Trojaner-Board - Win7.32bit: Im Browser werden alle LINKS auf Werbeseiten umgeleitet

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Win7.32bit: Im Browser werden alle LINKS auf Werbeseiten umgeleitet (https://www.trojaner-board.de/144027-win7-32bit-browser-alle-links-werbeseiten-umgeleitet.html)

Win7.32bit: Im Browser werden alle LINKS auf Werbeseiten umgeleitet

Habe seit 3 Tagen das Problem, dass meine Browser nicht mehr funktionieren wie sie sollen.
Dauernde Pop Up's und in Hilfedateien werden die Hilfelinks nicht ausgeführt sondern es wird auf dubiose Werbeseiten umgeleitet.

Hinweis an die Helferin / den Helfer::nono:

NEIN ich nutze mein System nicht professionell auch wenn ich Vollversionen des BTS habe und Dell inkl. Dockingstation benutze. Alles privat und nicht gewerblich.

Defogger:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 14:18 on 03/11/2013 (Ralf)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

FRST:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013

Ran by Ralf (administrator) on BAGALUTH01 on 03-11-2013 14:24:49

Running from \\BAGALUTH01\Users\Public\Downloads

Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\AtService.exe

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe

(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe

(Dell Inc.) c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe

(Microsoft Corporation) C:\Program Files\Windows Home Server\esClient.exe

(Intel(R) Corporation) c:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

(Intel(R) Corporation) c:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(EnTech Taiwan) C:\Program Files\softOSD\softOSD.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe

(Microsoft Corporation) C:\Program Files\Windows Home Server\WHSConnector.exe

(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe

(Microsoft Corporation) C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe

(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe

(Broadcom Corporation) C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe

(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe

(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Apple Computer, Inc.) C:\Program Files\QuickTime\qttask.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Sony Corporation) D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe

(Microsoft Corporation) C:\Program Files\Windows Home Server\WHSTrayApp.exe

(EnTech Taiwan) C:\Windows\system32\softLCP.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(sayLsoftlite) C:\program files\lyricssay-16\lyricssay-16-bg.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Farbar) \\BAGALUTH01\Users\Public\Downloads\FRST.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [249856 2009-06-19] (Alps Electric Co., Ltd.)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [458844 2009-08-01] (IDT, Inc.)

HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-08-07] (Intel Corporation)

HKLM\...\Run: [DellControlPoint] - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe [657920 2009-11-02] (Dell Inc.)

HKLM\...\Run: [DellConnectionManager] - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe [1845248 2009-12-22] (Smith Micro Software, Inc.)

HKLM\...\Run: [WavXMgr] - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe [147328 2010-01-05] (Wave Systems Corp.)

HKLM\...\Run: [USCService] - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe [34232 2010-01-06] (Broadcom Corporation)

HKLM\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-25] (CyberLink Corp.)

HKLM\...\Run: [Zune Launcher] - C:\Program Files\Zune\ZuneLauncher.exe [159456 2011-08-05] (Microsoft Corporation)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)

HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\qttask.exe [98304 2013-01-27] (Apple Computer, Inc.)

HKLM\...\Run: [] - [x]

HKLM\...\Run: [Reader Library Launcher] - D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)

HKLM\...\Runonce: [Del243731640] - cmd.exe /Q /D /c del "C:\Users\Ralf\AppData\Local\Temp\0.del"

HKCU\...\Runonce: [Del243731640] - cmd.exe /Q /D /c del "C:\Users\Ralf\AppData\Local\Temp\0.del"

Lsa: [Authentication Packages] msv1_0 wvauth
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLRDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKCU - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = 

BHO: LyricsSay-16 - {11111111-1111-1111-1111-110411411158} - C:\Program Files\LyricsSay-16\LyricsSay-16-bho.dll (sayLsoftlite)

BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)

BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM - Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)

Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

========================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)

R2 arXfrSvc; C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [239472 2011-01-10] (Microsoft Corporation)

R2 ATService; C:\Program Files\Fingerprint Sensor\AtService.exe [1803512 2009-05-15] (AuthenTec, Inc.)

R2 buttonsvc32; C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe [278304 2009-11-20] (Dell Inc.)

R2 dcpsysmgrsvc; c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [386848 2009-12-10] (Dell Inc.)

R2 esClient; C:\Program Files\Windows Home Server\esClient.exe [97136 2011-01-10] (Microsoft Corporation)

S3 SecureStorageService; C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [1032192 2009-11-18] (Wave Systems Corp.)

R2 SMManager; C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [77312 2009-12-22] (Smith Micro Software, Inc.)

R2 softOSD; C:\Program Files\softOSD\softOSD.exe [291384 2010-12-18] (EnTech Taiwan)

R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe [221266 2009-08-01] (IDT, Inc.)

S2 tcsd_win32.exe; C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1273856 2008-11-12] ()

R2 TdmService; C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [1148264 2009-11-24] (Wave Systems Corp.)

R2 WHSConnector; C:\Program Files\Windows Home Server\WHSConnector.exe [376688 2011-01-10] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-30] (Avira Operations GmbH & Co. KG)

S3 Blfp; C:\Windows\System32\DRIVERS\basp.sys [84992 2009-05-11] (Broadcom Corporation)

R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [35560 2012-08-01] (AnchorFree Inc.)

R2 hwpsgt; C:\Windows\System32\DRIVERS\hwpsgt.sys [137344 2010-07-15] ()

R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)

R2 lemsgt; C:\Windows\System32\DRIVERS\lemsgt.sys [9472 2010-07-15] ()

R0 PBADRV; C:\Windows\System32\DRIVERS\PBADRV.sys [26608 2008-06-04] (Dell Inc)

S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2010-04-09] ()

S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2010-04-09] ()

S3 risdpcie; C:\Windows\system32\DRIVERS\risdpe86.sys [49152 2009-07-01] (REDC)

S3 rixdpcie; C:\Windows\system32\DRIVERS\rixdpe86.sys [38400 2009-07-05] (REDC)

R1 se32; C:\Windows\System32\Drivers\se32.sys [12112 2007-05-03] (EnTech Taiwan)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)

S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-08-01] (AnchorFree Inc)

R2 WavxDMgr; C:\Windows\System32\DRIVERS\WavxDMgr.sys [211328 2010-01-05] (Wave Systems Corp.)

S3 NvtSp50; System32\Drivers\NvtSp50.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST

2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe

2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log

2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe

2013-11-03 14:01 - 2013-11-03 14:05 - 00001124 _____ C:\Users\Ralf\Desktop\Continue Firefox Installation.lnk

2013-11-03 14:00 - 2013-11-03 14:00 - 00000288 _____ C:\Windows\Tasks\UpdaterEX.job

2013-11-03 14:00 - 2013-11-03 14:00 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\UpdaterEX

2013-10-31 18:19 - 2013-10-31 18:19 - 00001024 _____ C:\.rnd

2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate

2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk

2013-10-27 17:58 - 2013-10-27 17:59 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache

2013-10-27 17:57 - 2013-10-27 18:01 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre

2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk

2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2

2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk

2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared

2013-10-27 17:01 - 2013-10-31 18:19 - 00001860 _____ C:\Windows\Tasks\LyricsSay-16-firefoxinstaller.job

2013-10-27 17:01 - 2013-10-31 18:19 - 00001804 _____ C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job

2013-10-27 17:01 - 2013-10-31 18:19 - 00001332 _____ C:\Windows\Tasks\LyricsSay-16-updater.job

2013-10-27 17:01 - 2013-10-31 18:19 - 00001238 _____ C:\Windows\Tasks\LyricsSay-16-codedownloader.job

2013-10-27 17:01 - 2013-10-31 18:19 - 00001138 _____ C:\Windows\Tasks\LyricsSay-16-enabler.job

2013-10-27 17:01 - 2013-10-27 17:01 - 00000000 ____D C:\Program Files\Plus-HD-1.6

2013-10-27 17:01 - 2013-10-27 17:01 - 00000000 ____D C:\Program Files\LyricsSay-16

2013-10-27 15:00 - 2013-11-03 13:21 - 00105176 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2013-10-27 14:59 - 2013-11-03 13:21 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe

2013-10-27 12:57 - 2013-11-03 13:58 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony

2013-10-27 12:11 - 2013-10-27 17:15 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation

2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma

2013-10-24 20:12 - 2013-10-24 20:13 - 00000000 ____D C:\Windows\system32\Adobe

2013-10-10 21:30 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-10-10 21:30 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-10-10 21:30 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-10-10 21:30 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-10-10 21:30 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-10-10 21:30 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-10-10 10:23 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2013-10-10 10:23 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-10-10 10:23 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll

2013-10-10 10:23 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2013-10-10 10:23 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-10-10 10:23 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-10-10 10:23 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll

2013-10-10 10:23 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2013-10-10 10:23 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-10-10 10:23 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll

2013-10-10 10:23 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2013-10-10 10:23 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2013-10-10 10:23 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll

2013-10-10 10:23 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys

2013-10-10 10:23 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys

2013-10-10 10:23 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2013-10-10 10:23 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2013-10-10 10:23 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2013-10-10 10:23 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2013-10-10 10:23 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2013-10-10 10:22 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys

2013-10-10 10:22 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll

2013-10-10 10:22 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll

2013-10-10 10:22 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2013-10-10 10:22 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
 

==================== One Month Modified Files and Folders =======
 

2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST

2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe

2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log

2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe

2013-11-03 14:05 - 2013-11-03 14:01 - 00001124 _____ C:\Users\Ralf\Desktop\Continue Firefox Installation.lnk

2013-11-03 14:00 - 2013-11-03 14:00 - 00000288 _____ C:\Windows\Tasks\UpdaterEX.job

2013-11-03 14:00 - 2013-11-03 14:00 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\UpdaterEX

2013-11-03 13:58 - 2013-10-27 12:57 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Adobe

2013-11-03 13:35 - 2013-07-08 06:02 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-03 13:35 - 2013-03-22 19:30 - 00000000 ____D C:\Users\Ralf\Desktop\mbar

2013-11-03 13:26 - 2009-07-14 05:55 - 01478104 _____ C:\Windows\WindowsUpdate.log

2013-11-03 13:21 - 2013-10-27 15:00 - 00105176 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2013-11-03 13:21 - 2013-10-27 14:59 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2013-10-31 20:16 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-10-31 20:16 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-10-31 18:23 - 2010-04-23 16:09 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI

2013-10-31 18:20 - 2010-05-03 15:25 - 00115672 _____ C:\Users\Ralf\AppData\Local\GDIPFONTCACHEV1.DAT

2013-10-31 18:20 - 2010-05-03 15:24 - 00000000 _____ C:\Users\Ralf\AppData\Local\WavXMapDrive.bat

2013-10-31 18:19 - 2013-10-31 18:19 - 00001024 _____ C:\.rnd

2013-10-31 18:19 - 2013-10-27 17:01 - 00001860 _____ C:\Windows\Tasks\LyricsSay-16-firefoxinstaller.job

2013-10-31 18:19 - 2013-10-27 17:01 - 00001804 _____ C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job

2013-10-31 18:19 - 2013-10-27 17:01 - 00001332 _____ C:\Windows\Tasks\LyricsSay-16-updater.job

2013-10-31 18:19 - 2013-10-27 17:01 - 00001238 _____ C:\Windows\Tasks\LyricsSay-16-codedownloader.job

2013-10-31 18:19 - 2013-10-27 17:01 - 00001138 _____ C:\Windows\Tasks\LyricsSay-16-enabler.job

2013-10-31 18:19 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-10-31 18:19 - 2009-07-14 05:39 - 00132693 _____ C:\Windows\setupact.log

2013-10-31 18:18 - 2009-07-14 05:33 - 00426736 _____ C:\Windows\system32\FNTCACHE.DAT

2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate

2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk

2013-10-27 18:01 - 2013-10-27 17:57 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre

2013-10-27 17:59 - 2013-10-27 17:58 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache

2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk

2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2

2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk

2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared

2013-10-27 17:15 - 2013-10-27 12:11 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation

2013-10-27 17:01 - 2013-10-27 17:01 - 00000000 ____D C:\Program Files\Plus-HD-1.6

2013-10-27 17:01 - 2013-10-27 17:01 - 00000000 ____D C:\Program Files\LyricsSay-16

2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe

2013-10-27 12:57 - 2010-05-06 11:33 - 00000000 ____D C:\Users\Ralf\AppData\Local\Mozilla

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony

2013-10-27 12:12 - 2010-05-03 15:24 - 00000000 ____D C:\Users\Ralf

2013-10-27 12:12 - 2010-04-23 16:05 - 00000000 ____D C:\Program Files\DIFX

2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma

2013-10-24 20:14 - 2010-04-23 16:02 - 00000000 ____D C:\Windows\system32\Macromed

2013-10-24 20:13 - 2013-10-24 20:12 - 00000000 ____D C:\Windows\system32\Adobe

2013-10-21 17:28 - 2013-09-01 15:10 - 00000000 ____D C:\Users\Ralf\AppData\Local\Thunderbird

2013-10-17 18:12 - 2011-05-19 13:03 - 00028672 _____ C:\Users\Ralf\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-10-15 19:48 - 2012-03-29 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-10-15 19:48 - 2011-05-19 12:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-10-14 18:37 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache

2013-10-14 18:21 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-10-14 17:46 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE

2013-10-14 17:44 - 2010-04-23 16:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-10-10 21:35 - 2010-05-06 14:54 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-10-10 21:33 - 2013-07-31 07:45 - 00000000 ____D C:\Windows\system32\MRT

2013-10-10 21:31 - 2010-05-06 15:26 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
 

Some content of TEMP:

====================

C:\Users\Ralf\AppData\Local\temp\eblinstaller.exe

C:\Users\Ralf\AppData\Local\temp\ICReinstall_Firefox_Setup.exe

C:\Users\Ralf\AppData\Local\temp\jre-7u21-windows-i586-iftw.exe

C:\Users\Ralf\AppData\Local\temp\jre-7u25-windows-i586-iftw.exe

C:\Users\Ralf\AppData\Local\temp\Shockwave_Installer_FF.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-31 18:37
 

==================== End Of Log ============================

Addition:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013

Ran by Ralf at 2013-11-03 14:25:21

Running from \\BAGALUTH01\Users\Public\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

Adobe Acrobat X Standard - English, Français, Deutsch (Version: 10.1.8)

Adobe Digital Editions 2.0 (Version: 2.0)

Adobe Flash Player 11 ActiveX (Version: 11.3.300.265)

Adobe Flash Player 11 Plugin (Version: 11.9.900.117)

Adobe Shockwave Player 12.0 (Version: 12.0.4.144)

AuthenTec Fingerprint Software (Version: 8.4.2.5)

Avira Free Antivirus (Version: 13.0.0.4052)

Bing Bar (Version: 7.0.850.0)

BioAPI Framework (Version: 1.0.1)

Broadcom NetXtreme-I Netlink Driver and Management Installer (Version: 12.25.02)

calibre (Version: 1.8.0)

DCP32MMWrapper (Version: 1.6.453.66)

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

Dell Control Point (Version: 1.6.453.66)

Dell ControlPoint Connection Manager (Version: 1.4.0)

Dell ControlPoint Security Manager (Version: 1.6.453.66)

Dell ControlPoint System Manager (Version: 1.4.00000)

Dell Edoc Viewer (Version: 1.0.0)

Dell Embassy Trust Suite by Wave Systems (Version: 03.05.00.079)

Dell Security Device Driver Pack (Version: 1.4.050)

Dell Touchpad (Version: 7.2.101.230)

Document Manager Lite (Version: 06.09.00.147)

EMBASSY Security Center (Version: 04.00.00.071)

EMBASSY Security Setup (Version: 04.00.00.058)

ESC Home Page Plugin (Version: 04.00.00.010)

Extended Update

GameSpy Arcade

Gemalto (Version: 01.01.00.0000)

Informaticus (Version: 1.00.000)

Intel PROSet Wireless

Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.2226)

Intel(R) PROSet/Wireless WiFi-Software (Version: 13.00.0000)

Intel(R) TV Wizard

Intel® Matrix Storage Manager

IrfanView (remove only) (Version: 4.28)

Junk Mail filter update (Version: 14.0.8089.726)

LyricsSay-16 (Version: 1.29.153.2)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6012.5000)

Microsoft Choice Guard (Version: 2.0.48.0)

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Home and Student 2010 (Version: 14.0.6029.1000)

Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)

Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)

Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)

Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft Office Single Image 2010 (Version: 14.0.6029.1000)

Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)

Microsoft PhotoDraw 2000 V2 (Version: 2.00.00.1429)

Microsoft Silverlight (Version: 5.1.20913.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)

Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0)

Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)

Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)

Mozilla Thunderbird 17.0.8 (x86 de) (Version: 17.0.8)

MSVCRT (Version: 14.0.1468.721)

MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)

NTRU TCG Software Stack (Version: 2.1.29)

OpenOffice.org 3.2 (Version: 3.2.9502)

Partition Wizard Home Edition 5.0

Pat4Tool (Version: 1.0.0)

Patrizier 4 (Version: 1.3.0)

Patrizier II Gold

Patrizier IV - Aufstieg einer Dynastie (Version: 2.0.4.0)

Patrizier IV Demo (Version: 1.0.0)

Plus-HD-1.6 (Version: 1.29.153.0)

PowerDVD DX (Version: 8.3.5424)

Preboot Manager (Version: 03.00.00.085)

Private Information Manager (Version: 06.04.00.057)

Product Key Explorer 3.1.3

ProtectDisc Driver, Version 11 (Version: 11.0.0.14)

PRS-500 USB driver (Version: 1.0.00.08110)

Puzzle Agent - The Mystery of Scoggins (Version: 1.0.0.0)

QuickTime

Reader Library by Sony (Version: 3.3.00.07130)

Rome - Total War - Gold Edition (Version: 1.6)

Roxio Creator Audio (Version: 3.7.0)

Roxio Creator Copy (Version: 3.7.0)

Roxio Creator Data (Version: 3.7.0)

Roxio Creator DE 10.3 (Version: 10.3)

Roxio Creator DE 10.3 (Version: 3.7.0)

Roxio Creator Tools (Version: 3.7.0)

Roxio Express Labeler 3 (Version: 3.2.2)

Roxio Update Manager (Version: 6.0.0)

Security Wizards (Version: 01.07.00.023)

SO32MMWrapper (Version: 1.6.453.66)

softOSD Client (Build 1445)

Sven - Die ersten 10 Jahre (Version: 1.00)

swMSM (Version: 12.0.0.1)

System Requirements Lab for Intel (Version: 4.3.13.0)

Trusted Drive Manager (Version: 3.3.0.396)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)

Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition

Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition

Update for Microsoft Office 2010 (KB2494150)

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition

Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition

Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition

Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition

Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition

Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition

Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition

Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition

Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition

Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition

Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition

UPEK TouchChip Fingerprint Reader (Version: 1.2.0)

Vermeer 2 - Patch 1.1.0

VLC media player 1.1.7 (Version: 1.1.7)

Wave Infrastructure Installer (Version: 07.01.19.0000)

Wave Support Software (Version: 05.10.00.062)

WIDCOMM Bluetooth Software (Version: 6.2.1.100)

Windows Driver Package - Sony Corporation (PRSUSB) USB  (08/08/2006 1.0.03.08080) (Version: 08/08/2006 1.0.03.08080)

Windows Home Server-Connector (Version: 6.0.3436.0)

Windows Live Anmelde-Assistent (Version: 5.000.818.5)

Windows Live Call (Version: 14.0.8064.0206)

Windows Live Communications Platform (Version: 14.0.8064.206)

Windows Live Essentials (Version: 14.0.8089.0726)

Windows Live Essentials (Version: 14.0.8089.726)

Windows Live Fotogalerie (Version: 14.0.8081.709)

Windows Live Mail (Version: 14.0.8089.0726)

Windows Live Messenger (Version: 14.0.8089.0726)

Windows Live Movie Maker (Version: 14.0.8091.0730)

Windows Live Sync (Version: 14.0.8089.726)

Windows Live Writer (Version: 14.0.8089.0726)

Windows Live-Uploadtool (Version: 14.0.8014.1029)

Windows Mobile Device Updater Component (Version: 04.08.2345.00)

Windows-Treiberpaket - AuthenTec Inc. (ATSwpWDF) Biometric  (05/13/2009 8.4.2.0) (Version: 05/13/2009 8.4.2.0)

Windows-Treiberpaket - Dell Inc. PBADRV System  (09/11/2009 1.0.1.6) (Version: 09/11/2009 1.0.1.6)

WinRAR

WinZip

Yahoo! Detect

Youda Legend

Zune (Version: 04.08.2345.00)

Zune Language Pack (CHS) (Version: 04.08.2345.00)

Zune Language Pack (CHT) (Version: 04.08.2345.00)

Zune Language Pack (CSY) (Version: 04.08.2345.00)

Zune Language Pack (DAN) (Version: 04.08.2345.00)

Zune Language Pack (DEU) (Version: 04.08.2345.00)

Zune Language Pack (ELL) (Version: 04.08.2345.00)

Zune Language Pack (ESP) (Version: 04.08.2345.00)

Zune Language Pack (FIN) (Version: 04.08.2345.00)

Zune Language Pack (FRA) (Version: 04.08.2345.00)

Zune Language Pack (HUN) (Version: 04.08.2345.00)

Zune Language Pack (IND) (Version: 04.08.2345.00)

Zune Language Pack (ITA) (Version: 04.08.2345.00)

Zune Language Pack (JPN) (Version: 04.08.2345.00)

Zune Language Pack (KOR) (Version: 04.08.2345.00)

Zune Language Pack (MSL) (Version: 04.08.2345.00)

Zune Language Pack (NLD) (Version: 04.08.2345.00)

Zune Language Pack (NOR) (Version: 04.08.2345.00)

Zune Language Pack (PLK) (Version: 04.08.2345.00)

Zune Language Pack (PTB) (Version: 04.08.2345.00)

Zune Language Pack (PTG) (Version: 04.08.2345.00)

Zune Language Pack (RUS) (Version: 04.08.2345.00)

Zune Language Pack (SVE) (Version: 04.08.2345.00)
 

==================== Restore Points  =========================
 

24-10-2013 16:32:22 Windows Update

27-10-2013 11:11:35 Installed Reader Library by Sony.

27-10-2013 14:55:05 Removed Reader Library by Sony.

27-10-2013 16:14:55 Installed Reader Library by Sony.

27-10-2013 16:57:11 Installed calibre

31-10-2013 17:24:17 Windows Update

03-11-2013 12:56:01 Removed Adobe Reader XI (11.0.04) - Deutsch.
 

==================== Hosts content: ==========================
 

2009-07-14 03:04 - 2013-04-02 07:01 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {109DCF76-0CD3-4F08-8D35-D5B6F9BA5C08} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)

Task: {1BF846DC-5DC4-46F8-816F-35A52A418717} - System32\Tasks\LyricsSay-16-firefoxinstaller => C:\Program Files\LyricsSay-16\LyricsSay-16-firefoxinstaller.exe [2013-10-27] (sayLsoftlite)

Task: {28311E67-8079-4D7B-BA62-DDAC2DF4CC4E} - System32\Tasks\{47526870-9D54-471C-B415-F82E5B7494F7} => C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE

Task: {29234F6A-F0FA-49C7-A461-9EB03E7B6919} - System32\Tasks\{E45CE27F-DFE6-4385-B200-85DEE1A620E7} => C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE

Task: {2EA79B48-FFD2-45CA-9B1E-09B40292C385} - System32\Tasks\UpdaterEX => C:\Users\Ralf\AppData\Roaming\UpdaterEX\UpdateProc\UpdateTask.exe [2013-04-12] ()

Task: {46ED8C8E-54D5-4400-B46F-295CFD313FDD} - System32\Tasks\{76772A00-FA5E-4542-97FC-2EE104466C31} => E:\SETUP.EXE

Task: {6511A7B4-CB78-4A30-95B6-5443D7ED9DBA} - System32\Tasks\LyricsSay-16-codedownloader => C:\Program Files\LyricsSay-16\LyricsSay-16-codedownloader.exe [2013-10-27] (sayLsoftlite)

Task: {8AA13A9A-A43A-471F-8799-DD49893FADAB} - System32\Tasks\{5A37C895-47DD-4A5D-91B1-22A7BBE2A98E} => C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE

Task: {8ADFA22E-414A-455B-BA29-1DC3EB5D3911} - System32\Tasks\LyricsSay-16-updater => C:\Program Files\LyricsSay-16\LyricsSay-16-updater.exe [2013-10-27] (sayLsoftlite)

Task: {8FF3BAB9-DF35-437C-91BB-84AD93978519} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {9AC4CB2D-6F14-4BCD-A2FD-006275CF5A0B} - System32\Tasks\JavaUpdateSched => C:\Windows\System32\jusched.exe

Task: {9B8D7A75-26F9-4ABE-9129-7C5717699323} - System32\Tasks\{9A7AAE21-21DD-4D1B-AAC3-05848DF9000A} => E:\SETUP.EXE

Task: {BBE469BB-9807-42CC-84F5-70763F030E75} - System32\Tasks\LyricsSay-16-enabler => C:\Program Files\LyricsSay-16\LyricsSay-16-enabler.exe [2013-10-27] (sayLsoftlite)

Task: {C077D56C-D3A0-4C9E-AC36-EFEFAD7E9FF0} - System32\Tasks\{FBD94380-2320-4247-9C86-1D068164E70A} => E:\SETUP.EXE

Task: {CBB79945-871F-4295-9664-81992B0A2A55} - System32\Tasks\Plus-HD-1.6-firefoxinstaller => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe [2013-10-27] (Plus HD)

Task: C:\Windows\Tasks\LyricsSay-16-codedownloader.job => C:\Program Files\LyricsSay-16\LyricsSay-16-codedownloader.exe

Task: C:\Windows\Tasks\LyricsSay-16-enabler.job => C:\Program Files\LyricsSay-16\LyricsSay-16-enabler.exe

Task: C:\Windows\Tasks\LyricsSay-16-firefoxinstaller.job => C:\Program Files\LyricsSay-16\LyricsSay-16-firefoxinstaller.exe

Task: C:\Windows\Tasks\LyricsSay-16-updater.job => C:\Program Files\LyricsSay-16\LyricsSay-16-updater.exe

Task: C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe

Task: C:\Windows\Tasks\UpdaterEX.job => C:\Users\Ralf\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE
 

==================== Loaded Modules (whitelisted) =============
 

2010-12-12 20:53 - 1998-10-17 07:00 - 00033792 _____ () C:\Program Files\WinZip\WZSHLEXT.DLL

2009-11-19 21:48 - 2009-11-19 21:48 - 00278528 _____ () C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\ContextMenuItem.dll

2009-11-19 21:47 - 2009-11-19 21:47 - 00249856 _____ () C:\Windows\system32\wxvault.dll

2009-08-11 22:10 - 2009-08-11 22:10 - 00132384 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll

2009-12-22 17:19 - 2009-12-22 17:19 - 00573440 _____ () C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SmithMicro.Message.XmlSerializers.dll

2009-11-13 14:17 - 2009-11-13 14:17 - 00010752 _____ () C:\Windows\system32\Wavx_ESC_Logging.dll

2008-11-12 19:29 - 2008-11-12 19:29 - 00004608 _____ () C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\TspPopup_DEU.dll

2010-07-13 01:28 - 2010-07-13 01:28 - 00856064 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\fsk.dll

2010-07-13 01:13 - 2010-07-13 01:13 - 00033792 _____ () D:\Program Files\Sony\Reader\Data\bin\FskMediaPlayers.dll

2010-07-13 01:15 - 2010-07-13 01:15 - 00233472 _____ () D:\Program Files\Sony\Reader\Data\bin\Fskin.dll

2010-07-13 01:22 - 2010-07-13 01:22 - 00020480 _____ () D:\Program Files\Sony\Reader\Data\bin\FskinLocalize.dll

2010-04-02 21:23 - 2010-04-02 21:23 - 00815104 _____ () D:\Program Files\Sony\Reader\Data\bin\FskSecurity.dll

2010-07-13 01:16 - 2010-07-13 01:16 - 00118784 _____ () D:\Program Files\Sony\Reader\Data\bin\FskDocumentViewer.dll

2010-07-13 01:22 - 2010-07-13 01:22 - 00009728 _____ () D:\Program Files\Sony\Reader\Data\bin\FskPower.dll

2010-07-13 01:26 - 2010-07-13 01:26 - 00018432 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\FskNetInterface.dll

2010-07-13 01:15 - 2010-07-13 01:15 - 00010240 _____ () D:\Program Files\Sony\Reader\Data\bin\FskMobileMediaDevice.dll

2010-07-13 01:25 - 2010-07-13 01:25 - 00008704 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\FskTimeHardware.dll

2010-07-13 01:25 - 2010-07-13 01:25 - 00028160 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\ticket.dll

2010-07-13 01:25 - 2010-07-13 01:25 - 00011776 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\ebookDeviceNotifier.dll

2010-04-02 20:44 - 2010-04-02 20:44 - 00086016 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\ebookUsb.dll

2010-07-13 01:29 - 2010-07-13 01:29 - 00143360 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\connectionDetector.dll

2010-07-13 01:10 - 2010-07-13 01:10 - 00172032 _____ () D:\Program Files\Sony\Reader\Data\bin\launcher\USBDetector.dll

2013-10-27 17:01 - 2013-10-27 17:01 - 00414208 _____ () C:\program files\lyricssay-16\LyricsSay-16-buttonutil.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:C5760A8B
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\se32.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
 

==================== Faulty Device Manager Devices =============
 

Name: Dell Wireless 370 Bluetooth Mini-card

Description: Dell Wireless 370 Bluetooth Mini-card

Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}

Manufacturer: Broadcom

Service: BTHUSB

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (10/31/2013 06:41:36 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (10/27/2013 00:12:50 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (10/24/2013 08:43:15 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (10/24/2013 06:14:15 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (10/21/2013 06:24:07 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (10/21/2013 01:58:19 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (10/10/2013 08:50:47 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (10/10/2013 10:32:03 AM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (10/05/2013 11:38:11 AM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (09/30/2013 07:05:42 AM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 
 

System errors:

=============

Error: (11/03/2013 01:30:47 PM) (Source: mbamchameleon) (User: )

Description: olume3\PROGRAM FILES\AVIRA\ANTIVIR DESKTOP\AVWSC.EXE
 

Error: (11/03/2013 01:30:47 PM) (Source: mbamchameleon) (User: )

Description: \??\C:\Program Files\Avira\AntiVir Desktop\avwsc.exe
 

Error: (11/03/2013 01:25:56 PM) (Source: mbamchameleon) (User: )

Description: C00000BE
 

Error: (11/03/2013 01:25:56 PM) (Source: mbamchameleon) (User: )

Description: C00000BE
 

Error: (11/03/2013 01:25:56 PM) (Source: mbamchameleon) (User: )

Description: C00000BE
 

Error: (10/31/2013 06:20:52 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (10/31/2013 06:19:33 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%0
 

Error: (10/27/2013 07:31:02 PM) (Source: Disk) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR19 gefunden.
 

Error: (10/27/2013 07:31:01 PM) (Source: Disk) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR19 gefunden.
 

Error: (10/27/2013 07:31:00 PM) (Source: Disk) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR19 gefunden.
 
 

Microsoft Office Sessions:

=========================

Error: (10/31/2013 06:41:36 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80004005
 

Error: (10/27/2013 00:12:50 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80004005
 

Error: (10/24/2013 08:43:15 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80004005
 

Error: (10/24/2013 06:14:15 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80004005
 

Error: (10/21/2013 06:24:07 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80004005
 

Error: (10/21/2013 01:58:19 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80004005
 

Error: (10/10/2013 08:50:47 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80004005
 

Error: (10/10/2013 10:32:03 AM) (Source: Customer Experience Improvement Program)(User: )

Description: 80004005
 

Error: (10/05/2013 11:38:11 AM) (Source: Customer Experience Improvement Program)(User: )

Description: 80004005
 

Error: (09/30/2013 07:05:42 AM) (Source: Customer Experience Improvement Program)(User: )

Description: 80004005
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 47%

Total physical RAM: 3539.17 MB

Available physical RAM: 1854.25 MB

Total Pagefile: 7076.63 MB

Available Pagefile: 4933.25 MB

Total Virtual: 2047.88 MB

Available Virtual: 1898.01 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:94.67 GB) (Free:55.78 GB) NTFS

Drive d: (Daten) (Fixed) (Total:123.52 GB) (Free:72.13 GB) NTFS

Drive f: (VERBATIM) (Removable) (Total:7.38 GB) (Free:7.38 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 233 GB) (Disk ID: 6F7DDDC7)

Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)

Partition 2: (Active) - (Size=15 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=95 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=124 GB) - (Type=OF Extended)
 

========================================================

Disk: 1 (Size: 7 GB) (Disk ID: 00000000)

Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)
 

==================== End Of Log ============================

Gmer:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-11-03 15:30:22

Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD25 rev.11.0 232,89GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\Ralf\AppData\Local\Temp\kfrcapow.sys
 
 

---- System - GMER 2.1 ----
 

SSDT            952538DE                                                                                                                ZwCreateSection

SSDT            952538E8                                                                                                                ZwRequestWaitReplyPort

SSDT            952538E3                                                                                                                ZwSetContextThread

SSDT            952538ED                                                                                                                ZwSetSecurityObject

SSDT            952538F2                                                                                                                ZwSystemDebugControl

SSDT            9525387F                                                                                                                ZwTerminateProcess
 

---- Kernel code sections - GMER 2.1 ----
 

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                                                82C58A15 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                  82C92212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                                     82C9958C 4 Bytes  [DE, 38, 25, 95]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                                     82C998E8 4 Bytes  JMP A802816F 

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                                     82C9992C 4 Bytes  [E3, 38, 25, 95]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                                     82C999A8 4 Bytes  [ED, 38, 25, 95]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                                     82C999FC 4 Bytes  [F2, 38, 25, 95]

.text           ...                                                                                                                     

.vmp2           C:\Windows\system32\drivers\acedrv11.sys                                                                                entry point in ".vmp2" section [0x9CEC269D]
 

---- Devices - GMER 2.1 ----
 

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                fltmgr.sys
 

---- Registry - GMER 2.1 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\70f1a109efc1                                             

Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\70f1a109efc1 (not active ControlSet)                         

Reg             HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{E077A6D8-5903-11DF-8ADF-806E6F6E6963}  3133035904
 

---- EOF - GMER 2.1 ----

Über Hilfe wäre ich sehr dankbar.

greetings

Hein Bagaluth
Alias Ralf Tielmann

hi,

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Erst einmal vielen Dank für die prompte Hilfe.

Probleme gab es bisher keine bis auf eine weitere Virenmeldung von Avira beim Aufrufen des boards, weil wieder ein verseuchtes Pop Up da war.

Combofix anschließend ausgeführt.
Hier das log:

Code:

ComboFix 13-11-03.02 - Ralf 03.11.2013  18:08:03.2.2 - x86

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3539.1963 [GMT 1:00]

ausgeführt von:: c:\users\Ralf\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\LyricsSay-16

c:\program files\LyricsSay-16\44158.xpi

c:\program files\LyricsSay-16\background.html

c:\program files\LyricsSay-16\Installer.log

c:\program files\LyricsSay-16\LyricsSay-16-bg.exe

c:\program files\LyricsSay-16\LyricsSay-16-buttonutil.dll

c:\program files\LyricsSay-16\LyricsSay-16-buttonutil.exe

c:\program files\LyricsSay-16\LyricsSay-16-codedownloader.exe

c:\program files\LyricsSay-16\LyricsSay-16-enabler.exe

c:\program files\LyricsSay-16\LyricsSay-16-firefoxinstaller.exe

c:\program files\LyricsSay-16\LyricsSay-16-helper.exe

c:\program files\LyricsSay-16\LyricsSay-16-updater.exe

c:\program files\LyricsSay-16\LyricsSay-16.ico

c:\program files\LyricsSay-16\Uninstall.exe

c:\program files\LyricsSay-16\utils.exe

c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-10-03 bis 2013-11-03  ))))))))))))))))))))))))))))))

.

.

2013-11-03 17:16 . 2013-11-03 17:16        --------        d-----w-        c:\users\Ralf\AppData\Local\temp

2013-11-03 17:16 . 2013-11-03 17:16        --------        d-----w-        c:\users\Public\AppData\Local\temp

2013-11-03 17:16 . 2013-11-03 17:16        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-11-03 17:16 . 2013-11-03 17:16        --------        d-----w-        c:\users\Administrator\AppData\Local\temp

2013-11-03 13:24 . 2013-11-03 13:24        --------        d-----w-        C:\FRST

2013-11-03 13:00 . 2013-11-03 13:00        --------        d-----w-        c:\users\Ralf\AppData\Roaming\UpdaterEX

2013-11-03 10:45 . 2013-11-03 10:45        62576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{7AA846B5-D997-480A-8B8D-5DF39D9B12C0}\offreg.dll

2013-11-03 10:43 . 2013-10-14 06:39        7796464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{7AA846B5-D997-480A-8B8D-5DF39D9B12C0}\mpengine.dll

2013-10-27 17:25 . 2013-10-27 17:25        --------        d-----w-        c:\users\Ralf\AppData\Local\Adobe_Systems_Incorporate

2013-10-27 16:58 . 2013-10-27 16:59        --------        d-----w-        c:\users\Ralf\AppData\Local\calibre-cache

2013-10-27 16:57 . 2013-10-27 17:01        --------        d-----w-        c:\users\Ralf\AppData\Roaming\calibre

2013-10-27 16:57 . 2013-10-27 16:57        --------        d-----w-        c:\program files\Calibre2

2013-10-27 16:15 . 2013-10-27 16:15        --------        d-----w-        c:\program files\Common Files\Sony Shared

2013-10-27 16:01 . 2013-10-27 16:01        --------        d-----w-        c:\program files\Plus-HD-1.6

2013-10-27 14:00 . 2013-11-03 12:21        105176        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys

2013-10-27 13:59 . 2013-11-03 12:21        75992        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys

2013-10-27 11:12 . 2013-10-27 11:12        --------        d-----w-        c:\users\Ralf\Library

2013-10-27 11:12 . 2013-10-27 11:12        --------        d-----w-        c:\users\Ralf\AppData\Roaming\Apple Computer

2013-10-27 11:12 . 2013-10-27 11:12        --------        d-----w-        c:\users\Ralf\AppData\Local\Apple Computer

2013-10-27 11:12 . 2013-10-27 11:12        --------        d-----w-        c:\programdata\kinoma

2013-10-27 11:12 . 2013-10-27 11:12        --------        d-----w-        c:\program files\Sony

2013-10-27 11:11 . 2013-10-27 16:15        --------        d-----w-        c:\users\Ralf\AppData\Local\Sony Corporation

2013-10-27 11:08 . 2013-10-27 11:08        --------        d-----w-        c:\users\Ralf\AppData\Local\kinoma

2013-10-24 19:12 . 2013-10-24 19:13        --------        d-----w-        c:\windows\system32\Adobe

2013-10-14 17:52 . 2013-10-14 17:52        163504        ----a-w-        c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin

2013-10-10 09:23 . 2013-07-04 11:50        530432        ----a-w-        c:\windows\system32\comctl32.dll

2013-10-10 09:22 . 2013-07-04 11:57        205824        ----a-w-        c:\windows\system32\WebClnt.dll

2013-10-10 09:22 . 2013-07-04 11:51        81920        ----a-w-        c:\windows\system32\davclnt.dll

2013-10-10 09:22 . 2013-07-04 09:48        115712        ----a-w-        c:\windows\system32\drivers\mrxdav.sys

2013-10-10 09:22 . 2013-07-12 10:07        86016        ----a-w-        c:\windows\system32\drivers\usbcir.sys

2013-10-10 09:22 . 2013-06-25 22:56        527064        ----a-w-        c:\windows\system32\drivers\Wdf01000.sys

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-10-31 17:20 . 2010-05-03 14:24        0        ----a-w-        c:\users\Ralf\AppData\Local\WavXMapDrive.bat

2013-10-15 18:48 . 2012-03-29 17:21        692616        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2013-10-15 18:48 . 2011-05-19 11:45        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2013-09-05 17:22 . 2013-05-10 05:46        66144        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-09-05 17:22 . 2012-12-22 15:04        88840        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2013-09-05 17:22 . 2012-12-22 15:04        136672        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2013-09-03 12:35 . 2010-05-03 15:14        238872        ------w-        c:\windows\system32\MpSigStub.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]

@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"

[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]

2009-11-24 20:48        62832        ----a-w-        c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]

@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"

[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]

2009-11-24 20:48        62832        ----a-w-        c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-06-19 249856]

"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-08-01 458844]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-07 186904]

"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2009-11-02 657920]

"DellConnectionManager"="c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" [2009-12-22 1845248]

"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2010-01-05 147328]

"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2010-01-06 34232]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520]

"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2011-08-05 159456]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2013-09-03 41336]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2013-09-03 840568]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-09-05 347192]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2013-01-27 98304]

"Reader Library Launcher"="d:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Del243731640"="del" [X]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-8-11 795936]

Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2009-12-10 1327392]

TdmNotify.lnk - c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe [2009-11-24 132456]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages        REG_MULTI_SZ           msv1_0 wvauth

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\se32.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-04-23 29472]

R3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\NvtSp50.sys [x]

R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2010-04-09 16472]

R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2010-04-09 11104]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]

R3 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe86.sys [2009-07-02 47104]

R3 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe86.sys [2009-07-01 49152]

R3 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe86.sys [2009-07-05 38400]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-28 1343400]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-03-30 37352]

S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys [2012-08-01 35560]

S1 se32;EnTech softEngine;c:\windows\system32\Drivers\se32.sys [2007-05-03 12112]

S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-02-24 185472]

S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-09-05 84024]

S2 arXfrSvc;TV-Archiv-Übertragungsdienst für Windows Media Center;c:\program files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [2011-01-10 239472]

S2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [2009-05-15 1803512]

S2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]

S2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [2009-11-20 278304]

S2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [2009-12-10 386848]

S2 esClient;Windows Media Center-Clientdienst;c:\program files\Windows Home Server\esClient.exe [2011-01-10 97136]

S2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [2009-12-22 77312]

S2 softOSD;softOSD;c:\program files\softOSD\softOSD.exe [2010-12-18 291384]

S2 WHSConnector;Windows Home Server-Connectordienst;c:\program files\Windows Home Server\WHSConnector.exe [2011-01-10 376688]

S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-03-15 127488]

S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]

S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*Deregistered* - kfrcapow

.

Inhalt des "geplante Tasks" Ordners

.

2013-11-03 c:\windows\Tasks\Plus-HD-1.6-firefoxinstaller.job

- c:\program files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe [2013-10-27 16:01]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = about:Tabs

IE: An OneNote s&enden - c:\progra~1\MIF5BA~1\Office14\ONBttnIE.dll/105

IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Anexar em PDF existente - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Bild in &Microsoft PhotoDraw öffnen - d:\progra~1\MICROS~1\Office\1031\phdintl.dll/phdContext.htm

IE: Converter destino de link em Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Converter destino de link em PDF existente - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Converter links selecionados em PDF existente - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MIF5BA~1\Office14\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000

IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

TCP: DhcpNameServer = 192.168.1.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Windows Home Server.lnk - c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe

AddRemove-LyricsSay-16 - c:\program files\LyricsSay-16\Uninstall.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'lsass.exe'(556)

c:\windows\system32\wvauth.DLL

.

Zeit der Fertigstellung: 2013-11-03  18:24:40

ComboFix-quarantined-files.txt  2013-11-03 17:24

.

Vor Suchlauf: 12 Verzeichnis(se), 59.318.444.032 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 59.670.970.368 Bytes frei

.

- - End Of File - - 32083DAA091BFB399AA83659AC8E1F3F

CDB4DE4BBD714F152979DA2DCBEF57EB

Nach combofix scheinen zumindest die verseuchten Pop Up's jetzt der Vergangenheit anzugehören.:dankeschoen:

Ralf

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

OK done

mbam log:

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.11.04.06
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 10.0.9200.16721

Ralf :: BAGALUTH01 [Administrator]
 

04.11.2013 20:25:13

mbam-log-2013-11-04 (20-25-13).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 218875

Laufzeit: 5 Minute(n), 58 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 7

HKCR\CrossriderApp0044158.BHO (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CrossriderApp0044158.BHO.1 (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CrossriderApp0044158.Sandbox (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CrossriderApp0044158.Sandbox.1 (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Plus-HD-1.6 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\Software\LyricsSay-16 (PUP.Optional.LyricsSay.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-1.6 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 1

C:\Program Files\Plus-HD-1.6 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 5

C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Plus-HD-1.6\32002.xpi (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Plus-HD-1.6\Uninstall.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\Plus-HD-1.6\utils.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Adwcleaner log:

Code:

# AdwCleaner v3.011 - Bericht erstellt am 04/11/2013 um 20:54:38

# Updated 03/11/2013 von Xplode

# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)

# Benutzername : Ralf - BAGALUTH01

# Gestartet von : C:\Users\Ralf\Desktop\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\Users\Ralf\AppData\Roaming\UpdaterEX
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{057AF304-F92A-4FE9-BAB2-9634F209C37E}

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{28311E67-8079-4D7B-BA62-DDAC2DF4CC4E}

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5DCF8606-F47C-49C2-92DC-B371C919BEAA}

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C077D56C-D3A0-4C9E-AC36-EFEFAD7E9FF0}

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E6890604-6054-412B-AA14-866963D254B2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220422412258}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455415558}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466416658}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440444414458}

Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions

Schlüssel Gelöscht : HKCU\Software\InstalledThirdPartyPrograms

Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar

Schlüssel Gelöscht : HKLM\Software\InstalledThirdPartyPrograms
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16720
 
 

*************************
 

AdwCleaner[R0].txt - [85943 octets] - [04/11/2013 20:51:05]

AdwCleaner[S0].txt - [2245 octets] - [04/11/2013 20:54:38]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2305 octets] ##########

JRT log:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.7 (10.15.2013:3)

OS: Windows 7 Professional x86

Ran by Ralf on 04.11.2013 at 21:02:11,35

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 04.11.2013 at 21:04:24,40

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und zu guter Letzt das neue FRST:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013

Ran by Ralf (administrator) on BAGALUTH01 on 04-11-2013 21:14:42

Running from C:\Users\Ralf\Desktop

Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\AtService.exe

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe

(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\BBSvc.EXE

(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe

(Dell Inc.) c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe

(Microsoft Corporation) C:\Program Files\Windows Home Server\esClient.exe

(Intel(R) Corporation) c:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

(Intel(R) Corporation) c:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(EnTech Taiwan) C:\Program Files\softOSD\softOSD.exe

(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe

(Microsoft Corporation) C:\Program Files\Windows Home Server\WHSConnector.exe

(Microsoft Corporation) C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe

(EnTech Taiwan) C:\Windows\system32\softLCP.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe

(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe

(Broadcom Corporation) C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe

(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe

(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Apple Computer, Inc.) C:\Program Files\QuickTime\qttask.exe

(Sony Corporation) D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [249856 2009-06-19] (Alps Electric Co., Ltd.)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [458844 2009-08-01] (IDT, Inc.)

HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-08-07] (Intel Corporation)

HKLM\...\Run: [DellControlPoint] - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe [657920 2009-11-02] (Dell Inc.)

HKLM\...\Run: [DellConnectionManager] - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe [1845248 2009-12-22] (Smith Micro Software, Inc.)

HKLM\...\Run: [WavXMgr] - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe [147328 2010-01-05] (Wave Systems Corp.)

HKLM\...\Run: [USCService] - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe [34232 2010-01-06] (Broadcom Corporation)

HKLM\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-25] (CyberLink Corp.)

HKLM\...\Run: [Zune Launcher] - C:\Program Files\Zune\ZuneLauncher.exe [159456 2011-08-05] (Microsoft Corporation)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)

HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\qttask.exe [98304 2013-01-27] (Apple Computer, Inc.)

HKLM\...\Run: [Reader Library Launcher] - D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)

Lsa: [Authentication Packages] msv1_0 wvauth
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLRDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKCU - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = 

BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)

BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM - Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)

Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

========================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)

R2 arXfrSvc; C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [239472 2011-01-10] (Microsoft Corporation)

R2 ATService; C:\Program Files\Fingerprint Sensor\AtService.exe [1803512 2009-05-15] (AuthenTec, Inc.)

R2 buttonsvc32; C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe [278304 2009-11-20] (Dell Inc.)

R2 dcpsysmgrsvc; c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [386848 2009-12-10] (Dell Inc.)

R2 esClient; C:\Program Files\Windows Home Server\esClient.exe [97136 2011-01-10] (Microsoft Corporation)

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 SecureStorageService; C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [1032192 2009-11-18] (Wave Systems Corp.)

R2 SMManager; C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [77312 2009-12-22] (Smith Micro Software, Inc.)

R2 softOSD; C:\Program Files\softOSD\softOSD.exe [291384 2010-12-18] (EnTech Taiwan)

R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe [221266 2009-08-01] (IDT, Inc.)

S2 tcsd_win32.exe; C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1273856 2008-11-12] ()

R2 TdmService; C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [1148264 2009-11-24] (Wave Systems Corp.)

R2 WHSConnector; C:\Program Files\Windows Home Server\WHSConnector.exe [376688 2011-01-10] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-30] (Avira Operations GmbH & Co. KG)

S3 Blfp; C:\Windows\System32\DRIVERS\basp.sys [84992 2009-05-11] (Broadcom Corporation)

R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [35560 2012-08-01] (AnchorFree Inc.)

R2 hwpsgt; C:\Windows\System32\DRIVERS\hwpsgt.sys [137344 2010-07-15] ()

R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)

R2 lemsgt; C:\Windows\System32\DRIVERS\lemsgt.sys [9472 2010-07-15] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R0 PBADRV; C:\Windows\System32\DRIVERS\PBADRV.sys [26608 2008-06-04] (Dell Inc)

S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2010-04-09] ()

S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2010-04-09] ()

S3 risdpcie; C:\Windows\system32\DRIVERS\risdpe86.sys [49152 2009-07-01] (REDC)

S3 rixdpcie; C:\Windows\system32\DRIVERS\rixdpe86.sys [38400 2009-07-05] (REDC)

R1 se32; C:\Windows\System32\Drivers\se32.sys [12112 2007-05-03] (EnTech Taiwan)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)

S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-08-01] (AnchorFree Inc)

R2 WavxDMgr; C:\Windows\System32\DRIVERS\WavxDMgr.sys [211328 2010-01-05] (Wave Systems Corp.)

S3 catchme; \??\C:\Users\Ralf\AppData\Local\Temp\catchme.sys [x]

S3 NvtSp50; System32\Drivers\NvtSp50.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-11-04 21:14 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Ralf\Desktop\FRST.exe

2013-11-04 21:07 - 2013-11-04 21:07 - 00001024 _____ C:\.rnd

2013-11-04 21:04 - 2013-11-04 21:04 - 00000624 _____ C:\Users\Ralf\Desktop\JRT.txt

2013-11-04 21:00 - 2013-11-04 21:00 - 01033335 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe

2013-11-04 20:57 - 2013-11-04 20:57 - 00002385 _____ C:\Users\Ralf\Desktop\AdwCleaner[S0].txt

2013-11-04 20:50 - 2013-11-04 20:54 - 00000000 ____D C:\AdwCleaner

2013-11-04 20:49 - 2013-11-04 20:49 - 01073258 _____ C:\Users\Ralf\Desktop\adwcleaner.exe

2013-11-04 20:20 - 2013-11-04 20:20 - 00001073 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-04 20:20 - 2013-11-04 20:20 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-11-04 20:20 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-11-04 20:19 - 2013-11-04 20:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Public\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-04 07:39 - 2013-11-04 07:39 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Mozilla

2013-11-03 18:24 - 2013-11-03 18:24 - 00014738 _____ C:\ComboFix.txt

2013-11-03 18:07 - 2013-11-03 18:25 - 00000000 ____D C:\Qoobox

2013-11-03 18:07 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2013-11-03 18:07 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2013-11-03 18:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-11-03 18:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-11-03 18:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-11-03 18:07 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2013-11-03 18:07 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2013-11-03 18:07 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2013-11-03 17:58 - 2013-11-03 17:58 - 05143677 ____R (Swearware) C:\Users\Ralf\Desktop\ComboFix.exe

2013-11-03 14:33 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe

2013-11-03 14:31 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Public\Downloads\gmer_2.1.19163.exe

2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST

2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe

2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log

2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe

2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate

2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk

2013-10-27 17:58 - 2013-10-27 17:59 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache

2013-10-27 17:57 - 2013-10-27 18:01 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre

2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk

2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2

2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk

2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared

2013-10-27 14:59 - 2013-11-04 19:59 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe

2013-10-27 12:57 - 2013-11-03 13:58 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony

2013-10-27 12:11 - 2013-10-27 17:15 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation

2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma

2013-10-24 20:12 - 2013-10-24 20:13 - 00000000 ____D C:\Windows\system32\Adobe

2013-10-10 21:30 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-10-10 21:30 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-10-10 21:30 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-10-10 21:30 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-10-10 21:30 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-10-10 21:30 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-10-10 10:23 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2013-10-10 10:23 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-10-10 10:23 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll

2013-10-10 10:23 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2013-10-10 10:23 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-10-10 10:23 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-10-10 10:23 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll

2013-10-10 10:23 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2013-10-10 10:23 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-10-10 10:23 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll

2013-10-10 10:23 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2013-10-10 10:23 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2013-10-10 10:23 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll

2013-10-10 10:23 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys

2013-10-10 10:23 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys

2013-10-10 10:23 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2013-10-10 10:23 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2013-10-10 10:23 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2013-10-10 10:23 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2013-10-10 10:23 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2013-10-10 10:22 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys

2013-10-10 10:22 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll

2013-10-10 10:22 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll

2013-10-10 10:22 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2013-10-10 10:22 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
 

==================== One Month Modified Files and Folders =======
 

2013-11-04 21:14 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-11-04 21:14 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-11-04 21:11 - 2010-05-03 15:24 - 00000000 _____ C:\Users\Ralf\AppData\Local\WavXMapDrive.bat

2013-11-04 21:11 - 2010-04-23 16:09 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI

2013-11-04 21:07 - 2013-11-04 21:07 - 00001024 _____ C:\.rnd

2013-11-04 21:07 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-11-04 21:07 - 2009-07-14 05:39 - 00133029 _____ C:\Windows\setupact.log

2013-11-04 21:05 - 2009-07-14 05:55 - 01623616 _____ C:\Windows\WindowsUpdate.log

2013-11-04 21:04 - 2013-11-04 21:04 - 00000624 _____ C:\Users\Ralf\Desktop\JRT.txt

2013-11-04 21:00 - 2013-11-04 21:00 - 01033335 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe

2013-11-04 20:57 - 2013-11-04 20:57 - 00002385 _____ C:\Users\Ralf\Desktop\AdwCleaner[S0].txt

2013-11-04 20:56 - 2009-07-14 05:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-11-04 20:54 - 2013-11-04 20:50 - 00000000 ____D C:\AdwCleaner

2013-11-04 20:49 - 2013-11-04 20:49 - 01073258 _____ C:\Users\Ralf\Desktop\adwcleaner.exe

2013-11-04 20:37 - 2010-04-23 08:57 - 00112768 _____ C:\Windows\PFRO.log

2013-11-04 20:20 - 2013-11-04 20:20 - 00001073 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-04 20:20 - 2013-11-04 20:20 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-11-04 20:19 - 2013-11-04 20:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Public\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-04 20:17 - 2013-07-08 06:02 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-04 20:17 - 2013-03-22 19:30 - 00000000 ____D C:\Users\Ralf\Desktop\mbar

2013-11-04 19:59 - 2013-10-27 14:59 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2013-11-04 07:39 - 2013-11-04 07:39 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Mozilla

2013-11-03 18:25 - 2013-11-03 18:07 - 00000000 ____D C:\Qoobox

2013-11-03 18:24 - 2013-11-03 18:24 - 00014738 _____ C:\ComboFix.txt

2013-11-03 18:16 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini

2013-11-03 18:06 - 2013-04-02 06:50 - 00000000 ____D C:\Windows\erdnt

2013-11-03 17:58 - 2013-11-03 17:58 - 05143677 ____R (Swearware) C:\Users\Ralf\Desktop\ComboFix.exe

2013-11-03 14:31 - 2013-11-03 14:33 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe

2013-11-03 14:31 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Public\Downloads\gmer_2.1.19163.exe

2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST

2013-11-03 14:21 - 2013-11-04 21:14 - 01089445 _____ (Farbar) C:\Users\Ralf\Desktop\FRST.exe

2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe

2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log

2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe

2013-11-03 13:58 - 2013-10-27 12:57 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Adobe

2013-10-31 18:20 - 2010-05-03 15:25 - 00115672 _____ C:\Users\Ralf\AppData\Local\GDIPFONTCACHEV1.DAT

2013-10-31 18:18 - 2009-07-14 05:33 - 00426736 _____ C:\Windows\system32\FNTCACHE.DAT

2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate

2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk

2013-10-27 18:01 - 2013-10-27 17:57 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre

2013-10-27 17:59 - 2013-10-27 17:58 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache

2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk

2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2

2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk

2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared

2013-10-27 17:15 - 2013-10-27 12:11 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation

2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe

2013-10-27 12:57 - 2010-05-06 11:33 - 00000000 ____D C:\Users\Ralf\AppData\Local\Mozilla

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony

2013-10-27 12:12 - 2010-05-03 15:24 - 00000000 ____D C:\Users\Ralf

2013-10-27 12:12 - 2010-04-23 16:05 - 00000000 ____D C:\Program Files\DIFX

2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma

2013-10-24 20:14 - 2010-04-23 16:02 - 00000000 ____D C:\Windows\system32\Macromed

2013-10-24 20:13 - 2013-10-24 20:12 - 00000000 ____D C:\Windows\system32\Adobe

2013-10-21 17:28 - 2013-09-01 15:10 - 00000000 ____D C:\Users\Ralf\AppData\Local\Thunderbird

2013-10-17 18:12 - 2011-05-19 13:03 - 00028672 _____ C:\Users\Ralf\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-10-15 19:48 - 2012-03-29 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-10-15 19:48 - 2011-05-19 12:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-10-14 18:37 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache

2013-10-14 18:21 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-10-14 17:46 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE

2013-10-14 17:44 - 2010-04-23 16:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-10-10 21:35 - 2010-05-06 14:54 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-10-10 21:33 - 2013-07-31 07:45 - 00000000 ____D C:\Windows\system32\MRT

2013-10-10 21:31 - 2010-05-06 15:26 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
 

Some content of TEMP:

====================

C:\Users\Ralf\AppData\Local\temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-31 18:37
 

==================== End Of Log ============================

--- --- ---

--- --- ---

schaut ganz gut aus :daumenhoc

greetings

Ralf

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

:daumenhoc
OK keine Probleme

ESET log:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=aefe49275ea6404ab2f07887b2620cb6

# engine=15784

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-11-06 08:33:37

# local_time=2013-11-06 09:33:37 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 97 12719 249193307 5497 0

# compatibility_mode=5893 16776573 100 94 53894 135401208 0 0

# scanned=163173

# found=0

# cleaned=0

# scan_time=5716

sieht gut aus :daumenhoc

Sec_checkup log:

Code:

Results of screen317's Security Check version 0.99.74  

 Windows 7 Service Pack 1 x86   

 Internet Explorer 10  
 ``````````````Antivirus/Firewall Check:`````````````` 

Avira Desktop   

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 Adobe Flash Player         11.9.900.117  

 Mozilla Firefox (25.0) 

 Mozilla Thunderbird (17.0.8) 
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

 Malwarebytes' Anti-Malware mbamscheduler.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

sieht auch gut aus :daumenhoc

und zu guter Letzt das frische

FRST:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013

Ran by Ralf (administrator) on BAGALUTH01 on 06-11-2013 21:46:11

Running from C:\Users\Ralf\Desktop

Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\AtService.exe

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe

(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe

(Dell Inc.) c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe

(Microsoft Corporation) C:\Program Files\Windows Home Server\esClient.exe

(Intel(R) Corporation) c:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

(Intel(R) Corporation) c:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(EnTech Taiwan) C:\Program Files\softOSD\softOSD.exe

(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe

(Microsoft Corporation) C:\Program Files\Windows Home Server\WHSConnector.exe

(Microsoft Corporation) C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe

(Smith Micro Software, Inc.) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe

(Broadcom Corporation) C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe

(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe

(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Apple Computer, Inc.) C:\Program Files\QuickTime\qttask.exe

(Sony Corporation) D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(EnTech Taiwan) C:\Windows\system32\softLCP.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwsc.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [249856 2009-06-19] (Alps Electric Co., Ltd.)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [458844 2009-08-01] (IDT, Inc.)

HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-08-07] (Intel Corporation)

HKLM\...\Run: [DellControlPoint] - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe [657920 2009-11-02] (Dell Inc.)

HKLM\...\Run: [DellConnectionManager] - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe [1845248 2009-12-22] (Smith Micro Software, Inc.)

HKLM\...\Run: [WavXMgr] - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe [147328 2010-01-05] (Wave Systems Corp.)

HKLM\...\Run: [USCService] - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe [34232 2010-01-06] (Broadcom Corporation)

HKLM\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-25] (CyberLink Corp.)

HKLM\...\Run: [Zune Launcher] - C:\Program Files\Zune\ZuneLauncher.exe [159456 2011-08-05] (Microsoft Corporation)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)

HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\qttask.exe [98304 2013-01-27] (Apple Computer, Inc.)

HKLM\...\Run: [Reader Library Launcher] - D:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)

Lsa: [Authentication Packages] msv1_0 wvauth
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLRDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKCU - {9B7E30B1-98A4-41EC-8D65-3EE9EC23072E} URL = 

BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)

BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM - Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - C:\Program Files\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)

Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Ralf\AppData\Roaming\Mozilla\Firefox\Profiles\ojr0abon.default

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()

FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)

FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @sony.com/eBookLibrary - D:\Program Files\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)

FF Plugin: Adobe Acrobat - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn

FF Extension: Adobe Acrobat - Create PDF - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
 

========================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)

R2 arXfrSvc; C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [239472 2011-01-10] (Microsoft Corporation)

R2 ATService; C:\Program Files\Fingerprint Sensor\AtService.exe [1803512 2009-05-15] (AuthenTec, Inc.)

R2 buttonsvc32; C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe [278304 2009-11-20] (Dell Inc.)

R2 dcpsysmgrsvc; c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [386848 2009-12-10] (Dell Inc.)

R2 esClient; C:\Program Files\Windows Home Server\esClient.exe [97136 2011-01-10] (Microsoft Corporation)

R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 SecureStorageService; C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [1032192 2009-11-18] (Wave Systems Corp.)

R2 SMManager; C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [77312 2009-12-22] (Smith Micro Software, Inc.)

R2 softOSD; C:\Program Files\softOSD\softOSD.exe [291384 2010-12-18] (EnTech Taiwan)

R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\STacSV.exe [221266 2009-08-01] (IDT, Inc.)

S2 tcsd_win32.exe; C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1273856 2008-11-12] ()

R2 TdmService; C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [1148264 2009-11-24] (Wave Systems Corp.)

R2 WHSConnector; C:\Program Files\Windows Home Server\WHSConnector.exe [376688 2011-01-10] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-30] (Avira Operations GmbH & Co. KG)

S3 Blfp; C:\Windows\System32\DRIVERS\basp.sys [84992 2009-05-11] (Broadcom Corporation)

R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [35560 2012-08-01] (AnchorFree Inc.)

R2 hwpsgt; C:\Windows\System32\DRIVERS\hwpsgt.sys [137344 2010-07-15] ()

R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)

R2 lemsgt; C:\Windows\System32\DRIVERS\lemsgt.sys [9472 2010-07-15] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R0 PBADRV; C:\Windows\System32\DRIVERS\PBADRV.sys [26608 2008-06-04] (Dell Inc)

S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2010-04-09] ()

S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2010-04-09] ()

S3 risdpcie; C:\Windows\system32\DRIVERS\risdpe86.sys [49152 2009-07-01] (REDC)

S3 rixdpcie; C:\Windows\system32\DRIVERS\rixdpe86.sys [38400 2009-07-05] (REDC)

R1 se32; C:\Windows\System32\Drivers\se32.sys [12112 2007-05-03] (EnTech Taiwan)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)

S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-08-01] (AnchorFree Inc)

R2 WavxDMgr; C:\Windows\System32\DRIVERS\WavxDMgr.sys [211328 2010-01-05] (Wave Systems Corp.)

S3 catchme; \??\C:\Users\Ralf\AppData\Local\Temp\catchme.sys [x]

S3 NvtSp50; System32\Drivers\NvtSp50.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-11-06 21:45 - 2013-11-06 21:45 - 00000924 _____ C:\Users\Ralf\Desktop\checkup.txt

2013-11-06 21:42 - 2013-11-06 21:42 - 00891167 _____ C:\Users\Ralf\Desktop\SecurityCheck.exe

2013-11-06 19:01 - 2013-11-06 19:01 - 102844835 _____ C:\Windows\system32\Ʒ᱄o

2013-11-06 19:00 - 2013-11-06 19:00 - 00001024 _____ C:\.rnd

2013-11-04 22:11 - 2013-11-04 22:11 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-11-04 22:11 - 2013-11-04 22:11 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-11-04 21:14 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Ralf\Desktop\FRST.exe

2013-11-04 21:00 - 2013-11-04 21:00 - 01033335 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe

2013-11-04 20:50 - 2013-11-04 20:54 - 00000000 ____D C:\AdwCleaner

2013-11-04 20:49 - 2013-11-04 20:49 - 01073258 _____ C:\Users\Ralf\Desktop\adwcleaner.exe

2013-11-04 20:20 - 2013-11-04 20:20 - 00001073 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-04 20:20 - 2013-11-04 20:20 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-11-04 20:20 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-11-04 20:19 - 2013-11-04 20:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Public\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-04 07:39 - 2013-11-04 22:11 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Mozilla

2013-11-03 18:24 - 2013-11-03 18:24 - 00014738 _____ C:\ComboFix.txt

2013-11-03 18:07 - 2013-11-03 18:25 - 00000000 ____D C:\Qoobox

2013-11-03 18:07 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2013-11-03 18:07 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2013-11-03 18:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-11-03 18:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-11-03 18:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-11-03 18:07 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2013-11-03 18:07 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2013-11-03 18:07 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2013-11-03 17:58 - 2013-11-03 17:58 - 05143677 ____R (Swearware) C:\Users\Ralf\Desktop\ComboFix.exe

2013-11-03 14:33 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe

2013-11-03 14:31 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Public\Downloads\gmer_2.1.19163.exe

2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST

2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe

2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log

2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe

2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate

2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk

2013-10-27 17:58 - 2013-10-27 17:59 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache

2013-10-27 17:57 - 2013-10-27 18:01 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre

2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk

2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2

2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk

2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared

2013-10-27 14:59 - 2013-11-04 19:59 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe

2013-10-27 12:57 - 2013-11-04 22:11 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony

2013-10-27 12:11 - 2013-10-27 17:15 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation

2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma

2013-10-24 20:12 - 2013-10-24 20:13 - 00000000 ____D C:\Windows\system32\Adobe

2013-10-10 21:30 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-10-10 21:30 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-10-10 21:30 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-10-10 21:30 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-10-10 21:30 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-10-10 21:30 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-10-10 21:30 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-10-10 10:23 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2013-10-10 10:23 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-10-10 10:23 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll

2013-10-10 10:23 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2013-10-10 10:23 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-10-10 10:23 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-10-10 10:23 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll

2013-10-10 10:23 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2013-10-10 10:23 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-10-10 10:23 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll

2013-10-10 10:23 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2013-10-10 10:23 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2013-10-10 10:23 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll

2013-10-10 10:23 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys

2013-10-10 10:23 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys

2013-10-10 10:23 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2013-10-10 10:23 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2013-10-10 10:23 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2013-10-10 10:23 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2013-10-10 10:23 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2013-10-10 10:22 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys

2013-10-10 10:22 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll

2013-10-10 10:22 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll

2013-10-10 10:22 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2013-10-10 10:22 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
 

==================== One Month Modified Files and Folders =======
 

2013-11-06 21:45 - 2013-11-06 21:45 - 00000924 _____ C:\Users\Ralf\Desktop\checkup.txt

2013-11-06 21:42 - 2013-11-06 21:42 - 00891167 _____ C:\Users\Ralf\Desktop\SecurityCheck.exe

2013-11-06 20:19 - 2009-07-14 05:55 - 01722492 _____ C:\Windows\WindowsUpdate.log

2013-11-06 19:08 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-11-06 19:08 - 2009-07-14 05:34 - 00014256 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-11-06 19:05 - 2010-04-23 16:09 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI

2013-11-06 19:01 - 2013-11-06 19:01 - 102844835 _____ C:\Windows\system32\Ʒ᱄o

2013-11-06 19:01 - 2010-05-03 15:24 - 00000000 _____ C:\Users\Ralf\AppData\Local\WavXMapDrive.bat

2013-11-06 19:00 - 2013-11-06 19:00 - 00001024 _____ C:\.rnd

2013-11-06 19:00 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-11-06 19:00 - 2009-07-14 05:39 - 00133197 _____ C:\Windows\setupact.log

2013-11-04 22:11 - 2013-11-04 22:11 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-11-04 22:11 - 2013-11-04 22:11 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-11-04 22:11 - 2013-11-04 07:39 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Mozilla

2013-11-04 22:11 - 2013-10-27 12:57 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-11-04 21:00 - 2013-11-04 21:00 - 01033335 _____ (Thisisu) C:\Users\Ralf\Desktop\JRT.exe

2013-11-04 20:56 - 2009-07-14 05:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-11-04 20:54 - 2013-11-04 20:50 - 00000000 ____D C:\AdwCleaner

2013-11-04 20:49 - 2013-11-04 20:49 - 01073258 _____ C:\Users\Ralf\Desktop\adwcleaner.exe

2013-11-04 20:37 - 2010-04-23 08:57 - 00112768 _____ C:\Windows\PFRO.log

2013-11-04 20:20 - 2013-11-04 20:20 - 00001073 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-04 20:20 - 2013-11-04 20:20 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-11-04 20:19 - 2013-11-04 20:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Public\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-04 20:17 - 2013-07-08 06:02 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-04 20:17 - 2013-03-22 19:30 - 00000000 ____D C:\Users\Ralf\Desktop\mbar

2013-11-04 19:59 - 2013-10-27 14:59 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2013-11-03 18:25 - 2013-11-03 18:07 - 00000000 ____D C:\Qoobox

2013-11-03 18:24 - 2013-11-03 18:24 - 00014738 _____ C:\ComboFix.txt

2013-11-03 18:16 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini

2013-11-03 18:06 - 2013-04-02 06:50 - 00000000 ____D C:\Windows\erdnt

2013-11-03 17:58 - 2013-11-03 17:58 - 05143677 ____R (Swearware) C:\Users\Ralf\Desktop\ComboFix.exe

2013-11-03 14:31 - 2013-11-03 14:33 - 00377856 _____ C:\Users\Ralf\Desktop\gmer_2.1.19163.exe

2013-11-03 14:31 - 2013-11-03 14:31 - 00377856 _____ C:\Users\Public\Downloads\gmer_2.1.19163.exe

2013-11-03 14:24 - 2013-11-03 14:24 - 00000000 ____D C:\FRST

2013-11-03 14:21 - 2013-11-04 21:14 - 01089445 _____ (Farbar) C:\Users\Ralf\Desktop\FRST.exe

2013-11-03 14:21 - 2013-11-03 14:21 - 01089445 _____ (Farbar) C:\Users\Public\Downloads\FRST.exe

2013-11-03 14:18 - 2013-11-03 14:18 - 00000470 _____ C:\Users\Public\Downloads\defogger_disable.log

2013-11-03 14:15 - 2013-11-03 14:15 - 00050477 _____ C:\Users\Public\Downloads\Defogger.exe

2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Common Files\Adobe

2013-11-03 13:56 - 2010-10-08 17:15 - 00000000 ____D C:\Program Files\Adobe

2013-10-31 18:20 - 2010-05-03 15:25 - 00115672 _____ C:\Users\Ralf\AppData\Local\GDIPFONTCACHEV1.DAT

2013-10-31 18:18 - 2009-07-14 05:33 - 00426736 _____ C:\Windows\system32\FNTCACHE.DAT

2013-10-27 18:25 - 2013-10-27 18:25 - 00000000 ____D C:\Users\Ralf\AppData\Local\Adobe_Systems_Incorporate

2013-10-27 18:24 - 2013-10-27 18:24 - 00002168 _____ C:\Users\Public\Desktop\Adobe Digital Editions 2.0.lnk

2013-10-27 18:01 - 2013-10-27 17:57 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\calibre

2013-10-27 17:59 - 2013-10-27 17:58 - 00000000 ____D C:\Users\Ralf\AppData\Local\calibre-cache

2013-10-27 17:57 - 2013-10-27 17:57 - 00000932 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk

2013-10-27 17:57 - 2013-10-27 17:57 - 00000000 ____D C:\Program Files\Calibre2

2013-10-27 17:15 - 2013-10-27 17:15 - 00001975 _____ C:\Users\Public\Desktop\Reader Library.lnk

2013-10-27 17:15 - 2013-10-27 17:15 - 00000000 ____D C:\Program Files\Common Files\Sony Shared

2013-10-27 17:15 - 2013-10-27 12:11 - 00000000 ____D C:\Users\Ralf\AppData\Local\Sony Corporation

2013-10-27 14:58 - 2013-10-27 14:58 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Ralf\Desktop\mbar-1.07.0.1007.exe

2013-10-27 12:57 - 2010-05-06 11:33 - 00000000 ____D C:\Users\Ralf\AppData\Local\Mozilla

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\Library

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Roaming\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Users\Ralf\AppData\Local\Apple Computer

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\ProgramData\kinoma

2013-10-27 12:12 - 2013-10-27 12:12 - 00000000 ____D C:\Program Files\Sony

2013-10-27 12:12 - 2010-05-03 15:24 - 00000000 ____D C:\Users\Ralf

2013-10-27 12:12 - 2010-04-23 16:05 - 00000000 ____D C:\Program Files\DIFX

2013-10-27 12:08 - 2013-10-27 12:08 - 00000000 ____D C:\Users\Ralf\AppData\Local\kinoma

2013-10-24 20:14 - 2010-04-23 16:02 - 00000000 ____D C:\Windows\system32\Macromed

2013-10-24 20:13 - 2013-10-24 20:12 - 00000000 ____D C:\Windows\system32\Adobe

2013-10-21 17:28 - 2013-09-01 15:10 - 00000000 ____D C:\Users\Ralf\AppData\Local\Thunderbird

2013-10-17 18:12 - 2011-05-19 13:03 - 00028672 _____ C:\Users\Ralf\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-10-15 19:48 - 2012-03-29 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2013-10-15 19:48 - 2011-05-19 12:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2013-10-14 18:37 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache

2013-10-14 18:21 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET

2013-10-14 17:46 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE

2013-10-14 17:44 - 2010-04-23 16:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-10-10 21:35 - 2010-05-06 14:54 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-10-10 21:33 - 2013-07-31 07:45 - 00000000 ____D C:\Windows\system32\MRT

2013-10-10 21:31 - 2010-05-06 15:26 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
 

Some content of TEMP:

====================

C:\Users\Ralf\AppData\Local\temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-31 18:37
 

==================== End Of Log ============================

--- --- ---

--- --- ---

sieht auch sehr gut aus :taenzer:

1.000 Dank scheint so als hätten wir alles erlegt was sich da ungebeten eingenistet hat.

greetings

Ralf

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Kurze Rückmeldung:

Alles OK :applaus:

Überweisungsträger für Kleine Spende liegt im Abtrag und wird morgen eingeworfen.

:daumenhoc

Nochmals Danke Ihr seit klasse. :applaus:

greetings

Hein Bagaluth
(Alias Ralf Tielmann)