Trojaner-Board - entfernen W32 blaster worm

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - entfernen W32 blaster worm (https://www.trojaner-board.de/139921-entfernen-w32-blaster-worm.html)

Hallo Leo,

habe wie beschrieben den Rechner im angesicherten Modus mit Netzwerktreibern gestartet. Allerdings wird nur ein File erzeugt.

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-08-2013

Ran by PM (administrator) on 17-08-2013 12:48:01

Running from C:\Users\PM\Desktop

Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 7

Boot Mode: Safe Mode (with Networking)
 

==================== Processes (Whitelisted) ===================
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2006-09-28] (Hewlett-Packard Company)

HKLM\...\Run: [KBD] - C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()

HKLM\...\Run: [OsdMaestro] - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [118784 2007-02-15] (OsdMaestro)

HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4874240 2008-01-15] (Realtek Semiconductor)

HKLM\...\Run: [NeroCheck] - C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)

HKLM\...\Run: [Symantec PIF AlertEng] - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [583048 2008-01-29] (Symantec Corporation)

HKLM\...\Run: [BrMfcWnd] - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1089536 2008-02-19] (Brother Industries, Ltd.)

HKLM\...\Run: [ControlCenter3] - C:\Program Files\Brother\ControlCenter3\brctrcen.exe [86016 2007-12-21] (Brother Industries, Ltd.)

HKLM\...\Run: [PaperPort PTD] - C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2007-10-11] (Nuance Communications, Inc.)

HKLM\...\Run: [IndexSearch] - C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2007-10-11] (Nuance Communications, Inc.)

HKLM\...\Run: [NvSvc] - C:\Windows\system32\nvsvc.dll [92704 2008-01-10] (NVIDIA Corporation)

HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [8530464 2008-01-10] (NVIDIA Corporation)

HKLM\...\Run: [NvMediaCenter] - C:\Windows\system32\NvMcTray.dll [88608 2008-01-10] (NVIDIA Corporation)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)

HKLM\...\Run: [PDFPrint] - C:\Program Files\PDF24\pdf24.exe [162856 2013-06-10] (Geek Software GmbH)

HKLM\...\Run: [FromDocToPDF Search Scope Monitor] - C:\PROGRA~1\FROMDO~2\bar\1.bin\65srchmn.exe [44784 2013-07-09] (MindSpark)

HKLM\...\Run: [FromDocToPDF_65 Browser Plugin Loader] - C:\PROGRA~1\FROMDO~2\bar\1.bin\65brmon.exe [30096 2013-07-09] (VER_COMPANY_NAME)

HKLM\...\Run: [TkBellExe] - C:\Program Files\Common Files\Real\Update_OB\realsched.exe [185896 2007-06-18] (RealNetworks, Inc.)

HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44168 2007-03-07] (soft thinks)

HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-18] (Microsoft Corporation)

HKCU\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1644088 2009-08-05] (Hewlett-Packard)

HKCU\...\Run: [Google Update*] -  [x] <===== ATTENTION (ZeroAccess rootkit hidden path)

HKCU\...\Run: [Internet Security] - C:\Users\PM\AppData\Roaming\msprotection.exe [845312 2013-08-17] (Peter Pawlowski)

HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-18] (Microsoft Corporation)

HKU\Default\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [ 2009-08-05] (Hewlett-Packard)

HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-18] (Microsoft Corporation)

HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [ 2009-08-05] (Hewlett-Packard)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

Startup: C:\Users\PM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=desktop

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKLM - {13ACC3AB-22DA-47E2-854A-F3A72E8F4FF7} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06

SearchScopes: HKLM - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - DefaultScope {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - {13ACC3AB-22DA-47E2-854A-F3A72E8F4FF7} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06

SearchScopes: HKCU - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - {AE67D855-EA9B-4626-9C96-0939A094504C} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}

BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File

Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKCU -No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File

Toolbar: HKCU -&Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

Handler: haufereader - No CLSID Value - 

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msdaipp - No CLSID Value - 

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [147456] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 83.169.185.33 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF Plugin: @FromDocToPDF_65.com/Plugin - C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll (MindSpark)

FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=6.0.11.2571 - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=1.0.2.2629 - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=6.0.12.1739 - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @veetle.com/vbp;version=0.9.16 - C:\Program Files\Veetle\VLCBroadcast\npvbp.dll No File

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\ask-web-search.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-11.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-12.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-13.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-14.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-15.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-16.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-17.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-18.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-19.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-20.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\searchplugins-backup

FF Extension: No Name - C:\Users\PM\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com

FF Extension: No Name - C:\Users\PM\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: Yahoo! Toolbar - C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF Extension: pdfforge - C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\Extensions\pdfforge@mybrowserbar.com

FF Extension: No Name - C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi

FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF HKLM\...\Firefox\Extensions: [65ffxtbr@FromDocToPDF_65.com] C:\Program Files\FromDocToPDF_65\bar\1.bin

FF Extension: FromDocToPDF - C:\Program Files\FromDocToPDF_65\bar\1.bin
 

Chrome: 

=======

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)

CHR Plugin: (MindSpark Toolbar Platform Plugin Stub) - C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll (MindSpark)

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

CHR Plugin: (MetaStream 3 Plugin) - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Extension: (Docs) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0

CHR Extension: (Google Drive) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0

CHR Extension: (YouTube) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0

CHR Extension: (Google Search) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0

CHR Extension: (Gmail) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
 

========================== Services (Whitelisted) =================
 

S2 FromDocToPDF_65Service; C:\PROGRA~1\FROMDO~2\bar\1.bin\65barsvc.exe [42504 2013-07-09] (COMPANYVERS_NAME)

S2 LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll [537992 2008-04-10] (Symantec Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)

S2 SymAppCore; c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [47712 2007-01-04] (Symantec Corporation)

S2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [1514304 2011-12-14] (TuneUp Software)

S2 LiveUpdate Notice Ex; "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
 

==================== Drivers (Whitelisted) ====================
 

S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)

S1 IDSvix86; C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080407.003\IDSvix86.sys [261680 2008-02-13] (Symantec Corporation)

S0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-31] (Duplex Secure Ltd.)

S3 SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [279088 2007-12-01] (Symantec Corporation)

S3 SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [317616 2007-12-01] (Symantec Corporation)

S1 SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [43696 2007-12-01] (Symantec Corporation)

S3 SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [12848 2007-10-30] (Symantec Corporation)

S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [123952 2008-02-13] (Symantec Corporation)

S3 SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [145968 2007-10-30] (Symantec Corporation)

S3 SYMIDS; C:\Windows\System32\Drivers\SYMIDS.SYS [39856 2007-10-30] (Symantec Corporation)

S3 SYMNDISV; C:\Windows\System32\Drivers\SYMNDISV.SYS [37936 2007-10-30] (Symantec Corporation)

S3 SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [27696 2007-10-30] (Symantec Corporation)

S1 SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [191536 2007-10-30] (Symantec Corporation)

S3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [10064 2011-12-12] (TuneUp Software)

S3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-01] (America Online, Inc.)

S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]

S3 catchme; \??\C:\Users\PM\AppData\Local\Temp\catchme.sys [x]

S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20080413.003\NAVENG.SYS [x]

S3 NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20080413.003\NAVEX15.SYS [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-17 12:46 - 2013-08-17 12:36 - 01068993 _____ (Farbar) C:\Users\PM\Desktop\FRST.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00845312 _____ (Peter Pawlowski) C:\Users\PM\AppData\Roaming\msprotection.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00240640 _____ C:\Users\PM\firefox.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00000713 _____ C:\Users\PM\Desktop\Internet Security 2013.lnk

2013-08-17 10:43 - 2013-08-17 10:43 - 00000000 _____ C:\Users\PM\windowsupdate.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00000000 _____ C:\Users\PM\msconfig.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00000000 _____ C:\Users\PM\jucheck.exe

2013-08-17 10:26 - 2013-08-17 10:26 - 00009725 _____ C:\ComboFix.txt

2013-08-17 10:11 - 2013-08-17 10:27 - 00000000 ____D C:\ComboFix

2013-08-17 10:11 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-17 10:11 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-17 10:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-17 10:10 - 2013-08-17 10:27 - 00000000 ____D C:\Qoobox

2013-08-17 10:04 - 2013-08-17 10:09 - 05105390 ____R (Swearware) C:\Users\PM\Desktop\ComboFix.exe

2013-08-17 08:59 - 2013-08-17 10:25 - 00000000 ____D C:\Windows\erdnt

2013-08-17 08:42 - 2013-08-17 08:44 - 00075013 _____ C:\AdwCleaner[S1].txt

2013-08-17 08:42 - 2013-08-17 08:44 - 00000157 _____ C:\Windows\DeleteOnReboot.bat

2013-08-17 00:21 - 2013-08-17 00:21 - 00000000 ____D C:\_OTL

2013-08-16 23:55 - 2013-08-16 23:55 - 00000000 ____D C:\FRST

2013-08-16 20:07 - 2013-08-16 20:07 - 00000000 ____D C:\Users\PM\Desktop\Wintrack

2013-08-16 19:26 - 2013-08-16 19:26 - 00000527 _____ C:\Users\PM\Desktop\Denis - Verknüpfung.lnk

2013-08-16 19:23 - 2013-08-16 19:24 - 00000000 ____D C:\Users\PM\Desktop\Bewerbung

2013-08-16 19:23 - 2013-08-16 19:23 - 00000000 ____D C:\Users\PM\Desktop\Anschreiben, Status

2013-08-16 06:34 - 2013-08-16 06:34 - 00080248 _____ C:\OTL1.txt

2013-08-16 06:34 - 2013-08-16 06:34 - 00034466 _____ C:\Extras1.txt

2013-08-16 06:30 - 2013-08-16 18:32 - 00043352 _____ C:\Extras.Txt

2013-08-16 06:29 - 2013-08-16 18:56 - 00069774 _____ C:\OTL.Txt

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\NIS60dDE.exe

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 613529.crdownload

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 281099.crdownload

2013-08-14 23:33 - 2013-08-14 23:33 - 00000000 ____D C:\Program Files\Common Files\Bitdefender

2013-08-12 19:39 - 2013-08-17 13:47 - 00000304 _____ C:\Windows\Tasks\pmrsud.job

2013-08-12 19:39 - 2013-08-12 19:39 - 00460800 __RSH C:\Windows\system32\KBDYCLP.dll

2013-08-06 13:55 - 2013-08-06 13:55 - 00004096 ____H C:\Users\PM\AppData\Local\keyfile3.drm
 

==================== One Month Modified Files and Folders =======
 

2013-08-17 13:57 - 2007-07-16 03:22 - 01857154 _____ C:\Windows\WindowsUpdate.log

2013-08-17 13:57 - 2006-11-02 15:01 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-17 13:57 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-17 13:57 - 2006-11-02 14:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-17 13:57 - 2006-11-02 14:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-17 13:52 - 2006-11-02 12:33 - 01517318 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-17 13:47 - 2013-08-12 19:39 - 00000304 _____ C:\Windows\Tasks\pmrsud.job

2013-08-17 13:47 - 2010-01-31 08:56 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-17 13:47 - 2007-06-18 13:39 - 00000000 ____D C:\Windows\SMINST

2013-08-17 12:36 - 2013-08-17 12:46 - 01068993 _____ (Farbar) C:\Users\PM\Desktop\FRST.exe

2013-08-17 11:43 - 2013-08-17 13:48 - 00139264 _____ C:\Users\PM\Desktop\SystemLook.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00845312 _____ (Peter Pawlowski) C:\Users\PM\AppData\Roaming\msprotection.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00240640 _____ C:\Users\PM\firefox.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00000713 _____ C:\Users\PM\Desktop\Internet Security 2013.lnk

2013-08-17 10:43 - 2013-08-17 10:43 - 00000000 _____ C:\Users\PM\windowsupdate.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00000000 _____ C:\Users\PM\msconfig.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00000000 _____ C:\Users\PM\jucheck.exe

2013-08-17 10:43 - 2007-09-01 15:57 - 00000000 ____D C:\Users\PM

2013-08-17 10:32 - 2007-06-18 13:41 - 00411156 _____ C:\Windows\PFRO.log

2013-08-17 10:27 - 2013-08-17 10:11 - 00000000 ____D C:\ComboFix

2013-08-17 10:27 - 2013-08-17 10:10 - 00000000 ____D C:\Qoobox

2013-08-17 10:27 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default

2013-08-17 10:27 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public

2013-08-17 10:26 - 2013-08-17 10:26 - 00009725 _____ C:\ComboFix.txt

2013-08-17 10:25 - 2013-08-17 08:59 - 00000000 ____D C:\Windows\erdnt

2013-08-17 10:24 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini

2013-08-17 10:09 - 2013-08-17 10:04 - 05105390 ____R (Swearware) C:\Users\PM\Desktop\ComboFix.exe

2013-08-17 10:08 - 2009-11-26 16:41 - 00000000 ____D C:\Users\PM\Tracing

2013-08-17 08:44 - 2013-08-17 08:42 - 00075013 _____ C:\AdwCleaner[S1].txt

2013-08-17 08:44 - 2013-08-17 08:42 - 00000157 _____ C:\Windows\DeleteOnReboot.bat

2013-08-17 08:20 - 2010-01-31 08:56 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-17 08:19 - 2008-08-25 22:46 - 00000412 ____H C:\Windows\Tasks\User_Feed_Synchronization-{45D4D7FF-D19B-4345-8B4E-5C1638791C24}.job

2013-08-17 00:21 - 2013-08-17 00:21 - 00000000 ____D C:\_OTL

2013-08-16 23:55 - 2013-08-16 23:55 - 00000000 ____D C:\FRST

2013-08-16 23:07 - 2009-08-30 14:52 - 00000000 ____D C:\Ablage Wolfgang

2013-08-16 22:26 - 2009-12-03 22:53 - 00000000 ____D C:\Users\PM\AppData\Roaming\WinTrack

2013-08-16 20:07 - 2013-08-16 20:07 - 00000000 ____D C:\Users\PM\Desktop\Wintrack

2013-08-16 19:26 - 2013-08-16 19:26 - 00000527 _____ C:\Users\PM\Desktop\Denis - Verknüpfung.lnk

2013-08-16 19:26 - 2010-08-22 17:55 - 00000000 ____D C:\Denis

2013-08-16 19:24 - 2013-08-16 19:23 - 00000000 ____D C:\Users\PM\Desktop\Bewerbung

2013-08-16 19:23 - 2013-08-16 19:23 - 00000000 ____D C:\Users\PM\Desktop\Anschreiben, Status

2013-08-16 18:56 - 2013-08-16 06:29 - 00069774 _____ C:\OTL.Txt

2013-08-16 18:32 - 2013-08-16 06:30 - 00043352 _____ C:\Extras.Txt

2013-08-16 13:33 - 2007-06-18 13:21 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-16 13:33 - 2006-11-02 12:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2013-08-16 13:32 - 2006-11-02 12:23 - 00000277 _____ C:\Windows\win.ini

2013-08-16 06:34 - 2013-08-16 06:34 - 00080248 _____ C:\OTL1.txt

2013-08-16 06:34 - 2013-08-16 06:34 - 00034466 _____ C:\Extras1.txt

2013-08-15 17:50 - 2008-03-09 14:34 - 00026624 _____ C:\Users\PM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\NIS60dDE.exe

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 613529.crdownload

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 281099.crdownload

2013-08-15 10:43 - 2011-06-08 16:38 - 00001356 _____ C:\Users\PM\AppData\Local\d3d9caps.dat

2013-08-14 23:33 - 2013-08-14 23:33 - 00000000 ____D C:\Program Files\Common Files\Bitdefender

2013-08-13 21:37 - 2007-06-18 13:20 - 00000000 ____D C:\Program Files\Microsoft Office

2013-08-13 11:54 - 2012-11-06 00:00 - 00000000 ____D C:\Users\PM\AppData\Local\Paint.NET

2013-08-13 09:35 - 2007-09-01 16:02 - 00000000 ____D C:\Users\PM\AppData\Local\Google

2013-08-12 19:39 - 2013-08-12 19:39 - 00460800 __RSH C:\Windows\system32\KBDYCLP.dll

2013-08-06 13:55 - 2013-08-06 13:55 - 00004096 ____H C:\Users\PM\AppData\Local\keyfile3.drm

2013-07-31 08:13 - 2007-09-01 16:01 - 00108136 _____ C:\Users\PM\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-31 08:11 - 2006-11-02 14:47 - 00400344 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-22 13:02 - 2012-02-21 20:01 - 00000310 _____ C:\Windows\Tasks\HPCeeScheduleForPM.job
 

Files to move or delete:

====================

ZeroAccess:

C:\Users\PM\AppData\Local\Google\Desktop\Install\{de9b0f9d-a697-0505-79ad-d01a3c1dbf87}

C:\Users\PM\firefox.exe

C:\Users\PM\jucheck.exe

C:\Users\PM\msconfig.exe

C:\Users\PM\windowsupdate.exe
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-17 15:39
 

==================== End Of Log ============================

--- --- ---

Gruß Roland

Hallo Roland,

du hast dich wieder neu infiziert. Verzichte bitte aufs Surfen mit diesem Rechner, bis wir hier ganz fertig sind und den Computer gegen einen neuerlichen Befall abgesichert haben.

Immer noch im abgesicherten Modus weiter:

Schritt 1

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Schritt 2

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

Log von Combofix
Log von FRST

Hallo Leo,

hier die beiden Files.

Combofix

Code:

Combofix Logfile:
 

        Code:


        
ComboFix 13-08-16.03 - PM 17.08.2013  16:41:32.2.2 - x86 NETWORK

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.2046.1576 [GMT 2:00]

ausgeführt von:: c:\users\PM\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\ntuser.dat

c:\users\PM\AppData\Local\Google\Desktop\Install

c:\users\PM\AppData\Local\Google\Desktop\Install\{de9b0f9d-a697-0505-79ad-d01a3c1dbf87}\C3C1~1\01C8~1\CFFE~1\{de9b0f9d-a697-0505-79ad-d01a3c1dbf87}\@

c:\users\PM\AppData\Local\Google\Desktop\Install\{de9b0f9d-a697-0505-79ad-d01a3c1dbf87}\C3C1~1\01C8~1\CFFE~1\{de9b0f9d-a697-0505-79ad-d01a3c1dbf87}\GoogleUpdate.exe

c:\users\PM\AppData\Roaming\msprotection.exe

c:\users\PM\firefox.exe

c:\users\PM\jucheck.exe

c:\users\PM\msconfig.exe

c:\users\PM\WindowsUpdate.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-07-17 bis 2013-08-17  ))))))))))))))))))))))))))))))

.

.

2013-08-17 14:52 . 2013-08-17 14:52        --------        d-----w-        c:\users\PM\AppData\Local\temp

2013-08-17 14:52 . 2013-08-17 14:52        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-08-17 06:42 . 2013-08-17 06:44        157        ----a-w-        c:\windows\DeleteOnReboot.bat

2013-08-16 22:21 . 2013-08-16 22:21        --------        d-----w-        C:\_OTL

2013-08-16 21:55 . 2013-08-16 21:55        --------        d-----w-        C:\FRST

2013-08-14 21:33 . 2013-08-14 21:33        --------        d-----w-        c:\program files\Common Files\Bitdefender

2013-08-13 06:38 . 2013-07-02 06:54        7143960        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{805F95FA-AD76-409B-AC6B-C755746A9B17}\mpengine.dll

2013-08-12 17:39 . 2013-08-12 17:39        460800        --sha-r-        c:\windows\system32\KBDYCLP.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]

"HPADVISOR"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-08-05 1644088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]

"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]

"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]

"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]

"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]

"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-02-19 1089536]

"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]

"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]

"NvSvc"="c:\windows\system32\nvsvc.dll" [2008-01-10 92704]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-10 8530464]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-01-10 88608]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2013-06-10 162856]

"FromDocToPDF Search Scope Monitor"="c:\progra~1\FROMDO~2\bar\1.bin\65srchmn.exe" [2013-07-09 44784]

"FromDocToPDF_65 Browser Plugin Loader"="c:\progra~1\FROMDO~2\bar\1.bin\65brmon.exe" [2013-07-09 30096]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-06-18 185896]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-07 44168]

.

c:\users\PM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LexwareInfoService]

2010-09-15 08:11        339312        ----a-w-        c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

2010-04-16 21:12        3872080        ----a-w-        c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

2011-01-21 13:54        1242448        ----a-w-        c:\program files\Steam\Steam.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"

"LexwareInfoService"=c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe /autostart

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-08-01 12:20        1173456        ----a-w-        c:\program files\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 06:56]

.

2013-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 06:56]

.

2013-07-22 c:\windows\Tasks\HPCeeScheduleForPM.job

- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-06-18 09:56]

.

2013-08-17 c:\windows\Tasks\pmrsud.job

- c:\windows\system32\KBDYCLP.dll [2013-08-12 17:39]

.

2013-08-17 c:\windows\Tasks\User_Feed_Synchronization-{45D4D7FF-D19B-4345-8B4E-5C1638791C24}.job

- c:\windows\system32\msfeedssync.exe [2010-05-24 21:33]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=desktop

uInternet Settings,ProxyOverride = *.local

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: {{0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - {E601996F-E400-41CA-804B-CD6373A7EEE2} -

TCP: DhcpNameServer = 83.169.185.33 192.168.0.1

FF - ProfilePath - c:\users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\

FF - ExtSQL: 2013-07-09 21:17; 65ffxtbr@FromDocToPDF_65.com; c:\users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\extensions\65ffxtbr@FromDocToPDF_65.com

FF - ExtSQL: !HIDDEN! 2009-08-08 08:31; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - ExtSQL: !HIDDEN! 2013-07-09 21:17; 65ffxtbr@FromDocToPDF_65.com; c:\program files\FromDocToPDF_65\bar\1.bin

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKCU-Run-Internet Security - c:\users\PM\AppData\Roaming\msprotection.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2013-08-17 16:52

Windows 6.0.6001 Service Pack 1 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Zeit der Fertigstellung: 2013-08-17  16:54:31

ComboFix-quarantined-files.txt  2013-08-17 14:54

ComboFix2.txt  2013-08-17 08:26

.

Vor Suchlauf: 24 Verzeichnis(se), 329.893.208.064 Bytes frei

Nach Suchlauf: 25 Verzeichnis(se), 329.829.019.648 Bytes frei

.

- - End Of File - - CC30BC5EA6DF4981F8F02C87AFE74EFD

 
--- --- ---

8913823FF508CCF109DB74B636C301DA

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-08-2013

Ran by PM (administrator) on 17-08-2013 16:56:23

Running from C:\Users\PM\Desktop

Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 7

Boot Mode: Safe Mode (with Networking)
 

==================== Processes (Whitelisted) ===================
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2006-09-28] (Hewlett-Packard Company)

HKLM\...\Run: [KBD] - C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()

HKLM\...\Run: [OsdMaestro] - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [118784 2007-02-15] (OsdMaestro)

HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4874240 2008-01-15] (Realtek Semiconductor)

HKLM\...\Run: [NeroCheck] - C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)

HKLM\...\Run: [Symantec PIF AlertEng] - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [583048 2008-01-29] (Symantec Corporation)

HKLM\...\Run: [BrMfcWnd] - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1089536 2008-02-19] (Brother Industries, Ltd.)

HKLM\...\Run: [ControlCenter3] - C:\Program Files\Brother\ControlCenter3\brctrcen.exe [86016 2007-12-21] (Brother Industries, Ltd.)

HKLM\...\Run: [PaperPort PTD] - C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2007-10-11] (Nuance Communications, Inc.)

HKLM\...\Run: [IndexSearch] - C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2007-10-11] (Nuance Communications, Inc.)

HKLM\...\Run: [NvSvc] - C:\Windows\system32\nvsvc.dll [92704 2008-01-10] (NVIDIA Corporation)

HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [8530464 2008-01-10] (NVIDIA Corporation)

HKLM\...\Run: [NvMediaCenter] - C:\Windows\system32\NvMcTray.dll [88608 2008-01-10] (NVIDIA Corporation)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)

HKLM\...\Run: [PDFPrint] - C:\Program Files\PDF24\pdf24.exe [162856 2013-06-10] (Geek Software GmbH)

HKLM\...\Run: [FromDocToPDF Search Scope Monitor] - C:\PROGRA~1\FROMDO~2\bar\1.bin\65srchmn.exe [44784 2013-07-09] (MindSpark)

HKLM\...\Run: [FromDocToPDF_65 Browser Plugin Loader] - C:\PROGRA~1\FROMDO~2\bar\1.bin\65brmon.exe [30096 2013-07-09] (VER_COMPANY_NAME)

HKLM\...\Run: [TkBellExe] - C:\Program Files\Common Files\Real\Update_OB\realsched.exe [185896 2007-06-18] (RealNetworks, Inc.)

HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44168 2007-03-07] (soft thinks)

HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-18] (Microsoft Corporation)

HKCU\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1644088 2009-08-05] (Hewlett-Packard)

HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-18] (Microsoft Corporation)

HKU\Default\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [ 2009-08-05] (Hewlett-Packard)

HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-18] (Microsoft Corporation)

HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [ 2009-08-05] (Hewlett-Packard)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

Startup: C:\Users\PM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=desktop

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKLM - {13ACC3AB-22DA-47E2-854A-F3A72E8F4FF7} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06

SearchScopes: HKLM - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - DefaultScope {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - {13ACC3AB-22DA-47E2-854A-F3A72E8F4FF7} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06

SearchScopes: HKCU - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - {AE67D855-EA9B-4626-9C96-0939A094504C} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}

BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File

Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKCU -No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File

Toolbar: HKCU -&Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

Handler: haufereader - No CLSID Value - 

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msdaipp - No CLSID Value - 

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [147456] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 83.169.185.33 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF Plugin: @FromDocToPDF_65.com/Plugin - C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll (MindSpark)

FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=6.0.11.2571 - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=1.0.2.2629 - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=6.0.12.1739 - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @veetle.com/vbp;version=0.9.16 - C:\Program Files\Veetle\VLCBroadcast\npvbp.dll No File

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\ask-web-search.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-11.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-12.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-13.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-14.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-15.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-16.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-17.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-18.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-19.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-20.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\searchplugins-backup

FF Extension: No Name - C:\Users\PM\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com

FF Extension: No Name - C:\Users\PM\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: Yahoo! Toolbar - C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF Extension: pdfforge - C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\Extensions\pdfforge@mybrowserbar.com

FF Extension: No Name - C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi

FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF HKLM\...\Firefox\Extensions: [65ffxtbr@FromDocToPDF_65.com] C:\Program Files\FromDocToPDF_65\bar\1.bin

FF Extension: FromDocToPDF - C:\Program Files\FromDocToPDF_65\bar\1.bin
 

Chrome: 

=======

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)

CHR Plugin: (MindSpark Toolbar Platform Plugin Stub) - C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll (MindSpark)

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

CHR Plugin: (MetaStream 3 Plugin) - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Extension: (Docs) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0

CHR Extension: (Google Drive) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0

CHR Extension: (YouTube) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0

CHR Extension: (Google Search) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0

CHR Extension: (Gmail) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
 

========================== Services (Whitelisted) =================
 

S2 FromDocToPDF_65Service; C:\PROGRA~1\FROMDO~2\bar\1.bin\65barsvc.exe [42504 2013-07-09] (COMPANYVERS_NAME)

S2 LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll [537992 2008-04-10] (Symantec Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)

S2 SymAppCore; c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [47712 2007-01-04] (Symantec Corporation)

S2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [1514304 2011-12-14] (TuneUp Software)

S2 LiveUpdate Notice Ex; "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
 

==================== Drivers (Whitelisted) ====================
 

S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)

S1 IDSvix86; C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080407.003\IDSvix86.sys [261680 2008-02-13] (Symantec Corporation)

S0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-31] (Duplex Secure Ltd.)

S3 SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [279088 2007-12-01] (Symantec Corporation)

S3 SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [317616 2007-12-01] (Symantec Corporation)

S1 SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [43696 2007-12-01] (Symantec Corporation)

S3 SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [12848 2007-10-30] (Symantec Corporation)

S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [123952 2008-02-13] (Symantec Corporation)

S3 SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [145968 2007-10-30] (Symantec Corporation)

S3 SYMIDS; C:\Windows\System32\Drivers\SYMIDS.SYS [39856 2007-10-30] (Symantec Corporation)

S3 SYMNDISV; C:\Windows\System32\Drivers\SYMNDISV.SYS [37936 2007-10-30] (Symantec Corporation)

S3 SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [27696 2007-10-30] (Symantec Corporation)

S1 SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [191536 2007-10-30] (Symantec Corporation)

S3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [10064 2011-12-12] (TuneUp Software)

S3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-01] (America Online, Inc.)

S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]

R3 catchme; \??\C:\Users\PM\AppData\Local\Temp\catchme.sys [x]

S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20080413.003\NAVENG.SYS [x]

S3 NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20080413.003\NAVEX15.SYS [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

S3 USBAAPL; System32\Drivers\usbaapl.sys [x]

U3 mbr; \??\C:\ComboFix\mbr.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-17 16:54 - 2013-08-17 16:54 - 00009694 _____ C:\ComboFix.txt

2013-08-17 13:48 - 2013-08-17 11:43 - 00139264 _____ C:\Users\PM\Desktop\SystemLook.exe

2013-08-17 12:46 - 2013-08-17 12:36 - 01068993 _____ (Farbar) C:\Users\PM\Desktop\FRST.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00000713 _____ C:\Users\PM\Desktop\Internet Security 2013.lnk

2013-08-17 10:11 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-17 10:11 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-17 10:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-17 10:10 - 2013-08-17 16:54 - 00000000 ____D C:\Qoobox

2013-08-17 10:04 - 2013-08-17 10:09 - 05105390 ____R (Swearware) C:\Users\PM\Desktop\ComboFix.exe

2013-08-17 08:59 - 2013-08-17 10:25 - 00000000 ____D C:\Windows\erdnt

2013-08-17 08:42 - 2013-08-17 08:44 - 00075013 _____ C:\AdwCleaner[S1].txt

2013-08-17 08:42 - 2013-08-17 08:44 - 00000157 _____ C:\Windows\DeleteOnReboot.bat

2013-08-17 00:21 - 2013-08-17 00:21 - 00000000 ____D C:\_OTL

2013-08-16 23:55 - 2013-08-16 23:55 - 00000000 ____D C:\FRST

2013-08-16 20:07 - 2013-08-16 20:07 - 00000000 ____D C:\Users\PM\Desktop\Wintrack

2013-08-16 19:26 - 2013-08-16 19:26 - 00000527 _____ C:\Users\PM\Desktop\Denis - Verknüpfung.lnk

2013-08-16 19:23 - 2013-08-16 19:24 - 00000000 ____D C:\Users\PM\Desktop\Bewerbung

2013-08-16 19:23 - 2013-08-16 19:23 - 00000000 ____D C:\Users\PM\Desktop\Anschreiben, Status

2013-08-16 06:34 - 2013-08-16 06:34 - 00080248 _____ C:\OTL1.txt

2013-08-16 06:34 - 2013-08-16 06:34 - 00034466 _____ C:\Extras1.txt

2013-08-16 06:30 - 2013-08-16 18:32 - 00043352 _____ C:\Extras.Txt

2013-08-16 06:29 - 2013-08-17 19:57 - 00061446 _____ C:\OTL.Txt

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\NIS60dDE.exe

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 613529.crdownload

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 281099.crdownload

2013-08-14 23:33 - 2013-08-14 23:33 - 00000000 ____D C:\Program Files\Common Files\Bitdefender

2013-08-12 19:39 - 2013-08-17 17:29 - 00000304 _____ C:\Windows\Tasks\pmrsud.job

2013-08-12 19:39 - 2013-08-12 19:39 - 00460800 __RSH C:\Windows\system32\KBDYCLP.dll

2013-08-06 13:55 - 2013-08-06 13:55 - 00004096 ____H C:\Users\PM\AppData\Local\keyfile3.drm
 

==================== One Month Modified Files and Folders =======
 

2013-08-17 20:00 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public

2013-08-17 19:57 - 2013-08-16 06:29 - 00061446 _____ C:\OTL.Txt

2013-08-17 17:30 - 2006-11-02 15:01 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-17 17:30 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-17 17:29 - 2013-08-12 19:39 - 00000304 _____ C:\Windows\Tasks\pmrsud.job

2013-08-17 17:29 - 2010-01-31 08:56 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-17 17:29 - 2007-06-18 13:39 - 00000000 ____D C:\Windows\SMINST

2013-08-17 17:29 - 2006-11-02 14:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-17 17:29 - 2006-11-02 14:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-17 16:54 - 2013-08-17 16:54 - 00009694 _____ C:\ComboFix.txt

2013-08-17 16:54 - 2013-08-17 10:10 - 00000000 ____D C:\Qoobox

2013-08-17 16:52 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini

2013-08-17 16:51 - 2007-09-01 15:57 - 00000000 ____D C:\Users\PM

2013-08-17 13:57 - 2007-07-16 03:22 - 01857154 _____ C:\Windows\WindowsUpdate.log

2013-08-17 13:52 - 2006-11-02 12:33 - 01517318 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-17 12:36 - 2013-08-17 12:46 - 01068993 _____ (Farbar) C:\Users\PM\Desktop\FRST.exe

2013-08-17 11:43 - 2013-08-17 13:48 - 00139264 _____ C:\Users\PM\Desktop\SystemLook.exe

2013-08-17 10:43 - 2013-08-17 10:43 - 00000713 _____ C:\Users\PM\Desktop\Internet Security 2013.lnk

2013-08-17 10:32 - 2007-06-18 13:41 - 00411156 _____ C:\Windows\PFRO.log

2013-08-17 10:27 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default

2013-08-17 10:25 - 2013-08-17 08:59 - 00000000 ____D C:\Windows\erdnt

2013-08-17 10:09 - 2013-08-17 10:04 - 05105390 ____R (Swearware) C:\Users\PM\Desktop\ComboFix.exe

2013-08-17 10:08 - 2009-11-26 16:41 - 00000000 ____D C:\Users\PM\Tracing

2013-08-17 08:44 - 2013-08-17 08:42 - 00075013 _____ C:\AdwCleaner[S1].txt

2013-08-17 08:44 - 2013-08-17 08:42 - 00000157 _____ C:\Windows\DeleteOnReboot.bat

2013-08-17 08:20 - 2010-01-31 08:56 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-17 08:19 - 2008-08-25 22:46 - 00000412 ____H C:\Windows\Tasks\User_Feed_Synchronization-{45D4D7FF-D19B-4345-8B4E-5C1638791C24}.job

2013-08-17 00:21 - 2013-08-17 00:21 - 00000000 ____D C:\_OTL

2013-08-16 23:55 - 2013-08-16 23:55 - 00000000 ____D C:\FRST

2013-08-16 23:07 - 2009-08-30 14:52 - 00000000 ____D C:\Ablage Wolfgang

2013-08-16 22:26 - 2009-12-03 22:53 - 00000000 ____D C:\Users\PM\AppData\Roaming\WinTrack

2013-08-16 20:07 - 2013-08-16 20:07 - 00000000 ____D C:\Users\PM\Desktop\Wintrack

2013-08-16 19:26 - 2013-08-16 19:26 - 00000527 _____ C:\Users\PM\Desktop\Denis - Verknüpfung.lnk

2013-08-16 19:26 - 2010-08-22 17:55 - 00000000 ____D C:\Denis

2013-08-16 19:24 - 2013-08-16 19:23 - 00000000 ____D C:\Users\PM\Desktop\Bewerbung

2013-08-16 19:23 - 2013-08-16 19:23 - 00000000 ____D C:\Users\PM\Desktop\Anschreiben, Status

2013-08-16 18:32 - 2013-08-16 06:30 - 00043352 _____ C:\Extras.Txt

2013-08-16 13:33 - 2007-06-18 13:21 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-16 13:33 - 2006-11-02 12:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2013-08-16 13:32 - 2006-11-02 12:23 - 00000277 _____ C:\Windows\win.ini

2013-08-16 06:34 - 2013-08-16 06:34 - 00080248 _____ C:\OTL1.txt

2013-08-16 06:34 - 2013-08-16 06:34 - 00034466 _____ C:\Extras1.txt

2013-08-15 17:50 - 2008-03-09 14:34 - 00026624 _____ C:\Users\PM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\NIS60dDE.exe

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 613529.crdownload

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 281099.crdownload

2013-08-15 10:43 - 2011-06-08 16:38 - 00001356 _____ C:\Users\PM\AppData\Local\d3d9caps.dat

2013-08-14 23:33 - 2013-08-14 23:33 - 00000000 ____D C:\Program Files\Common Files\Bitdefender

2013-08-13 21:37 - 2007-06-18 13:20 - 00000000 ____D C:\Program Files\Microsoft Office

2013-08-13 11:54 - 2012-11-06 00:00 - 00000000 ____D C:\Users\PM\AppData\Local\Paint.NET

2013-08-13 09:35 - 2007-09-01 16:02 - 00000000 ____D C:\Users\PM\AppData\Local\Google

2013-08-12 19:39 - 2013-08-12 19:39 - 00460800 __RSH C:\Windows\system32\KBDYCLP.dll

2013-08-06 13:55 - 2013-08-06 13:55 - 00004096 ____H C:\Users\PM\AppData\Local\keyfile3.drm

2013-07-31 08:13 - 2007-09-01 16:01 - 00108136 _____ C:\Users\PM\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-31 08:11 - 2006-11-02 14:47 - 00400344 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-22 13:02 - 2012-02-21 20:01 - 00000310 _____ C:\Windows\Tasks\HPCeeScheduleForPM.job
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-17 16:54
 

==================== End Of Log ============================

--- --- ---

Gruß Roland

So, dann jetzt so weiter:
(Immer noch aufs Surfen verzichten, um eine erneute Re-Infektion zu vermeiden.)

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

2013-08-12 19:39 - 2013-08-12 19:39 - 00460800 __RSH C:\Windows\system32\KBDYCLP.dll

2013-08-12 19:39 - 2013-08-17 17:29 - 00000304 _____ C:\Windows\Tasks\pmrsud.job

2013-08-17 10:43 - 2013-08-17 10:43 - 00000713 _____ C:\Users\PM\Desktop\Internet Security 2013.lnk

SearchScopes: HKLM - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - DefaultScope {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

Lade SystemLook (von jpshortstuff) herunter und speichere das Tool auf dem Desktop.

Doppelklicke auf die SystemLook.exe, um das Tool zu starten.
Vista und Win7 User: Rechtsklick und "als Administrator starten".
Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

Code:

:filefind *FromDocToPDF* :folderfind *FromDocToPDF* :regfind FromDocToPDF
Klicke nun auf den Button Look, um den Scan zu starten.
Wenn der Suchlauf beendet ist, wird sich dein Editor mit den Ergebnissen öffnen. Poste diese in deinen Thread.
Das Log-File wird auch auf dem Desktop als SystemLook.txt gespeichert.

Schritt 3

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Bitte poste in deiner nächsten Antwort:

Fixlog von FRST
Log von SystemLook
Log von MBAM

Hallo Leo,

hier die Ergebnisse.

Schritt 1

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 16-08-2013

Ran by PM at 2013-08-17 17:49:25 Run:1

Running from C:\Users\PM\Desktop

Boot Mode: Safe Mode (with Networking)
 

==============================================
 

Content of fixlist:

*****************

2013-08-12 19:39 - 2013-08-12 19:39 - 00460800 __RSH C:\Windows\system32\KBDYCLP.dll 2013-08-12 19:39 - 2013-08-17 17:29 - 00000304 _____ C:\Windows\Tasks\pmrsud.job 2013-08-17 10:43 - 2013-08-17 10:43 - 00000713 _____ C:\Users\PM\Desktop\Internet Security 2013.lnk SearchScopes: HKLM - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - DefaultScope {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms} 
 
 

*****************
 

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.

"C:\Users\PM\Desktop\Internet Security 2013.lnk SearchScopes: HKLM - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - DefaultScope {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms} " => File/Directory not found.
 

==== End of Fixlog ====

Schritt 2

Code:

SystemLook 30.07.11 by jpshortstuff

Log created at 18:24 on 17/08/2013 by PM

Administrator - Elevation successful
 

========== filefind ==========
 

Searching for "*FromDocToPDF*"

C:\Users\PM\AppData\Roaming\Microsoft\Windows\Cookies\Low\pm@fromdoctopdf[2].txt        --a---- 477 bytes        [19:17 09/07/2013]        [19:18 09/07/2013] E77392F1B487BF1E615A86589A63B0E6
 

========== folderfind ==========
 

Searching for "*FromDocToPDF*"

C:\Program Files\FromDocToPDF_65        d------        [19:17 09/07/2013]

C:\Users\PM\AppData\LocalLow\FromDocToPDF_65        d------        [06:45 17/08/2013]
 

========== regfind ==========
 

Searching for "FromDocToPDF"

[HKEY_CURRENT_USER\Software\AppDataLow\Software\FromDocToPDF_65]

[HKEY_CURRENT_USER\Software\AppDataLow\Software\FromDocToPDF_65\bar]

"SettingsDir"="C:\Users\PM\AppData\LocalLow\FromDocToPDF_65\bar\Settings\"

[HKEY_CURRENT_USER\Software\AppDataLow\Software\FromDocToPDF_65\bar]

"CacheDir"="C:\Users\PM\AppData\LocalLow\FromDocToPDF_65\bar\Cache\"

[HKEY_CURRENT_USER\Software\AppDataLow\Software\FromDocToPDF_65\bar]

"HistoryDir"="C:\Users\PM\AppData\LocalLow\FromDocToPDF_65\bar\History\"

[HKEY_CURRENT_USER\Software\AppDataLow\Software\FromDocToPDF_65\bar]

"SkinsDirLowIL"="C:\Users\PM\AppData\LocalLow\FromDocToPDF_65\bar\"

[HKEY_CURRENT_USER\Software\FromDocToPDF_65]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FromDocToPDF_65bar Uninstall Firefox]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FromDocToPDF_65bar Uninstall Internet Explorer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65mlbtn.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}\ProgID]

@="FromDocToPDF_65.MultipleButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}\VersionIndependentProgID]

@="FromDocToPDF_65.MultipleButton"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}]

@="FromDocToPDF Third Party Installer"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65tpinst.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\ProgID]

@="FromDocToPDF_65.ThirdPartyInstaller.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}\VersionIndependentProgID]

@="FromDocToPDF_65.ThirdPartyInstaller"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65script.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}\ProgID]

@="FromDocToPDF_65.ScriptButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}\VersionIndependentProgID]

@="FromDocToPDF_65.ScriptButton"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65skin.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4ffa72ec-9fd9-4b2b-92a5-68b60885fd8a}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65httpct.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65radio.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\ProgID]

@="FromDocToPDF_65.RadioSettings.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}\VersionIndependentProgID]

@="FromDocToPDF_65.RadioSettings"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72d05120-df65-4c27-921e-899b5267fef2}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65dlghk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ad40e5e-9fd9-4f5e-b4d1-ddf2c921dce3}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65msg.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ad40e5e-9fd9-4f5e-b4d1-ddf2c921dce3}\ProgID]

@="FromDocToPDF_65.XMLSessionPlugin.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8ad40e5e-9fd9-4f5e-b4d1-ddf2c921dce3}\VersionIndependentProgID]

@="FromDocToPDF_65.XMLSessionPlugin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a0cf6cb9-2276-4f30-b841-05a67067ace0}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65uabtn.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a0cf6cb9-2276-4f30-b841-05a67067ace0}\ProgID]

@="FromDocToPDF_65.UrlAlertButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a0cf6cb9-2276-4f30-b841-05a67067ace0}\VersionIndependentProgID]

@="FromDocToPDF_65.UrlAlertButton"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65bprtct.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}\ProgID]

@="FromDocToPDF_65.ToolbarProtector.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}\VersionIndependentProgID]

@="FromDocToPDF_65.ToolbarProtector"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afa196f4-80e5-47ad-b7bc-c671487d36fb}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65datact.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65radio.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}\ProgID]

@="FromDocToPDF_65.Radio.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}\VersionIndependentProgID]

@="FromDocToPDF_65.Radio"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65bar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\ProgID]

@="FromDocToPDF_65.SettingsPlugin.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}\VersionIndependentProgID]

@="FromDocToPDF_65.SettingsPlugin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65skin.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\ProgID]

@="FromDocToPDF_65.PseudoTransparentPlugin.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}\VersionIndependentProgID]

@="FromDocToPDF_65.PseudoTransparentPlugin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65feedmg.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\ProgID]

@="FromDocToPDF_65.FeedManager.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}\VersionIndependentProgID]

@="FromDocToPDF_65.FeedManager"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65skin.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}]

@="FromDocToPDF_65 HTML"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\T8HTML.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\ProgID]

@="FromDocToPDF_65.HTMLPanel.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}\VersionIndependentProgID]

@="FromDocToPDF_65.HTMLPanel"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f96ee2ef-fe15-4878-aecd-bc367f12c70f}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65dyn.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f96ee2ef-fe15-4878-aecd-bc367f12c70f}\ProgID]

@="FromDocToPDF_65.DynamicBarButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f96ee2ef-fe15-4878-aecd-bc367f12c70f}\VersionIndependentProgID]

@="FromDocToPDF_65.DynamicBarButton"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}]

@="FromDocToPDF_65 HTML Menu"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}\InprocServer32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\65htmlmu.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}\ProgID]

@="FromDocToPDF_65.HTMLMenu.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}\VersionIndependentProgID]

@="FromDocToPDF_65.HTMLMenu"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.DynamicBarButton]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.DynamicBarButton\CurVer]

@="FromDocToPDF_65.DynamicBarButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.DynamicBarButton.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.FeedManager]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.FeedManager\CurVer]

@="FromDocToPDF_65.FeedManager.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.FeedManager.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu]

@="FromDocToPDF_65 HTML Menu"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu\CurVer]

@="FromDocToPDF_65.HTMLMenu.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu.1]

@="FromDocToPDF_65 HTML Menu"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel]

@="FromDocToPDF_65 HTML Panel"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel\CurVer]

@="FromDocToPDF_65.HTMLPanel.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel.1]

@="FromDocToPDF_65 HTML Panel"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton\CurVer]

@="FromDocToPDF_65.MultipleButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin\CurVer]

@="FromDocToPDF_65.PseudoTransparentPlugin.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.Radio]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.Radio\CurVer]

@="FromDocToPDF_65.Radio.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.Radio.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings\CurVer]

@="FromDocToPDF_65.RadioSettings.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton\CurVer]

@="FromDocToPDF_65.ScriptButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin\CurVer]

@="FromDocToPDF_65.SettingsPlugin.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncher\CurVer]

@="FromDocToPDF_65.SkinLauncher.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncher.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncherSettings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncherSettings\CurVer]

@="FromDocToPDF_65.SkinLauncherSettings.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncherSettings.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller]

@="FromDocToPDF Third Party Installer"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller\CurVer]

@="FromDocToPDF_65.ThirdPartyInstaller.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller.1]

@="FromDocToPDF Third Party Installer"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector\CurVer]

@="FromDocToPDF_65.ToolbarProtector.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.UrlAlertButton]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.UrlAlertButton\CurVer]

@="FromDocToPDF_65.UrlAlertButton.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.UrlAlertButton.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.XMLSessionPlugin]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.XMLSessionPlugin\CurVer]

@="FromDocToPDF_65.XMLSessionPlugin.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FromDocToPDF_65.XMLSessionPlugin.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1747AE4D-0A83-4336-84D4-48500BF1554F}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\405"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1747AE4D-0A83-4336-84D4-48500BF1554F}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2C9D27D8-C81E-4968-8026-E725E01650C1}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\625"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2C9D27D8-C81E-4968-8026-E725E01650C1}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\1003"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\1506"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\1807"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{542EAC56-BF4B-46A7-943E-0A4C2CBA34EA}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\1306"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{542EAC56-BF4B-46A7-943E-0A4C2CBA34EA}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\1104"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{74C02D12-FAEE-4834-80D2-5B7D2480AD61}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\626"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{74C02D12-FAEE-4834-80D2-5B7D2480AD61}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{840AE8AE-D547-433E-985C-6BF6C74F5084}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\905"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{840AE8AE-D547-433E-985C-6BF6C74F5084}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A85ACA7E-5CD2-461B-877A-994CCCCF491C}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\100"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A85ACA7E-5CD2-461B-877A-994CCCCF491C}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\1406"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}\1.0\0\win32]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin\t8res.dll\1604"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}\1.0\HELPDIR]

@="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\FromDocToPDF_65]

[HKEY_LOCAL_MACHINE\SOFTWARE\FromDocToPDF_65\bar]

"un"="FromDocToPDF"

[HKEY_LOCAL_MACHINE\SOFTWARE\FromDocToPDF_65\bar]

"Dir"="C:\Program Files\FromDocToPDF_65\bar\"

[HKEY_LOCAL_MACHINE\SOFTWARE\FromDocToPDF_65\bar]

"UninstallString"=""C:\Program Files\FromDocToPDF_65\bar\1.bin\65highin.exe" 65bar.dll,O uninstalltype="IE""

[HKEY_LOCAL_MACHINE\SOFTWARE\FromDocToPDF_65\bar]

"PluginPath"="C:\Program Files\FromDocToPDF_65\bar\1.bin\"

[HKEY_LOCAL_MACHINE\SOFTWARE\FromDocToPDF_65\bar]

"SettingsDir"="C:\Program Files\FromDocToPDF_65\bar\Settings\"

[HKEY_LOCAL_MACHINE\SOFTWARE\FromDocToPDF_65\bar]

"HistoryDir"="C:\Program Files\FromDocToPDF_65\bar\History\"

[HKEY_LOCAL_MACHINE\SOFTWARE\FromDocToPDF_65\SkinTools]

"PlayerPath"=""C:\Program Files\FromDocToPDF_65\bar\1.bin\65SkPlay.exe""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{36b445bf-1b84-466a-a623-a360a8cff8c3}]

"AppPath"="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6cbf5c01-c876-481b-867e-111cb1d2a7d6}]

"AppPath"="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{701f5c41-bb30-46da-a56b-68784b0b762b}]

"AppPath"="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a3b975a0-f679-444e-9d94-6d292fa53140}]

"AppPath"="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d97143c2-4282-496b-bdc4-7ec852f1497c}]

"AppPath"="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}]

"AppPath"="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"FromDocToPDF Search Scope Monitor"=""C:\PROGRA~1\FROMDO~2\bar\1.bin\65srchmn.exe" /m=2 /w /h"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"FromDocToPDF_65 Browser Plugin Loader"="C:\PROGRA~1\FROMDO~2\bar\1.bin\65brmon.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Firefox]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Firefox]

"DisplayName"="FromDocToPDF Firefox Toolbar"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Firefox]

"UninstallString"="rundll32 "C:\Program Files\FromDocToPDF_65\bar\1.bin\65Bar.dll",O mindsparktoolbarkey="FromDocToPDF_65" uninstalltype="FF""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer]

"DisplayName"="FromDocToPDF Internet Explorer Toolbar"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer]

"UninstallString"="rundll32 "C:\Program Files\FromDocToPDF_65\bar\1.bin\65Bar.dll",O mindsparktoolbarkey="FromDocToPDF_65" uninstalltype="IE""

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions]

"65ffxtbr@FromDocToPDF_65.com"="C:\Program Files\FromDocToPDF_65\bar\1.bin"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@FromDocToPDF_65.com/Plugin]

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@FromDocToPDF_65.com/Plugin]

"Description"="FromDocToPDF Plugin"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@FromDocToPDF_65.com/Plugin]

"Path"="C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@FromDocToPDF_65.com/Plugin]

"vendor"="FromDocToPDF_65"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@FromDocToPDF_65.com/Plugin\MimeTypes\application/x-fromdoctopdf_65plugin]

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@FromDocToPDF_65.com/Plugin\MimeTypes\application/x-fromdoctopdf_65plugin]

"Description"="FromDocToPDF Plugin"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FromDocToPDF_65Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FromDocToPDF_65Service]

"DisplayName"="FromDocToPDFService"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\FromDocToPDF_65Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\FromDocToPDF_65Service]

"DisplayName"="FromDocToPDFService"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\FromDocToPDF_65Service]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\FromDocToPDF_65Service]

"DisplayName"="FromDocToPDFService"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FromDocToPDF_65Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FromDocToPDF_65Service]

"DisplayName"="FromDocToPDFService"

[HKEY_USERS\S-1-5-21-1644527311-4281704627-1724655704-1000\Software\AppDataLow\Software\FromDocToPDF_65]

[HKEY_USERS\S-1-5-21-1644527311-4281704627-1724655704-1000\Software\AppDataLow\Software\FromDocToPDF_65\bar]

"SettingsDir"="C:\Users\PM\AppData\LocalLow\FromDocToPDF_65\bar\Settings\"

[HKEY_USERS\S-1-5-21-1644527311-4281704627-1724655704-1000\Software\AppDataLow\Software\FromDocToPDF_65\bar]

"CacheDir"="C:\Users\PM\AppData\LocalLow\FromDocToPDF_65\bar\Cache\"

[HKEY_USERS\S-1-5-21-1644527311-4281704627-1724655704-1000\Software\AppDataLow\Software\FromDocToPDF_65\bar]

"HistoryDir"="C:\Users\PM\AppData\LocalLow\FromDocToPDF_65\bar\History\"

[HKEY_USERS\S-1-5-21-1644527311-4281704627-1724655704-1000\Software\AppDataLow\Software\FromDocToPDF_65\bar]

"SkinsDirLowIL"="C:\Users\PM\AppData\LocalLow\FromDocToPDF_65\bar\"

[HKEY_USERS\S-1-5-21-1644527311-4281704627-1724655704-1000\Software\FromDocToPDF_65]

[HKEY_USERS\S-1-5-21-1644527311-4281704627-1724655704-1000\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FromDocToPDF_65bar Uninstall Firefox]

[HKEY_USERS\S-1-5-21-1644527311-4281704627-1724655704-1000\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FromDocToPDF_65bar Uninstall Internet Explorer]
 

-= EOF =-

Schritt 3

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.04.04.07
 

Windows Vista Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 7.0.6001.18000

PM :: PM-PC [Administrator]
 

Schutz: Deaktiviert
 

17.08.2013 18:37:12

mbam-log-2013-08-17 (18-37-12).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 213105

Laufzeit: 5 Minute(n), 26 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Gruß Roland

Hallo Roland,

der FRST-Fix hat nicht ganz geklappt. Ich hab hier einen neuen für dich. Achte dieses Mal bitte darauf, dass in deinem Fixskript, dass du von hier kopierst, die Zeilenumbrüche vorhanden sind, so dass jede Angabe auf einer eigenen Zeile steht.

Schritt 1

Gehe zu Start --> Systemsteuerung und öffne Programme und Funktionen.
Suche und deinstalliere dort der Reihe nach folgende Einträge:
- FromDocToPDF Firefox Toolbar
- FromDocToPDF Internet Explorer Toolbar
Schliesse das Fenster wieder und führe einen Neustart durch, wenn das gefordert wurde.

Schritt 2

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

2013-08-12 19:39 - 2013-08-12 19:39 - 00460800 __RSH C:\Windows\system32\KBDYCLP.dll

2013-08-12 19:39 - 2013-08-17 17:29 - 00000304 _____ C:\Windows\Tasks\pmrsud.job

2013-08-17 10:43 - 2013-08-17 10:43 - 00000713 _____ C:\Users\PM\Desktop\Internet Security 2013.lnk

SearchScopes: HKLM - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - DefaultScope {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

CHR Plugin: (MindSpark Toolbar Platform Plugin Stub) - C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll (MindSpark)

C:\Program Files\FromDocToPDF_65

C:\Users\PM\AppData\LocalLow\FromDocToPDF_65

REG: reg delete "HKCU\Software\AppDataLow\Software\FromDocToPDF_65" /f

REG: reg delete "HKCU\Software\FromDocToPDF_65" /f

REG: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FromDocToPDF_65bar Uninstall Firefox" /f

REG: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FromDocToPDF_65bar Uninstall Internet Explorer" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{72d05120-df65-4c27-921e-899b5267fef2}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{8ad40e5e-9fd9-4f5e-b4d1-ddf2c921dce3}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{a0cf6cb9-2276-4f30-b841-05a67067ace0}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{afa196f4-80e5-47ad-b7bc-c671487d36fb}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{f96ee2ef-fe15-4878-aecd-bc367f12c70f}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.DynamicBarButton" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.DynamicBarButton.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.FeedManager" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.FeedManager.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.Radio" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.Radio.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncher" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncher.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncherSettings" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncherSettings.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.UrlAlertButton" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.UrlAlertButton.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.XMLSessionPlugin" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.XMLSessionPlugin.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{1747AE4D-0A83-4336-84D4-48500BF1554F}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{2C9D27D8-C81E-4968-8026-E725E01650C1}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{542EAC56-BF4B-46A7-943E-0A4C2CBA34EA}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{74C02D12-FAEE-4834-80D2-5B7D2480AD61}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{840AE8AE-D547-433E-985C-6BF6C74F5084}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{A85ACA7E-5CD2-461B-877A-994CCCCF491C}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}" /f

REG: reg delete "HKLM\SOFTWARE\FromDocToPDF_65" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{36b445bf-1b84-466a-a623-a360a8cff8c3}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6cbf5c01-c876-481b-867e-111cb1d2a7d6}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{701f5c41-bb30-46da-a56b-68784b0b762b}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a3b975a0-f679-444e-9d94-6d292fa53140}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d97143c2-4282-496b-bdc4-7ec852f1497c}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FromDocToPDF Search Scope Monitor" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FromDocToPDF_65 Browser Plugin Loader" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Firefox" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer" /f

REG: reg delete "HKLM\SOFTWARE\Mozilla\Firefox\Extensions" /v "65ffxtbr@FromDocToPDF_65.com" /f

REG: reg delete "HKLM\SOFTWARE\MozillaPlugins\@FromDocToPDF_65.com/Plugin" /f

REG: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\FromDocToPDF_65Service" /f

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4

Starte noch einmal FRST.

Setze bei Optional Scan den Haken bei Addition.txt und drücke Scan.
Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und Addition.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieser beiden Logfiles bitte hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

Fixlog von FRST
Log von ESET
Logs von FRST

Hallo Leo,

beim Schritt 1 erscheint folgende Fehlermeldung im abgesichteren Modus.
"Fehler beim Laden von C:/ProgramFiles/FromDocToPDF_65/bar/1.65Bar.dll"
"Das angebene Modul wurde nicht gefunden
Für das zweite Programm göeicher Fehler.

Gruß Roland

Ah, ich hab vergessen zu schreiben: Du musst jetzt nicht mehr im abgesicherten Modus arbeiten, der normale Modus sollte auch wieder funktionieren. Benutze diesen Rechner einfach noch nicht zum Surfen im Internet, bis wir hier ganz fertig sind.

Wenn der Schritt 1 nicht klappt, dann überspring ihn und mach mit Schritt 2 weiter.
(Wichtig ist beim Schritt 2 wie gesagt, dass die Zeilenumbrüche beim Rüberkopieren nicht verloren gehen.)

Hallo Leo,

kann den Est online scanner nicht wie beschrieben starten.
Folgende Fehlermeldung erscheint "Can not get update. Is proxy configured?"

Gruß Roland

Ok, dann überspringen und weiter mit Schritt 4. :)

Hallo Leo,

hier die Ergebnisse.

Fixlog von FRST

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 16-08-2013

Ran by PM at 2013-08-17 20:08:40 Run:1

Running from C:\Users\PM\Desktop

Boot Mode: Normal
 

==============================================
 

Content of fixlist:

*****************

2013-08-12 19:39 - 2013-08-12 19:39 - 00460800 __RSH C:\Windows\system32\KBDYCLP.dll

2013-08-12 19:39 - 2013-08-17 17:29 - 00000304 _____ C:\Windows\Tasks\pmrsud.job

2013-08-17 10:43 - 2013-08-17 10:43 - 00000713 _____ C:\Users\PM\Desktop\Internet Security 2013.lnk

SearchScopes: HKLM - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - DefaultScope {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^Y6^xdm043^YYA^de&si=swissconverter&ptb=D1881E25-0032-4500-A85B-49180ECAE22D&ind=2013070915&n=77fd0643&psa=&st=sb&searchfor={searchTerms}

CHR Plugin: (MindSpark Toolbar Platform Plugin Stub) - C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll (MindSpark)

C:\Program Files\FromDocToPDF_65

C:\Users\PM\AppData\LocalLow\FromDocToPDF_65

REG: reg delete "HKCU\Software\AppDataLow\Software\FromDocToPDF_65" /f

REG: reg delete "HKCU\Software\FromDocToPDF_65" /f

REG: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FromDocToPDF_65bar Uninstall Firefox" /f

REG: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FromDocToPDF_65bar Uninstall Internet Explorer" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{72d05120-df65-4c27-921e-899b5267fef2}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{8ad40e5e-9fd9-4f5e-b4d1-ddf2c921dce3}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{a0cf6cb9-2276-4f30-b841-05a67067ace0}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{afa196f4-80e5-47ad-b7bc-c671487d36fb}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{f96ee2ef-fe15-4878-aecd-bc367f12c70f}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.DynamicBarButton" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.DynamicBarButton.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.FeedManager" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.FeedManager.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.Radio" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.Radio.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncher" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncher.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncherSettings" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncherSettings.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.UrlAlertButton" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.UrlAlertButton.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.XMLSessionPlugin" /f

REG: reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.XMLSessionPlugin.1" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{1747AE4D-0A83-4336-84D4-48500BF1554F}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{2C9D27D8-C81E-4968-8026-E725E01650C1}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{542EAC56-BF4B-46A7-943E-0A4C2CBA34EA}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{74C02D12-FAEE-4834-80D2-5B7D2480AD61}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{840AE8AE-D547-433E-985C-6BF6C74F5084}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{A85ACA7E-5CD2-461B-877A-994CCCCF491C}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}" /f

REG: reg delete "HKLM\SOFTWARE\Classes\TypeLib\{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}" /f

REG: reg delete "HKLM\SOFTWARE\FromDocToPDF_65" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{36b445bf-1b84-466a-a623-a360a8cff8c3}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6cbf5c01-c876-481b-867e-111cb1d2a7d6}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{701f5c41-bb30-46da-a56b-68784b0b762b}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a3b975a0-f679-444e-9d94-6d292fa53140}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d97143c2-4282-496b-bdc4-7ec852f1497c}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FromDocToPDF Search Scope Monitor" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FromDocToPDF_65 Browser Plugin Loader" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Firefox" /f

REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer" /f

REG: reg delete "HKLM\SOFTWARE\Mozilla\Firefox\Extensions" /v "65ffxtbr@FromDocToPDF_65.com" /f

REG: reg delete "HKLM\SOFTWARE\MozillaPlugins\@FromDocToPDF_65.com/Plugin" /f

REG: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\FromDocToPDF_65Service" /f

         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet). 

Starte nun FRST erneut und klicke den Fix Button. 

Das Tool erstellt eine Fixlog.txt. 

Poste mir deren Inhalt. 
 

*****************
 

"C:\Windows\system32\KBDYCLP.dll" => File/Directory not found.

"C:\Windows\Tasks\pmrsud.job" => File/Directory not found.

"C:\Users\PM\Desktop\Internet Security 2013.lnk" => File/Directory not found.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9a216821-0ec5-49a3-85ac-fb72ae79a1e8} => Key not found.

HKCR\Wow6432Node\CLSID\{9a216821-0ec5-49a3-85ac-fb72ae79a1e8} => Key not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9a216821-0ec5-49a3-85ac-fb72ae79a1e8} => Key not found.

HKCR\Wow6432Node\CLSID\{9a216821-0ec5-49a3-85ac-fb72ae79a1e8} => Key not found.

C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll => Moved successfully.
 

"C:\Program Files\FromDocToPDF_65" directory move:
 

C:\Program Files\FromDocToPDF_65\bar\Settings\s_pid.dat => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\Message\COMMON.T8S => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\IE9Mesg\COMMON.T8S => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\gen1\COMMON.T8S => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65barsvc.exe => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65bprtct.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65brmon.exe => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65brstub.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65datact.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65dlghk.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65dyn.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65feedmg.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65highin.exe => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65hkstub.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65htmlmu.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65httpct.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65idle.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65ieovr.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65impipe.exe => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65medint.exe => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65mlbtn.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65msg.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65Plugin.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65radio.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65regfft.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65reghk.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65regiet.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65script.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65skin.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65sknlcr.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65skplay.exe => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65SrcAs.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65SrchMn.exe => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65tpinst.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\65uabtn.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\AppIntegrator64.exe => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\AppIntegratorStub64.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\BOOTSTRAP.JS => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\CHROME.MANIFEST => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\CREXT.DLL => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\CrExtP65.exe => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\DPNMNGR.DLL => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\EXEMANAGER.DLL => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\Hpg64.dll => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\INSTALL.RDF => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\installKeys.js => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\LOGO.BMP => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\T8EXTEX.DLL => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\T8EXTPEX.DLL => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\T8HTML.DLL => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\T8RES.DLL => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\T8TICKER.DLL => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\VERIFY.DLL => Moved successfully.

C:\Program Files\FromDocToPDF_65\bar\1.bin\chrome\65ffxtbr.jar => Moved successfully.

Could not move "C:\Program Files\FromDocToPDF_65" directory. => Scheduled to move on reboot.
 

C:\Users\PM\AppData\LocalLow\FromDocToPDF_65 => Moved successfully.
 

========= reg delete "HKCU\Software\AppDataLow\Software\FromDocToPDF_65" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKCU\Software\FromDocToPDF_65" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FromDocToPDF_65bar Uninstall Firefox" /f =========
 

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.
 
 

========= End of Reg: =========
 
 

========= reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FromDocToPDF_65bar Uninstall Internet Explorer" /f =========
 

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{017d68f2-19b3-41ae-9d8a-8b09dbd25479}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{2bd4465d-669a-42e6-b449-636b0b10ebb8}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{3700b685-d795-4e17-9b78-73bcee5d4086}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{3e6260ac-bc6f-44b4-942b-1568c367543a}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{504b4aa9-9952-4490-b0e1-80a5321c35f7}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{72d05120-df65-4c27-921e-899b5267fef2}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{8ad40e5e-9fd9-4f5e-b4d1-ddf2c921dce3}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{a0cf6cb9-2276-4f30-b841-05a67067ace0}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{ae84501a-2cb6-41d6-b3a7-9679bdbdfa0b}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{afa196f4-80e5-47ad-b7bc-c671487d36fb}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{b7fd68f7-d28b-431e-9ee8-e45d915b7f17}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{bc7e25d7-4681-46a3-af5a-9a1b865783ed}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{cbbea4b9-b183-47ac-8b1f-fd526ac99a8d}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{cd1d181e-c654-4ca5-9d09-b3648537fd7d}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{e1c4699e-5e74-4f30-a4a2-378e45d44f07}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{f96ee2ef-fe15-4878-aecd-bc367f12c70f}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.DynamicBarButton" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.DynamicBarButton.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.FeedManager" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.FeedManager.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.Radio" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.Radio.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncher" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncher.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncherSettings" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.SkinLauncherSettings.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.UrlAlertButton" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.UrlAlertButton.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.XMLSessionPlugin" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\FromDocToPDF_65.XMLSessionPlugin.1" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{1747AE4D-0A83-4336-84D4-48500BF1554F}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{2C9D27D8-C81E-4968-8026-E725E01650C1}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{542EAC56-BF4B-46A7-943E-0A4C2CBA34EA}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{74C02D12-FAEE-4834-80D2-5B7D2480AD61}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{840AE8AE-D547-433E-985C-6BF6C74F5084}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{A85ACA7E-5CD2-461B-877A-994CCCCF491C}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Classes\TypeLib\{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\FromDocToPDF_65" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{36b445bf-1b84-466a-a623-a360a8cff8c3}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6cbf5c01-c876-481b-867e-111cb1d2a7d6}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{701f5c41-bb30-46da-a56b-68784b0b762b}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a3b975a0-f679-444e-9d94-6d292fa53140}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d97143c2-4282-496b-bdc4-7ec852f1497c}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e0c3a839-0e5e-4ebc-9f8f-e56f8fc732ce}" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FromDocToPDF Search Scope Monitor" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "FromDocToPDF_65 Browser Plugin Loader" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Firefox" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\Mozilla\Firefox\Extensions" /v "65ffxtbr@FromDocToPDF_65.com" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SOFTWARE\MozillaPlugins\@FromDocToPDF_65.com/Plugin" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

========= reg delete "HKLM\SYSTEM\CurrentControlSet\Services\FromDocToPDF_65Service" /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 

=========== Result of Scheduled Files to move ===========
 

C:\Program Files\FromDocToPDF_65 => Moved successfully.
 

==== End of Fixlog ====

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-08-2013

Ran by PM (administrator) on 17-08-2013 20:31:10

Running from C:\Users\PM\Desktop

Microsoft® Windows Vista™ Home Premium  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 7

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Company) c:\Program Files\Common Files\LightScribe\LSSrvc.exe

(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

(Nero AG) C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

(TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

(TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe

(Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe

(OsdMaestro) C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe

(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

(Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe

(Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe

(RealNetworks, Inc.) C:\Program Files\Common Files\Real\Update_OB\realsched.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe

(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

(Hewlett-Packard Company) C:\hp\kbd\kbd.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2006-09-28] (Hewlett-Packard Company)

HKLM\...\Run: [KBD] - C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()

HKLM\...\Run: [OsdMaestro] - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [118784 2007-02-15] (OsdMaestro)

HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4874240 2008-01-15] (Realtek Semiconductor)

HKLM\...\Run: [NeroCheck] - C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)

HKLM\...\Run: [Symantec PIF AlertEng] - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [583048 2008-01-29] (Symantec Corporation)

HKLM\...\Run: [BrMfcWnd] - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1089536 2008-02-19] (Brother Industries, Ltd.)

HKLM\...\Run: [ControlCenter3] - C:\Program Files\Brother\ControlCenter3\brctrcen.exe [86016 2007-12-21] (Brother Industries, Ltd.)

HKLM\...\Run: [PaperPort PTD] - C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2007-10-11] (Nuance Communications, Inc.)

HKLM\...\Run: [IndexSearch] - C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2007-10-11] (Nuance Communications, Inc.)

HKLM\...\Run: [NvSvc] - C:\Windows\system32\nvsvc.dll [92704 2008-01-10] (NVIDIA Corporation)

HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [8530464 2008-01-10] (NVIDIA Corporation)

HKLM\...\Run: [NvMediaCenter] - C:\Windows\system32\NvMcTray.dll [88608 2008-01-10] (NVIDIA Corporation)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)

HKLM\...\Run: [PDFPrint] - C:\Program Files\PDF24\pdf24.exe [162856 2013-06-10] (Geek Software GmbH)

HKLM\...\Run: [TkBellExe] - C:\Program Files\Common Files\Real\Update_OB\realsched.exe [185896 2007-06-18] (RealNetworks, Inc.)

HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44168 2007-03-07] (soft thinks)

HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-18] (Microsoft Corporation)

HKCU\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1644088 2009-08-05] (Hewlett-Packard)

HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-18] (Microsoft Corporation)

HKU\Default\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [ 2009-08-05] (Hewlett-Packard)

HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2008-01-18] (Microsoft Corporation)

HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [ 2009-08-05] (Hewlett-Packard)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

Startup: C:\Users\PM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=desktop

SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKLM - {13ACC3AB-22DA-47E2-854A-F3A72E8F4FF7} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06

SearchScopes: HKCU - DefaultScope {9a216821-0ec5-49a3-85ac-fb72ae79a1e8} URL = 

SearchScopes: HKCU - {13ACC3AB-22DA-47E2-854A-F3A72E8F4FF7} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06

SearchScopes: HKCU - {AE67D855-EA9B-4626-9C96-0939A094504C} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}

BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File

Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKCU -No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File

Toolbar: HKCU -&Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

Handler: haufereader - No CLSID Value - 

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msdaipp - No CLSID Value - 

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [147456] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 83.169.185.33 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=6.0.11.2571 - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=1.0.2.2629 - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=6.0.12.1739 - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @veetle.com/vbp;version=0.9.16 - C:\Program Files\Veetle\VLCBroadcast\npvbp.dll No File

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\ask-web-search.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-11.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-12.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-13.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-14.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-15.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-16.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-17.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-18.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-19.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\icqplugin-20.xml

FF SearchPlugin: C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\searchplugins\searchplugins-backup

FF Extension: No Name - C:\Users\PM\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com

FF Extension: No Name - C:\Users\PM\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: Yahoo! Toolbar - C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF Extension: pdfforge - C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\Extensions\pdfforge@mybrowserbar.com

FF Extension: No Name - C:\Users\PM\AppData\Roaming\Mozilla\Firefox\Profiles\e2au7sym.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi

FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
 

Chrome: 

=======

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.5) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)

CHR Plugin: (MindSpark Toolbar Platform Plugin Stub) - C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll No File

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

CHR Plugin: (MetaStream 3 Plugin) - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Extension: (Docs) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0

CHR Extension: (Google Drive) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0

CHR Extension: (YouTube) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0

CHR Extension: (Google Search) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0

CHR Extension: (Gmail) - C:\Users\PM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
 

========================== Services (Whitelisted) =================
 

R2 LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll [537992 2008-04-10] (Symantec Corporation)

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)

S2 SymAppCore; c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [47712 2007-01-04] (Symantec Corporation)

R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [1514304 2011-12-14] (TuneUp Software)

S2 LiveUpdate Notice Ex; "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
 

==================== Drivers (Whitelisted) ====================
 

S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)

R1 IDSvix86; C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080407.003\IDSvix86.sys [261680 2008-02-13] (Symantec Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-31] ()

S3 SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [279088 2007-12-01] (Symantec Corporation)

S3 SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [317616 2007-12-01] (Symantec Corporation)

R1 SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [43696 2007-12-01] (Symantec Corporation)

R3 SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [12848 2007-10-30] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [123952 2008-02-13] (Symantec Corporation)

R3 SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [145968 2007-10-30] (Symantec Corporation)

R3 SYMIDS; C:\Windows\System32\Drivers\SYMIDS.SYS [39856 2007-10-30] (Symantec Corporation)

R3 SYMNDISV; C:\Windows\System32\Drivers\SYMNDISV.SYS [37936 2007-10-30] (Symantec Corporation)

R3 SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [27696 2007-10-30] (Symantec Corporation)

R1 SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [191536 2007-10-30] (Symantec Corporation)

R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [10064 2011-12-12] (TuneUp Software)

S3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-01] (America Online, Inc.)

S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]

S3 catchme; \??\C:\Users\PM\AppData\Local\Temp\catchme.sys [x]

S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20080413.003\NAVENG.SYS [x]

S3 NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20080413.003\NAVEX15.SYS [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-08-17 18:35 - 2013-08-17 18:35 - 00000000 ____D C:\Users\PM\AppData\Roaming\Malwarebytes

2013-08-17 18:34 - 2013-08-17 18:36 - 00000908 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-17 18:34 - 2013-08-17 18:36 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-08-17 18:34 - 2013-08-17 18:34 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-17 18:34 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-08-17 18:13 - 2013-08-17 18:10 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\PM\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-17 16:54 - 2013-08-17 16:54 - 00009694 _____ C:\ComboFix.txt

2013-08-17 13:48 - 2013-08-17 18:08 - 00139264 _____ C:\Users\PM\Desktop\SystemLook.exe

2013-08-17 12:46 - 2013-08-17 12:36 - 01068993 _____ (Farbar) C:\Users\PM\Desktop\FRST.exe

2013-08-17 10:11 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2013-08-17 10:11 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2013-08-17 10:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2013-08-17 10:11 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2013-08-17 10:10 - 2013-08-17 16:54 - 00000000 ____D C:\Qoobox

2013-08-17 10:04 - 2013-08-17 10:09 - 05105390 ____R (Swearware) C:\Users\PM\Desktop\ComboFix.exe

2013-08-17 08:59 - 2013-08-17 10:25 - 00000000 ____D C:\Windows\erdnt

2013-08-17 08:42 - 2013-08-17 08:44 - 00075013 _____ C:\AdwCleaner[S1].txt

2013-08-17 08:42 - 2013-08-17 08:44 - 00000157 _____ C:\Windows\DeleteOnReboot.bat

2013-08-17 00:21 - 2013-08-17 00:21 - 00000000 ____D C:\_OTL

2013-08-16 23:55 - 2013-08-17 20:10 - 00000000 ____D C:\FRST

2013-08-16 20:07 - 2013-08-16 20:07 - 00000000 ____D C:\Users\PM\Desktop\Wintrack

2013-08-16 19:26 - 2013-08-16 19:26 - 00000527 _____ C:\Users\PM\Desktop\Denis - Verknüpfung.lnk

2013-08-16 19:23 - 2013-08-16 19:24 - 00000000 ____D C:\Users\PM\Desktop\Bewerbung

2013-08-16 19:23 - 2013-08-16 19:23 - 00000000 ____D C:\Users\PM\Desktop\Anschreiben, Status

2013-08-16 06:34 - 2013-08-16 06:34 - 00080248 _____ C:\OTL1.txt

2013-08-16 06:34 - 2013-08-16 06:34 - 00034466 _____ C:\Extras1.txt

2013-08-16 06:30 - 2013-08-16 18:32 - 00043352 _____ C:\Extras.Txt

2013-08-16 06:29 - 2013-08-17 19:57 - 00061446 _____ C:\OTL.Txt

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\NIS60dDE.exe

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 613529.crdownload

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 281099.crdownload

2013-08-14 23:33 - 2013-08-14 23:33 - 00000000 ____D C:\Program Files\Common Files\Bitdefender

2013-08-06 13:55 - 2013-08-06 13:55 - 00004096 ____H C:\Users\PM\AppData\Local\keyfile3.drm
 

==================== One Month Modified Files and Folders =======
 

2013-08-17 20:20 - 2010-01-31 08:56 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-17 20:20 - 2007-07-16 03:22 - 01968664 _____ C:\Windows\WindowsUpdate.log

2013-08-17 20:17 - 2010-01-31 08:56 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-17 20:17 - 2007-06-18 13:39 - 00000000 ____D C:\Windows\SMINST

2013-08-17 20:17 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-08-17 20:17 - 2006-11-02 14:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-17 20:17 - 2006-11-02 14:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-17 20:16 - 2006-11-02 15:01 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-08-17 20:16 - 2006-11-02 12:33 - 01517318 _____ C:\Windows\system32\PerfStringBackup.INI

2013-08-17 20:15 - 2013-08-17 20:15 - 00000000 ____D C:\Program Files\ESET

2013-08-17 20:10 - 2013-08-16 23:55 - 00000000 ____D C:\FRST

2013-08-17 20:09 - 2007-06-18 13:41 - 00412220 _____ C:\Windows\PFRO.log

2013-08-17 20:00 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public

2013-08-17 19:57 - 2013-08-16 06:29 - 00061446 _____ C:\OTL.Txt

2013-08-17 18:36 - 2013-08-17 18:34 - 00000908 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-08-17 18:36 - 2013-08-17 18:34 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-08-17 18:35 - 2013-08-17 18:35 - 00000000 ____D C:\Users\PM\AppData\Roaming\Malwarebytes

2013-08-17 18:34 - 2013-08-17 18:34 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-17 18:10 - 2013-08-17 18:13 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\PM\Desktop\mbam-setup-1.75.0.1300.exe

2013-08-17 18:08 - 2013-08-17 13:48 - 00139264 _____ C:\Users\PM\Desktop\SystemLook.exe

2013-08-17 18:02 - 2006-11-02 14:47 - 00400344 _____ C:\Windows\system32\FNTCACHE.DAT

2013-08-17 16:54 - 2013-08-17 16:54 - 00009694 _____ C:\ComboFix.txt

2013-08-17 16:54 - 2013-08-17 10:10 - 00000000 ____D C:\Qoobox

2013-08-17 16:52 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini

2013-08-17 16:51 - 2007-09-01 15:57 - 00000000 ____D C:\Users\PM

2013-08-17 12:36 - 2013-08-17 12:46 - 01068993 _____ (Farbar) C:\Users\PM\Desktop\FRST.exe

2013-08-17 10:27 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default

2013-08-17 10:25 - 2013-08-17 08:59 - 00000000 ____D C:\Windows\erdnt

2013-08-17 10:09 - 2013-08-17 10:04 - 05105390 ____R (Swearware) C:\Users\PM\Desktop\ComboFix.exe

2013-08-17 10:08 - 2009-11-26 16:41 - 00000000 ____D C:\Users\PM\Tracing

2013-08-17 08:44 - 2013-08-17 08:42 - 00075013 _____ C:\AdwCleaner[S1].txt

2013-08-17 08:44 - 2013-08-17 08:42 - 00000157 _____ C:\Windows\DeleteOnReboot.bat

2013-08-17 08:19 - 2008-08-25 22:46 - 00000412 ____H C:\Windows\Tasks\User_Feed_Synchronization-{45D4D7FF-D19B-4345-8B4E-5C1638791C24}.job

2013-08-17 00:21 - 2013-08-17 00:21 - 00000000 ____D C:\_OTL

2013-08-16 23:07 - 2009-08-30 14:52 - 00000000 ____D C:\Ablage Wolfgang

2013-08-16 22:26 - 2009-12-03 22:53 - 00000000 ____D C:\Users\PM\AppData\Roaming\WinTrack

2013-08-16 20:07 - 2013-08-16 20:07 - 00000000 ____D C:\Users\PM\Desktop\Wintrack

2013-08-16 19:26 - 2013-08-16 19:26 - 00000527 _____ C:\Users\PM\Desktop\Denis - Verknüpfung.lnk

2013-08-16 19:26 - 2010-08-22 17:55 - 00000000 ____D C:\Denis

2013-08-16 19:24 - 2013-08-16 19:23 - 00000000 ____D C:\Users\PM\Desktop\Bewerbung

2013-08-16 19:23 - 2013-08-16 19:23 - 00000000 ____D C:\Users\PM\Desktop\Anschreiben, Status

2013-08-16 18:32 - 2013-08-16 06:30 - 00043352 _____ C:\Extras.Txt

2013-08-16 13:33 - 2007-06-18 13:21 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-16 13:33 - 2006-11-02 12:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2013-08-16 13:32 - 2006-11-02 12:23 - 00000277 _____ C:\Windows\win.ini

2013-08-16 06:34 - 2013-08-16 06:34 - 00080248 _____ C:\OTL1.txt

2013-08-16 06:34 - 2013-08-16 06:34 - 00034466 _____ C:\Extras1.txt

2013-08-15 17:50 - 2008-03-09 14:34 - 00026624 _____ C:\Users\PM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\NIS60dDE.exe

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 613529.crdownload

2013-08-15 10:46 - 2013-08-15 10:46 - 83665920 _____ C:\Users\PM\Downloads\Nicht bestätigt 281099.crdownload

2013-08-15 10:43 - 2011-06-08 16:38 - 00001356 _____ C:\Users\PM\AppData\Local\d3d9caps.dat

2013-08-14 23:33 - 2013-08-14 23:33 - 00000000 ____D C:\Program Files\Common Files\Bitdefender

2013-08-13 21:37 - 2007-06-18 13:20 - 00000000 ____D C:\Program Files\Microsoft Office

2013-08-13 11:54 - 2012-11-06 00:00 - 00000000 ____D C:\Users\PM\AppData\Local\Paint.NET

2013-08-13 09:35 - 2007-09-01 16:02 - 00000000 ____D C:\Users\PM\AppData\Local\Google

2013-08-06 13:55 - 2013-08-06 13:55 - 00004096 ____H C:\Users\PM\AppData\Local\keyfile3.drm

2013-07-31 08:13 - 2007-09-01 16:01 - 00108136 _____ C:\Users\PM\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-22 13:02 - 2012-02-21 20:01 - 00000310 _____ C:\Windows\Tasks\HPCeeScheduleForPM.job
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-08-17 20:23
 

==================== End Of Log ============================

--- --- ---

--------------------------------------------------------------------------

Code:



Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-08-2013

Ran by PM at 2013-08-17 20:32:02

Running from C:\Users\PM\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

 Update for Microsoft Office 2007 (KB2508958)

ABBYY FineReader 6.0 Sprint (Version: 6.0.0.1550.41613)

Activation Assistant for the 2007 Microsoft Office suites

Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)

Adobe AIR (Version: 1.5.0.7220)

Adobe Flash Player 10 Plugin (Version: 10.1.82.76)

Adobe Flash Player 11 ActiveX (Version: 11.0.1.152)

Adobe Reader X (10.1.4) - Deutsch (Version: 10.1.4)

Advertising Center (Version: 0.0.0.1)

Ahead Nero Burning ROM

AppCore (Version: 1)

Apple Software Update (Version: 2.1.1.116)

AVG 2012 (Version: 12.0.3162)

Biet-O-Matic v2.14.8 (Version: 2.14.8)

Bonjour (Version: 1.0.106)

Brother MFL-Pro Suite MFC-290C (Version: 1.1.8.0)

Counter-Strike

FinePixViewer Resource

FinePixViewer Ver.5.0

FoxTab Video Converter

Google Chrome (Version: 28.0.1500.95)

Google Update Helper (Version: 1.3.21.153)

Hardware Diagnose Tools (Version: 5.00.4424.15)

Haufe iDesk-Browser (Version: 8.07.16.5590)

Haufe iDesk-Service (Version: 8.08.20.5622)

HP Advisor (Version: 3.1.9152.3107)

HP Customer Experience Enhancements (Version: 5.1.0.2264)

HP Customer Feedback (Version: 1.0.0)

HP Easy Setup - Frontend (Version: 5.1.0.2269)

HP On-Screen Cap/Num/Scroll Lock Indicator

HP Photosmart Essential 2.0 (Version: 2.0)

HP Photosmart Essential2.5 (Version: 1.00.0000)

HP Picasso Media Center Add-In (Version: 1.0.0)

HP Update (Version: 5.002.002.002)

Java 7 Update 7 (Version: 7.0.70)

Java Auto Updater (Version: 2.1.9.0)

Java(TM) 6 Update 2 (Version: 1.6.0.20)

JDownloader (Version: 0.89)

Konz 2012 (Version: 1.00.0000)

Konz 2013 (Version: 1.00.0000)

LeechFTP 

Lexmark Symbolleiste

Lexware Info Service (Version: 2.70.00.0081)

LightScribe  1.4.142.1 (Version: 1.4.142.1)

LiveUpdate Notice (Symantec Corporation) (Version: 1.4.5)

LokProgrammer v2 (Version: 2.7.9)

Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)

McAfee Security Scan Plus (Version: 3.0.318.3)

Microsoft .NET Framework 1.1 (Version: 1.1.4322)

Microsoft .NET Framework 1.1 Security Update (KB2416447)

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6012.5000)

Microsoft Choice Guard (Version: 2.0.48.0)

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)

Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)

Microsoft Office FrontPage 2003 (Version: 11.0.8173.0)

Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)

Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)

Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)

Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)

Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)

Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)

Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)

Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Works (Version: 08.05.0822)

Mozilla Firefox 22.0 (x86 de) (Version: 22.0)

Mozilla Maintenance Service (Version: 22.0)

MSVCRT (Version: 14.0.1468.721)

MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)

MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)

MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)

muvee autoProducer 6.0 (Version: 6.00.050)

Nero 9 Essentials

Nero ControlCenter (Version: 9.0.0.1)

Nero Installer (Version: 4.4.9.0)

Nero Online Upgrade (Version: 1.3.0.0)

Nero StartSmart (Version: 9.4.12.100)

Nero StartSmart OEM (Version: 9.4.10.100)

neroxml (Version: 1.0.0)

Norton Internet Security (Version: 10.2.0.30)

NVIDIA Drivers

Optimierte Multimedia-Tastatur-Lösung

Paint.NET v3.5.10 (Version: 3.60.0)

PaperPort Image Printer (Version: 1.00.0000)

PDF24 Creator 5.6.0

pdfforge Toolbar v7.1 (Version: 7.1)

PKH-fix 3.2

PL-2303 USB-to-Serial (Version: 1.1.0)

PSSWCORE (Version: 2.00.5000)

Python 2.4.3 (Version: 2.4.3150)

Railroad & Co. Version 5.8

RapidShare Manager (Version: 0.1)

RAW FILE CONVERTER LE

RealPlayer

Realtek High Definition Audio Driver (Version: 6.0.1.5548)

Roxio Activation Module (Version: 1.0)

Roxio Creator Audio (Version: 3.4.0)

Roxio Creator Basic v9 (Version: 3.4.0)

Roxio Creator Copy (Version: 3.4.0)

Roxio Creator Data (Version: 3.4.0)

Roxio Creator EasyArchive (Version: 3.4.0)

Roxio Creator Tools (Version: 3.4.0)

Roxio Express Labeler 3 (Version: 3.2.1)

Roxio MyDVD Basic v9 (Version: 9.0.559)

RTC Client API v1.2 (Version: 1.2.0000)

ScanSoft PaperPort 11 (Version: 11.1.0000)

Spelling Dictionaries Support For Adobe Reader 8 (Version: 8.0.0)

Steam (Version: 1.0.0.0)

Steuer 2007 (Version: 14.00)

Steuer 2010 (Version: 17.00.00.0062)

Steuer 2011 (Version: 19.00.7304)

Steuer 2012 (Version: 20.00.8137)

Steuer Hilfesammlung (Version: 14.0.0.0)

Steuer Hilfesammlung (Version: 15.0.0.0)

Symantec Real Time Storage Protection Component (Version: 10.2.2.6)

SymNet (Version: 7.2.1.110)

TomTom HOME Visual Studio Merge Modules (Version: 1.0.2)

TuneUp Utilities 2012 (Version: 12.0.2160.11)

TuneUp Utilities Language Pack (de-DE) (Version: 12.0.2160.11)

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update für Microsoft Office Excel 2007 Help (KB963678)

Update für Microsoft Office Powerpoint 2007 Help (KB963669)

Update für Microsoft Office Word 2007 Help (KB963665)

Windows Live Anmelde-Assistent (Version: 5.000.818.6)

Windows Live Call (Version: 14.0.8117.0416)

Windows Live Communications Platform (Version: 14.0.8117.416)

Windows Live Essentials (Version: 14.0.8117.0416)

Windows Live Essentials (Version: 14.0.8117.416)

Windows Live Messenger (Version: 14.0.8117.0416)

Windows Live-Uploadtool (Version: 14.0.8014.1029)

Windows-Treiberpaket - FTDI CDM Driver Package (10/22/2009 2.06.00) (Version: 10/22/2009 2.06.00)

WinRAR archiver

WinTrack 3D-Modelle (Teil 1-11)

WinTrack Demo Version 10.0 3D (Version: 10.0 3D)

WinTrack V9.0 3D

 
 

==================== Restore Points  =========================
 

11-07-2013 07:57:17 Geplanter Prüfpunkt

12-07-2013 06:49:31 Windows Update

12-07-2013 07:01:11 Windows Update

13-07-2013 09:45:16 Geplanter Prüfpunkt

14-07-2013 16:26:39 Geplanter Prüfpunkt

15-07-2013 07:06:55 Geplanter Prüfpunkt

15-07-2013 10:26:48 Installiert Steuer 2012

16-07-2013 06:26:15 Windows Update

17-07-2013 21:06:54 Windows Update

18-07-2013 17:13:15 Geplanter Prüfpunkt

19-07-2013 10:53:03 Geplanter Prüfpunkt

19-07-2013 21:38:08 Windows Update

20-07-2013 17:29:59 Geplanter Prüfpunkt

21-07-2013 21:36:45 Geplanter Prüfpunkt

23-07-2013 06:40:31 Windows Update

23-07-2013 19:39:18 Geplanter Prüfpunkt

24-07-2013 08:22:46 Geplanter Prüfpunkt

25-07-2013 19:02:16 Geplanter Prüfpunkt

26-07-2013 05:48:15 Windows Update

27-07-2013 13:29:09 Geplanter Prüfpunkt

28-07-2013 10:50:38 Geplanter Prüfpunkt

30-07-2013 06:02:39 Windows Update

30-07-2013 18:35:57 Geplanter Prüfpunkt

02-08-2013 07:08:27 Windows Update

04-08-2013 19:06:33 Geplanter Prüfpunkt

05-08-2013 18:56:45 Geplanter Prüfpunkt

06-08-2013 07:32:56 Windows Update

09-08-2013 07:21:01 Windows Update

10-08-2013 10:30:50 Geplanter Prüfpunkt

11-08-2013 17:55:53 Geplanter Prüfpunkt

12-08-2013 15:22:11 Geplanter Prüfpunkt
 

==================== Hosts content: ==========================
 

2006-11-02 12:23 - 2013-08-17 16:52 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {0C57124A-989C-4DC9-A85A-65E1F56F3C18} - System32\Tasks\HPCeeScheduleForPM => C:\Program Files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-03-07] (Hewlett-Packard)

Task: {1519696E-009F-4429-B757-515F06B2BFD9} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2008-01-18] (Microsoft Corporation)

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM

Task: {27092A8B-44A9-4341-A174-A718C61A8610} - System32\Tasks\Microsoft\Windows\RestartManager\{07D857BA-122E-4753-840D-86CE76F8B495} => C:\Windows\system32\rmclient.exe [2006-11-02] (Microsoft Corporation)

Task: {2B0EF2C6-9FCF-4271-BAB0-8815DED0A084} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2008-12-08] (Hewlett-Packard)

Task: {2D1F265C-45DF-49E9-8D44-1D7F579325BF} - \RegCure No Task File

Task: {2D36B681-011A-4CC0-B69B-ED36239558F3} - System32\Tasks\ScanSoft Background Update => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)

Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages

Task: {423F6588-C47F-45BB-9384-CD945A2FF3F1} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-18] (Microsoft Corp.)

Task: {4492F359-46DE-4614-98F9-C047A161D1DD} - System32\Tasks\Sun Microsystems-Online-Aktualisierungsprogramm => C:\Program Files\Java\jre6\bin\jusched.exe No File

Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-18] (Microsoft Corporation)

Task: {7AF7316D-F704-4D0A-A2F1-BEDDED2233AF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-31] (Google Inc.)

Task: {8FDF5864-5687-4168-A063-E691EF6D899A} - \RegCure Program Check No Task File

Task: {A4D279C6-4536-4634-A75A-AE6C1D0B73DF} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-18] (Microsoft Corporation)

Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-18] (Microsoft Corporation)

Task: {AC24617D-D855-4B90-8F81-DE93EE579ECD} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI

Task: {ACB04661-E9F4-4E22-B960-F8D250F3E721} - System32\Tasks\Advanced System Protector => C:\Program Files\RegClean Pro\SystweakASP.exe No File

Task: {AE373B69-DD63-4339-8C1A-17BF79D592F8} - System32\Tasks\{D49F5661-E562-4E51-A948-1282240E8CE5} => C:\Program Files\Skype\Phone\Skype.exe No File

Task: {B2BA7CA1-617D-40CF-AA29-3EA2E51DAD3E} - System32\Tasks\User_Feed_Synchronization-{45D4D7FF-D19B-4345-8B4E-5C1638791C24} => C:\Windows\system32\msfeedssync.exe [2008-01-18] (Microsoft Corporation)

Task: {B37B3F24-B563-419A-8A13-E17C7CD85F55} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe No File

Task: {C06617F8-3222-43FC-86C5-6C52D0BF0B19} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files\TuneUp Utilities 2012\OneClick.exe [2011-12-14] (TuneUp Software)

Task: {C76BFDFF-B62E-4971-9766-CBFF98283676} - System32\Tasks\Lexware-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [2010-09-15] (Haufe-Lexware GmbH & Co. KG)

Task: {CD1C5AE0-35B1-4184-B4CD-A2B2DCE9E8A2} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe No File

Task: {E4A511C6-E22C-4473-934E-0CCCE5CB31B2} - System32\Tasks\pmrsud => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)

Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()

Task: {E5831471-BD3F-4FAF-A99B-52D364254837} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-31] (Google Inc.)

Task: {F094E537-DCBD-460C-B3E4-A1F98552D349} - System32\Tasks\At1 => C:\Users\PM\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE No File

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\HPCeeScheduleForPM.job => C:\Program Files\hewlett-packard\sdp\ceement\HPCEE.exe

Task: C:\Windows\Tasks\User_Feed_Synchronization-{45D4D7FF-D19B-4345-8B4E-5C1638791C24}.job => C:\Windows\system32\msfeedssync.exe
 

==================== Faulty Device Manager Devices =============
 

Name: Microsoft-ISATAP-Adapter

Description: Microsoft-ISATAP-Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)

Resolution: Update the driver
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/17/2013 07:35:48 PM) (Source: EventSystem) (User: )

Description: d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
 

Error: (08/17/2013 06:22:51 PM) (Source: EventSystem) (User: )

Description: d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
 

Error: (08/17/2013 06:02:35 PM) (Source: EventSystem) (User: )

Description: d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
 

Error: (08/17/2013 04:54:40 PM) (Source: EventSystem) (User: )

Description: d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
 

Error: (08/17/2013 04:54:03 PM) (Source: EventSystem) (User: )

Description: d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
 

Error: (08/17/2013 04:51:50 PM) (Source: EventSystem) (User: )

Description: d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
 

Error: (08/17/2013 05:36:46 PM) (Source: EventSystem) (User: )

Description: d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
 

Error: (08/17/2013 05:32:14 PM) (Source: EventSystem) (User: )

Description: d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
 

Error: (08/17/2013 03:21:23 PM) (Source: EventSystem) (User: )

Description: d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp458007043c
 

Error: (08/17/2013 10:28:51 AM) (Source: Application Hang) (User: )

Description: Programm explorer.exe, Version 6.0.6001.18164 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.

Prozess-ID: e98

Anfangszeit: 01ce9b238d52d427

Zeitpunkt der Beendigung: 31
 
 

System errors:

=============
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2013-08-17 20:31:46.690

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-08-17 20:31:46.224

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-08-17 20:31:45.755

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-08-17 20:31:45.287

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-08-17 20:31:44.813

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-08-17 20:31:44.344

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-08-17 20:31:43.868

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-08-17 20:31:43.391

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-08-17 18:40:41.736

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-08-17 18:40:41.299

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 41%

Total physical RAM: 2045.82 MB

Available physical RAM: 1190.89 MB

Total Pagefile: 4334.16 MB

Available Pagefile: 3310.13 MB

Total Virtual: 2047.88 MB

Available Virtual: 1915.12 MB
 

==================== Drives ================================
 

Drive c: (HP) (Fixed) (Total:457.79 GB) (Free:305.14 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (Recovery) (Fixed) (Total:7.97 GB) (Free:1 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive g: (Transcend) (Removable) (Total:15.1 GB) (Free:14.21 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 466 GB) (Disk ID: 1549F232)

Partition 1: (Active) - (Size=458 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=8 GB) - (Type=07 NTFS)
 

========================================================

Disk: 6 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)

Partition 1: (Active) - (Size=15 GB) - (Type=0C)
 

==================== End Of Log ============================

Gruß Roland

Hallo Roland,

das sieht jetzt besser aus. Wie läuft der Rechner? Bemerkst du noch Probleme?
Dann müssen wir jetzt den Rechner noch absichern, damit sowas nicht wieder passiert...

Hinweis: Kein Antivirenprogramm

Ich sehe in deinen Logfiles kein laufendes Antivirenprogramm mit Hintergrundwächter.

Das ist gefährlich. Auch wenn so ein Wächter niemals alle Bedrohungen abwehren kann, ist er doch ein wichtiger Bestandteil, um den Rechner sauber zu halten.
Downloade und installiere bitte ein Antivirenprogramm mit Hintergrundwächter. Hier sind zwei mögliche Vorschläge:

Schritt 1

Mache einen Vollscan (über die ganze Festplatte) mit deinem neu installierten Antivirenprogramm. Poste das Logfile, falls es Funde gibt.

Schritt 2

Dein Java ist nicht mehr aktuell. Ältere Versionen enthalten Sicherheitslücken, die von Malware zur Infizierung per Drive-by Download missbraucht werden können.

Die aktuelle Version ist Java 7 Update 25.

Gehe zu
Start --> Systemsteuerung --> Programme und Funktionen (bei Vista / Win 7)
Start --> Systemsteuerung --> Software (bei Win XP)
und deinstalliere alle älteren Java-Versionen.

In wenigen Fällen wird Java wirklich benötigt. Auch werden immer wieder neue, noch nicht geschlossene Sicherheitslücken ausgenutzt.
Überleg dir also, ob du eine Java-Installation wirklich brauchst.
Falls du Java weiterhin verwenden möchtest, dann:

Lade dir die neueste Java-Version herunter.
Schliesse alle laufenden Programme, speziell den Browser.
Starte die heruntergeladene jxpiinstall.exe und folge den Anweisungen.
Entferne während der Installation den Haken bei "Installieren Sie die Ask-Toolbar ...".

Schritt 3

Die Version deines Adobe PDF Readers ist veraltet, wir müssen ihn updaten:

Deinstalliere bitte deine aktuelle Version von Adobe Reader über
Start --> Systemsteuerung --> Software (bei Windows XP)
Start --> Systemsteuerung --> Programme und Funktionen (bei Vista / Windows 7)
Besuche diese Seite von Adobe.
Entferne gegebenenfalls den Haken bei McAfee Security Scan bzw. Google Chrome.
Drücke auf Jetzt herunterladen und installiere die neuste Version.

Schritt 4

Dein Firefox ist nicht mehr aktuell.
Starte deinen Firefox als Administrator, klicke Hilfe --> Über Firefox und führe das angebotene Update durch.
Wiederhole diesen Schritt, bis Firefox als aktuell angezeigt wird.

Schritt 5

Dein Flashplayer ist veraltet. Installiere folgendermassen die aktuelle Version:

Besuche diese Seite von Adobe.
Entferne gegebenenfalls den Haken bei McAfee Security Scan bzw. Google Chrome.
Drücke auf Jetzt herunterladen und installiere die neuste Version.

Überprüfe dann mit diesem Plugin-Check (mit dem Firefox hier), ob nun alle deine verwendeten Versionen aktuell sind und update sie anderenfalls.

Bitte poste in deiner nächsten Antwort:

Log des Scans mit dem neuen AVP

Hallo Leo,

danke für die Hinweise, werde diese umsetzen, wird allerdings heute nichts mehr da ich gleich zum Dienst muss. Kann ich den IE verwenden oder sollte es lieber lassen?

Gruß Roland

Oh, beim IE hab ich vergessen, der muss ja auch noch unbedingt erneuert werden!

Downloade und installiere den Internet Explorer 9.
Der Internet Explorer sollte auch dann aktuell gehalten werden, wenn er nicht zum Surfen verwendet wird.

Ich würde nicht im Internet surfen, bis du alle diese Punkte abgearbeitet hast, denn im jetzigen Zustand ist dein Rechner höchst verwundbar!

Hallo Leo,

danke für die schnelle Rückantwort, wünsche Dir noch einen schönen Abend.
Melde mich dann Morgen wieder.

Gruß Roland