:40 - 2010-02-15 14:17 - 00000000 ____D () C:\Program Files (x86)\AviSynth 2.5
2015-02-12 16:40 - 2010-02-15 14:17 - 00000000 ____D () C:\Program Files (x86)\Avi2Dvd
2015-02-12 16:40 - 2009-11-17 11:39 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2015-02-12 16:40 - 2009-10-21 17:41 - 00000000 ____D () C:\Program Files (x86)\ArcSoft
2015-02-12 16:40 - 2009-10-21 17:38 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2015-02-12 16:40 - 2009-10-21 17:31 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-02-12 16:38 - 2012-05-22 02:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-02-12 16:38 - 2011-07-05 21:49 - 00000000 ____D () C:\Program Files\Microsoft Office
2015-02-12 16:38 - 2009-11-16 19:20 - 00000000 ____D () C:\Program Files\Common Files\Macrovision Shared
2015-02-12 16:38 - 2009-11-16 19:20 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-02-12 16:38 - 2009-11-16 11:55 - 00000000 ____D () C:\Program Files\WinRAR
2015-02-12 16:38 - 2009-10-21 17:41 - 00000000 ____D () C:\Program Files\Sony
2015-02-12 16:38 - 2009-08-18 19:11 - 00000000 ____D () C:\Program Files\Common Files\Sony Shared
2015-02-12 16:38 - 2009-08-18 17:57 - 00000000 ____D () C:\Program Files\WIDCOMM
2015-02-12 16:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-02-12 16:37 - 2009-11-16 19:26 - 00000000 ____D () C:\Program Files\Adobe
2015-02-12 16:28 - 2009-07-14 06:38 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG
2015-02-12 16:28 - 2009-07-14 06:32 - 00028672 _____ () C:\Windows\system32\config\BCD-Template
2015-02-12 15:47 - 2009-10-21 17:34 - 01461888 _____ () C:\Windows\WindowsUpdate (1).log
2015-02-12 13:41 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-02-11 23:53 - 2009-07-14 03:34 - 00000546 _____ () C:\Windows\win.ini
2015-02-10 19:42 - 2009-11-16 19:06 - 00386680 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys
2015-02-10 16:25 - 2011-05-19 20:49 - 00000000 ____D () C:\Update
2015-02-10 12:05 - 2009-08-18 17:56 - 00089810 _____ () C:\Windows\DPINST.LOG
2015-02-09 16:52 - 2009-11-16 11:59 - 00000000 ____D () C:\ProgramData\Temp
2015-02-09 14:27 - 2009-08-18 18:53 - 00000000 ____D () C:\Program Files (x86)\Temp
2015-02-09 13:40 - 2009-10-21 17:41 - 00000000 ____D () C:\Program Files\Google
2015-02-09 05:38 - 2010-03-28 15:47 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-09 05:38 - 2010-03-28 15:47 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2009-12-05 17:54 - 2009-12-13 12:12 - 0000137 _____ () C:\Users\Philipp\AppData\Roaming\default.pls
2009-11-15 09:03 - 2009-11-15 09:03 - 0000000 _____ () C:\Users\Philipp\AppData\Roaming\wklnhst.dat
2015-02-12 16:33 - 2015-02-12 16:33 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-12 16:30

==================== End Of Log ============================
--- --- ---



Wenn ich jetzt noch Office zum Laufen kriege, dass sich jetzt wegen eines anderen VCRedist beschwert, bin ich glücklich!

cosinus 13.02.2015 09:23
FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3325936630-1017222350-922930496-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
Toolbar: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {10740E9E-D0A0-40E6-96CD-FB8CD206656C} URL = http://suche.web.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {57F52502-BDED-FDD7-0423-6082F8A06F93} URL = http://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {61C9CA60-FDF7-4486-A7F3-119C3435378B} URL = http://search.1und1.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {71477CCD-BFF5-49B0-A38F-81E56D105462} URL = http://suche.gmx.net/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {9ED2C43A-B711-41A9-828F-A0FB125F4620} URL = http://go.web.de/suchbox/amazon/?keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {F552487D-6416-4302-84A8-018BB61CBD6C} URL = http://go.web.de/suchbox/smartshopping/?searchText={searchTerms}&mc=searchplugin@suche@msie.suche@preisvergleich
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
FF Extension: Avira Browser Safety - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\GnlWzHEK.default\Extensions\abs@avira.com [2015-02-09]
CHR Extension: (Avira Browserschutz) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-09]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
C:\Windows\{AEC0FEE6-3A76-44E1-97A2-5DA325DFC41C}
C:\Windows\65F1CF6331E0450B96F34A88BE7361A6.TMP
C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
EmptyTemp:
Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


fensterkreuz 13.02.2015 12:12
Hier ist das Ergebnis:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-02-2015
Ran by Philipp at 2015-02-13 12:02:29 Run:1
Running from C:\Users\Philipp\Desktop
Loaded Profiles: Philipp (Available profiles: Philipp)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3325936630-1017222350-922930496-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
Toolbar: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {10740E9E-D0A0-40E6-96CD-FB8CD206656C} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {57F52502-BDED-FDD7-0423-6082F8A06F93} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {61C9CA60-FDF7-4486-A7F3-119C3435378B} URL = hxxp://search.1und1.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {71477CCD-BFF5-49B0-A38F-81E56D105462} URL = hxxp://suche.gmx.net/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {9ED2C43A-B711-41A9-828F-A0FB125F4620} URL = hxxp://go.web.de/suchbox/amazon/?keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3325936630-1017222350-922930496-1000 -> {F552487D-6416-4302-84A8-018BB61CBD6C} URL = hxxp://go.web.de/suchbox/smartshopping/?searchText={searchTerms}&mc=searchplugin@suche@msie.suche@preisvergleich
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
FF Extension: Avira Browser Safety - C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\GnlWzHEK.default\Extensions\abs@avira.com [2015-02-09]
CHR Extension: (Avira Browserschutz) - C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-09]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
C:\Windows\{AEC0FEE6-3A76-44E1-97A2-5DA325DFC41C}
C:\Windows\65F1CF6331E0450B96F34A88BE7361A6.TMP
C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
EmptyTemp:
Hosts:
       
*****************

"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-3325936630-1017222350-922930496-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\S-1-5-21-3325936630-1017222350-922930496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
"HKU\S-1-5-21-3325936630-1017222350-922930496-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{10740E9E-D0A0-40E6-96CD-FB8CD206656C}" => Key deleted successfully.
HKCR\CLSID\{10740E9E-D0A0-40E6-96CD-FB8CD206656C} => Key not found.
"HKU\S-1-5-21-3325936630-1017222350-922930496-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{57F52502-BDED-FDD7-0423-6082F8A06F93}" => Key deleted successfully.
HKCR\CLSID\{57F52502-BDED-FDD7-0423-6082F8A06F93} => Key not found.
"HKU\S-1-5-21-3325936630-1017222350-922930496-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{61C9CA60-FDF7-4486-A7F3-119C3435378B}" => Key deleted successfully.
HKCR\CLSID\{61C9CA60-FDF7-4486-A7F3-119C3435378B} => Key not found.
"HKU\S-1-5-21-3325936630-1017222350-922930496-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{71477CCD-BFF5-49B0-A38F-81E56D105462}" => Key deleted successfully.
HKCR\CLSID\{71477CCD-BFF5-49B0-A38F-81E56D105462} => Key not found.
"HKU\S-1-5-21-3325936630-1017222350-922930496-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9ED2C43A-B711-41A9-828F-A0FB125F4620}" => Key deleted successfully.
HKCR\CLSID\{9ED2C43A-B711-41A9-828F-A0FB125F4620} => Key not found.
"HKU\S-1-5-21-3325936630-1017222350-922930496-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F552487D-6416-4302-84A8-018BB61CBD6C}" => Key deleted successfully.
HKCR\CLSID\{F552487D-6416-4302-84A8-018BB61CBD6C} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
"HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\GnlWzHEK.default\Extensions\abs@avira.com => Moved successfully.
C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk => Moved successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
C:\Windows\{AEC0FEE6-3A76-44E1-97A2-5DA325DFC41C} => Moved successfully.
C:\Windows\65F1CF6331E0450B96F34A88BE7361A6.TMP => Moved successfully.
C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC} => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 330.5 MB temporary data.


The system needed a reboot.

==== End of Fixlog 12:04:48 ====

cosinus 13.02.2015 12:25
Dann mal Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


fensterkreuz 14.02.2015 02:48
Sieht soweit vielversprechend aus.


MBAM:

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 13.02.2015
Suchlauf-Zeit: 12:56:54
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.02.11.02
Rootkit Datenbank: v2015.02.03.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Philipp

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 458299
Verstrichene Zeit: 47 Min, 57 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Mit ESET habe ich wegen einer zu geringen Bandbreite gerade so ein Problem, das Log liefere ich nach, sobald es fertig ist.


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:47 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19