Trojaner-Board - Ungewünschte Umleitung zu bycontext.com nach CHIP.DE-Download

Hola Cosinus,
ok, habe ich gemacht.
Jetzt noch ein Frst log Scan mit angeklickten
Registry / Services / Drivers / Processes / Internet, viele Grüße, und herzlichen Dank bis hierher, Romanos:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-09-2014 01

Ran by Rainer (administrator) on RAINER-PC on 25-09-2014 23:05:39

Running from C:\Users\Rainer\Downloads

Loaded Profile: Rainer (Available profiles: Rainer & Conny & Rainer-User & Marie-Sophie & Felix)

Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(TOSHIBA) C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe

(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe

(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe

(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\AMCore\mcshield.exe

(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\Utilities\KeNotify.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\Platform\McUICnt.exe

(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe

(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7289376 2009-03-30] (Realtek Semiconductor)

HKLM\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [421888 2007-04-16] (TOSHIBA Electronics, Inc.)

HKLM\...\Run: [SVPWUTIL] => C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe [438272 2008-11-21] (TOSHIBA)

HKLM\...\Run: [KeNotify] => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)

HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe [1011712 2009-04-23] (TOSHIBA Corporation)

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2009-04-21] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1451304 2009-03-20] (Synaptics Incorporated)

HKLM\...\Run: [Toshiba Registration] => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [96144 2009-03-04] (Toshiba Europe GmbH)

HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-30] (Realtek Semiconductor Corp.)

HKLM\...\Run: [OrderReminder] => C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe [98304 2006-01-30] (Hewlett-Packard)

HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.)

HKLM\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.)

HKLM\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.)

HKLM\...\Run: [TAccessibility] => C:\Program Files\TOSHIBA\Accessibility\TAccessibility.exe [110592 2009-04-24] ()

HKLM\...\Run: [TCtryIOHook] => TCtrlIOHook.exe

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)

HKLM\...\Policies\Explorer: [NoCDBurning] 0

HKLM\...\Policies\Explorer: [NoFolderOptions] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKU\S-1-5-21-3586509278-78834929-860225448-1000\...\Run: [TOSHIBA Online Product Information] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [6158240 2009-03-16] (TOSHIBA)

HKU\S-1-5-21-3586509278-78834929-860225448-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)

HKU\S-1-5-18\...\Run: [TOSHIBA Online Product Information] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [6158240 2009-03-16] (TOSHIBA)

HKU\S-1-5-18\...\Policies\Explorer: [NoFolderOptions] 0

HKU\S-1-5-18\...\Policies\Explorer: [NoControlPanel] 0

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk

ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe (No File)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Shortcut-Leiste.lnk

ShortcutTarget: Microsoft Office Shortcut-Leiste.lnk -> C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft-Indexerstellung.lnk

ShortcutTarget: Microsoft-Indexerstellung.lnk -> C:\Program Files\Microsoft Office\Office\FINDFAST.EXE (Microsoft Corporation)

Startup: C:\Users\Conny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk

ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk

ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

Startup: C:\Users\Rainer-User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKLM - {38AEB7B3-42CC-4C33-9290-BEA08B6FE742} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG;

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - F31624B0AF444080B7F139E05E41A758 URL = hxxp://isearch.avg.com/search?cid={72680FDB-E8CB-437D-AEE8-9F9D0761B89D}&mid=34d71d940f5847d1b30bd16a1c122099-aca251ad60a79a90d151588985182fee0518d1c3&lang=de&ds=tt014&pr=sa&d=2011-12-19 22:25:18&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}

SearchScopes: HKCU - {38AEB7B3-42CC-4C33-9290-BEA08B6FE742} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG;

BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab

DPF: {B07F54E6-0806-47DB-B5D8-398F240776F2} file:///E:/viewer/ORDcmViewCD.ocx

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Handler: haufereader - No CLSID Value - 

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default

FF Keyword.URL: hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()

FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin: @protectdisc.com/NPMPDRM -> C:\Program Files\Common Files\mpDRM\NPMPDRM.dll ( )

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\11-suche.xml

FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\webde-suche.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: WEB.DE MailCheck - C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\Extensions\toolbar@web.de [2014-09-24]

FF Extension: WOT - C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-08-18]

FF Extension: Ghostery - C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\Extensions\firefox@ghostery.com.xpi [2014-08-15]

FF Extension: UITBAutoInstaller - C:\Program Files\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} [2014-09-25]

FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor

FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2011-12-15]

FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2011-12-15]

FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
 

Chrome: 

=======

CHR CustomProfile: C:\Users\Rainer\AppData\Local\Google\Chrome\User Data\Default

CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2011-12-15]
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S4 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()

R2 camsvc; C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [20544 2009-04-16] (TOSHIBA)

R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [46448 2009-03-10] (TOSHIBA CORPORATION)

S4 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [242424 2009-02-11] (WildTangent, Inc.)

R2 HomeNetSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)

S4 HRService; C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe [71024 2010-10-25] ()

S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.)

R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [145568 2014-04-25] (McAfee, Inc.)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)

R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)

R2 McNaiAnn; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)

S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [472072 2014-06-12] (McAfee, Inc.)

R2 mcpltsvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)

R2 McProxy; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)

R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [655936 2014-07-24] (McAfee, Inc.)

R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169800 2014-06-20] (McAfee, Inc.)

R2 mfevtp; C:\Windows\system32\mfevtps.exe [179600 2014-06-20] (McAfee, Inc.)

R2 MSK80Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)

S4 SXDS10; C:\Program Files\Common Files\soft Xpansion\sxds10.exe [234096 2013-10-06] (soft Xpansion)

R2 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [62776 2009-04-01] (TOSHIBA Corporation)

R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [176128 2009-04-24] (TOSHIBA Corporation) [File not signed]

R2 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [73728 2009-03-17] (TOSHIBA Corporation) [File not signed]

R2 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [656752 2009-04-15] (TOSHIBA Corporation)

S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 acedrv10; C:\Windows\system32\drivers\acedrv10.sys [330144 2007-07-27] (Protect Software GmbH)

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)

R2 acehlp10; C:\Windows\system32\drivers\acehlp10.sys [251680 2007-07-27] (Protect Software GmbH)

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [62832 2014-06-20] (McAfee, Inc.)

S3 FTD2XX; C:\Windows\System32\Drivers\FTD2XX.sys [29292 2004-10-15] (FTDI Ltd.) [File not signed]

S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [60104 2011-01-24] (FTDI Ltd.)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [147912 2013-09-23] (McAfee, Inc.)

R0 LPCFilter; C:\Windows\System32\DRIVERS\LPCFilter.sys [25896 2008-05-07] (COMPAL ELECTRONIC INC.)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-09-25] (Malwarebytes Corporation)

R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [135968 2014-06-20] (McAfee, Inc.)

R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [238176 2014-06-20] (McAfee, Inc.)

S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [67816 2014-06-20] (McAfee, Inc.)

R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [369248 2014-06-20] (McAfee, Inc.)

R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [576048 2014-06-20] (McAfee, Inc.)

R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [349192 2014-07-24] (McAfee, Inc.)

S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [81296 2014-07-24] (McAfee, Inc.)

R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [217224 2014-06-20] (McAfee, Inc.)

R3 PGEffect; C:\Windows\System32\DRIVERS\pgeffect.sys [22272 2009-03-18] (TOSHIBA Corporation)

R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [154272 2008-11-11] (Realtek Semiconductor Corp.)

R1 RtlProt; C:\Windows\System32\DRIVERS\rtlprot.sys [25896 2007-04-23] (Windows (R) Codename Longhorn DDK provider)

S3 SAFAUSB; C:\Windows\System32\Drivers\VocTrace.sys [16035 2003-12-19] (Windows (R) 2000 DDK provider)

R2 TVALZFL; C:\Windows\System32\DRIVERS\TVALZFL.sys [12920 2009-03-21] (TOSHIBA Corporation)

U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)

S4 avgtp; \??\C:\Windows\system32\drivers\avgtpx86.sys [X]

S3 catchme; \??\C:\Users\Rainer\AppData\Local\Temp\catchme.sys [X]

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-09-25 22:12 - 2014-09-25 22:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee

2014-09-25 21:35 - 2014-09-25 21:35 - 00000809 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\Program Files\CCleaner

2014-09-25 21:33 - 2014-09-25 21:33 - 04901352 _____ (Piriform Ltd) C:\Users\Rainer\Downloads\ccsetup417.exe

2014-09-25 15:38 - 2014-09-25 15:39 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-09-24 23:09 - 2014-09-09 08:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-09-24 22:56 - 2014-09-24 22:56 - 00448512 _____ (OldTimer Tools) C:\Users\Rainer\Downloads\TFC.exe

2014-09-24 21:32 - 2014-09-24 22:15 - 00000021 _____ () C:\Users\Rainer\Downloads\Fixlist.txt

2014-09-24 09:21 - 2014-09-24 09:21 - 00001880 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ___RD () C:\Program Files\Skype

2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\Program Files\Common Files\Skype

2014-09-18 07:42 - 2014-09-18 07:42 - 00068225 _____ () C:\Users\Rainer\Downloads\ESET20140918.txt

2014-09-17 16:56 - 2014-09-17 16:56 - 00006428 _____ () C:\Users\Rainer-User\Downloads\Antimalware txt.txt

2014-09-16 22:16 - 2014-09-16 22:17 - 02347384 _____ (ESET) C:\Users\Rainer-User\Downloads\esetsmartinstaller_deu.exe

2014-09-12 19:41 - 2014-09-12 19:41 - 00007191 _____ () C:\Users\Rainer-User\Downloads\Malwarebytes Anti-Malware 2014 09 10.txt

2014-09-12 18:27 - 2014-09-12 18:27 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2014-09-12 18:26 - 2014-09-12 18:26 - 00002112 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk

2014-09-12 18:26 - 2014-09-12 18:26 - 00001037 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\OpenCandy

2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Program Files\WEB.DE MailCheck

2014-09-11 17:08 - 2013-03-02 23:24 - 00000744 _____ () C:\Users\Felix\Desktop\Tapps DE.lnk

2014-09-11 14:53 - 2014-08-19 03:46 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-09-11 14:53 - 2014-08-19 03:46 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-09-11 14:53 - 2014-08-19 03:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2014-09-11 14:53 - 2014-08-19 03:44 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2014-09-11 14:53 - 2014-08-19 03:41 - 06003200 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-09-11 14:53 - 2014-08-19 03:41 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll

2014-09-11 14:53 - 2014-08-19 03:41 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-09-11 14:53 - 2014-08-19 03:41 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-09-11 14:53 - 2014-08-19 03:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll

2014-09-11 14:53 - 2014-08-19 03:40 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-09-11 14:53 - 2014-08-19 03:40 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll

2014-09-11 14:53 - 2014-08-19 03:40 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-09-11 14:53 - 2014-08-19 03:39 - 11082752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-09-11 14:53 - 2014-08-19 03:39 - 02005504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-09-11 14:53 - 2014-08-19 03:39 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-09-11 14:53 - 2014-08-19 03:39 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll

2014-09-11 14:53 - 2014-08-19 03:39 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-09-11 14:53 - 2014-08-19 03:39 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-09-11 14:53 - 2014-08-19 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-09-11 14:53 - 2014-08-19 03:39 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-09-11 14:53 - 2014-08-19 03:38 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll

2014-09-11 14:53 - 2014-08-19 02:10 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2014-09-11 14:53 - 2014-08-19 00:33 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-09-11 14:53 - 2014-08-19 00:33 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-09-11 14:53 - 2014-08-19 00:31 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

2014-09-11 14:53 - 2014-08-19 00:30 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-08-29 08:43 - 2014-08-23 03:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-29 08:43 - 2014-08-23 01:26 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-09-25 23:05 - 2014-08-17 22:03 - 00000000 ____D () C:\Users\Rainer\Downloads\FRST-OlderVersion

2014-09-25 23:05 - 2014-08-10 22:03 - 00022798 _____ () C:\Users\Rainer\Downloads\FRST.txt

2014-09-25 23:05 - 2014-04-29 00:09 - 01100800 _____ (Farbar) C:\Users\Rainer\Downloads\FRST.exe

2014-09-25 23:05 - 2013-11-11 00:10 - 00000000 ____D () C:\FRST

2014-09-25 22:43 - 2009-06-09 09:00 - 00000000 ____D () C:\Windows\Panther

2014-09-25 22:38 - 2012-04-04 21:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-09-25 22:34 - 2011-09-26 23:43 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-09-25 22:12 - 2014-09-25 22:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee

2014-09-25 22:12 - 2013-02-20 08:55 - 00001756 _____ () C:\Users\Public\Desktop\McAfee Internet Security.lnk

2014-09-25 21:40 - 2014-04-28 22:25 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-09-25 21:35 - 2014-09-25 21:35 - 00000809 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\Program Files\CCleaner

2014-09-25 21:33 - 2014-09-25 21:33 - 04901352 _____ (Piriform Ltd) C:\Users\Rainer\Downloads\ccsetup417.exe

2014-09-25 21:26 - 2008-02-24 09:46 - 01181881 ____N () C:\Windows\WindowsUpdate.log

2014-09-25 21:23 - 2014-06-22 14:29 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8e15a8ab2474.job

2014-09-25 21:23 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-09-25 21:23 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-09-25 21:23 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-09-25 18:32 - 2006-11-02 15:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-09-25 18:09 - 2011-12-02 22:18 - 00000000 ___RD () C:\Users\Public\Recorded TV

2014-09-25 18:06 - 2014-05-07 23:06 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-09-25 15:39 - 2014-09-25 15:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-09-25 15:25 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache

2014-09-24 23:10 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE

2014-09-24 22:56 - 2014-09-24 22:56 - 00448512 _____ (OldTimer Tools) C:\Users\Rainer\Downloads\TFC.exe

2014-09-24 22:40 - 2010-11-14 21:59 - 00000000 ____D () C:\Users\Rainer-User\AppData\Roaming\Skype

2014-09-24 22:15 - 2014-09-24 21:32 - 00000021 _____ () C:\Users\Rainer\Downloads\Fixlist.txt

2014-09-24 15:50 - 2011-11-26 10:09 - 00000000 ____D () C:\Users\Felix\AppData\Roaming\Skype

2014-09-24 09:21 - 2014-09-24 09:21 - 00001880 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ___RD () C:\Program Files\Skype

2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\Program Files\Common Files\Skype

2014-09-24 09:21 - 2010-11-17 08:51 - 00000000 ____D () C:\Users\Conny\AppData\Roaming\Skype

2014-09-24 09:20 - 2010-11-14 21:59 - 00000000 ____D () C:\ProgramData\Skype

2014-09-18 07:42 - 2014-09-18 07:42 - 00068225 _____ () C:\Users\Rainer\Downloads\ESET20140918.txt

2014-09-17 18:04 - 2014-07-17 21:26 - 00000000 ____D () C:\Program Files\Opera

2014-09-17 16:56 - 2014-09-17 16:56 - 00006428 _____ () C:\Users\Rainer-User\Downloads\Antimalware txt.txt

2014-09-16 22:17 - 2014-09-16 22:16 - 02347384 _____ (ESET) C:\Users\Rainer-User\Downloads\esetsmartinstaller_deu.exe

2014-09-16 22:14 - 2011-06-23 12:41 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

2014-09-15 09:06 - 2011-12-09 23:58 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-09-12 19:41 - 2014-09-12 19:41 - 00007191 _____ () C:\Users\Rainer-User\Downloads\Malwarebytes Anti-Malware 2014 09 10.txt

2014-09-12 18:28 - 2011-11-28 00:47 - 00000000 ____D () C:\Program Files\TuneUp Utilities 2012

2014-09-12 18:28 - 2011-11-28 00:45 - 00000000 ____D () C:\ProgramData\TuneUp Software

2014-09-12 18:27 - 2014-09-12 18:27 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2014-09-12 18:27 - 2011-09-13 22:46 - 00000000 ____D () C:\Users\Rainer-User\AppData\Roaming\DVDVideoSoft

2014-09-12 18:27 - 2011-02-25 21:28 - 00000000 ____D () C:\Users\Rainer-User\Documents\DVDVideoSoft

2014-09-12 18:27 - 2010-10-18 19:04 - 00000000 ____D () C:\Program Files\DVDVideoSoft

2014-09-12 18:26 - 2014-09-12 18:26 - 00002112 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk

2014-09-12 18:26 - 2014-09-12 18:26 - 00001037 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\OpenCandy

2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Program Files\WEB.DE MailCheck

2014-09-12 18:26 - 2011-09-13 22:47 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\DVDVideoSoft

2014-09-12 18:26 - 2010-10-18 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft

2014-09-12 18:26 - 2010-10-18 19:04 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft

2014-09-11 17:25 - 2008-01-21 09:16 - 01626604 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-09-11 15:48 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET

2014-09-11 15:09 - 2013-08-07 12:11 - 00000000 ____D () C:\Windows\system32\MRT

2014-09-11 14:55 - 2006-11-02 12:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2014-09-11 14:34 - 2012-04-04 21:24 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-09-11 14:34 - 2011-06-01 22:29 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-09-09 08:24 - 2014-09-24 23:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-09-06 21:30 - 2011-12-15 01:57 - 00000000 ____D () C:\Program Files\Common Files\Mcafee

2014-08-31 13:55 - 2013-12-03 16:10 - 00001781 _____ () C:\Users\Rainer\Desktop\FOTOParadies.lnk

2014-08-31 13:55 - 2013-12-03 16:10 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FOTOParadies

2014-08-31 13:55 - 2012-09-11 21:19 - 00000000 ____D () C:\Program Files\FOTOParadies

2014-08-29 09:02 - 2006-11-02 14:47 - 00322424 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-08-26 17:23 - 2011-11-20 21:35 - 00000020 ____H () C:\ProgramData\PKP_DLdu.DAT

2014-08-26 17:22 - 2011-11-20 21:37 - 00000020 ____H () C:\ProgramData\PKP_DLdw.DAT
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-09-25 21:29
 

==================== End Of Log ============================

--- --- ---

.... hmja, wie soll ich das machen, ich frage ja Dich, ... :eek:
heute Abend habe ich MWB nochmal laufen lassen, folgendes Ergebnis:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 18.08.2014

Suchlauf-Zeit: 21:39:23

Logdatei: Malwarebytes Anti-Malware 2014 08 18.txt

Administrator: Nein
 

Version: 2.00.2.1012

Malware Datenbank: v2014.08.18.09

Rootkit Datenbank: v2014.08.16.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows Vista Service Pack 2

CPU: x86

Dateisystem: NTFS

Benutzer: Rainer-User
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 350521

Verstrichene Zeit: 13 Min, 40 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Aktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 1

PUP.Optional.DealKeeper.A, HKLM\SOFTWARE\Deal Keeper, Löschen bei Neustart, [32df33959edd64d270b78364bc4645bb], 
 

Registrierungswerte: 1

PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1381094394899&tguid=66920-6787-1381094394899-AF07B6AD22DF51CE02B3D1B428BA0F24&q=%s, Löschen bei Neustart, [fa17e9df5526290d1bc8ac41956d9070]
 

Registrierungsdaten: 1

PUP.Optional.SafeFinder.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}),Löschen bei Neustart,[c34e3a8e0d6e74c2346412b826deb34d]
 

Ordner: 0

(No malicious items detected)
 

Dateien: 12

PUP.Optional.SmartBar, C:\Windows\Installer\16f349.msi, Löschen bei Neustart, [29e8c3050d6eb284b78fd8569769e020], 

PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\searchplugins\SafeFinder Search.xml, Löschen bei Neustart, [6da4c008eb90d660ebc9e3fdbd45f60a], 

PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\searchplugins\SafeFinder Search.xml, Löschen bei Neustart, [db36fbcd9fdcfe3872423fa12fd3f709], 

PUP.Optional.HomeTab.A, c:\Windows\System32\Tasks\browser updater, Löschen bei Neustart, [57ba7b4d700b270f1f7df4f825dd3fc1], 

PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), Entfernung fehlgeschlagen,[2be606c28eedea4cb2db27de34d1b34d]

PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), Entfernung fehlgeschlagen,[63aee9dfe29980b6018d52b380856799]

PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), Entfernung fehlgeschlagen,[947d1dabd4a7082eccc38e77b055ab55]

PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), Entfernung fehlgeschlagen,[5eb380486e0d2c0ad7b60afbde278f71]

PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), Entfernung fehlgeschlagen,[ec258741463542f43c523fc6d92c0af6]

PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), Entfernung fehlgeschlagen,[0b06d7f17506fb3b5f3048bd4eb7a65a]

PUP.Optional.SafeFinder.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), Entfernung fehlgeschlagen,[918014b48bf09a9c652a759029dc4bb5]

PUP.Optional.QuickStart.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");), Entfernung fehlgeschlagen,[c24f5276adcebc7aa9eaac5961a4629e]
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

In dem Fenster von MWB ist also diese Liste, und in der Spalte 'Aktion' steht für jede der gelisteten Zeilen: 'Quarantäne'. Nun kann ich meiner Meinung nach entweder rechts den Button 'Aktionen anwenden' drücken oder auch links 'Alles in Quarantäne stellen'.
Ich wählte bis jetzt immer den rechten Button 'Aktionen anwenden'.

Also, heute Abend wähle ich dann mal den linken Button und schicke Dir anschl. das Ergebnis, ok?
Ah, ok, im Verlaufsfenster kann ich auch noch die Quarantäne anschauen und dort alles löschen.
Das mache ich also auch noch...
Nun ist dort auch alles leer.
Bitte entschuldige, ich habe den Eindruck, daß meine fortlaufenden Fragen sehr nervend für Dich sind.
Viele Grüße
Romanos

Hallo Cosinus,
so, und dann den Rechner runter- und wieder hochgefahren, ...
MWB nochmal laufen lassen, Ergebnis:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 09.10.2014

Suchlauf-Zeit: 23:15:12

Logdatei: 

Administrator: Nein
 

Version: 2.00.2.1012

Malware Datenbank: v2014.10.09.11

Rootkit Datenbank: v2014.10.08.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows Vista Service Pack 2

CPU: x86

Dateisystem: NTFS

Benutzer: Rainer-User
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 361154

Verstrichene Zeit: 14 Min, 13 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Aktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 2

PUP.Optional.DealKeeper.A, HKLM\SOFTWARE\Deal Keeper, , [4b6423eff983a59108148b96c63ddd23], 

PUP.Optional.BrowserGuard.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\kfepagcelbegkpkcjgfeecmlnmkedjin, , [19964ec4abd144f28b930f0321e221df], 
 

Registrierungswerte: 1

PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1381094394899&tguid=66920-6787-1381094394899-AF07B6AD22DF51CE02B3D1B428BA0F24&q=%s, , [2c8321f19ddf6bcb1caf31f6ab5817e9]
 

Registrierungsdaten: 1

PUP.Optional.SafeFinder.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}),,[0ba4e230314b1422155e8c825fa619e7]
 

Ordner: 4

PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy, , [8c23e13198e4ea4c47790ed77e8413ed], 

PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\177586C2EEA542989844699BACEE36C5, , [8c23e13198e4ea4c47790ed77e8413ed], 

PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\8255D8B8BE3D4D2C91C3FF151064C5B9, , [8c23e13198e4ea4c47790ed77e8413ed], 

PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\A34781A3E41146DFADBA6A7B704BF5CD, , [8c23e13198e4ea4c47790ed77e8413ed], 
 

Dateien: 10

PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\searchplugins\SafeFinder Search.xml, , [8926cc461369ec4a02b58199f90a06fa], 

PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\searchplugins\SafeFinder Search.xml, , [6b44db37304c6dc92394e43645bec23e], 

PUP.Optional.HomeTab.A, c:\Windows\System32\Tasks\browser updater, , [119e040e49331521f492180e2cd7f10f], 

PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), ,[a8078e849ddf7fb7a3d30943fb0a17e9]

PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), ,[96193cd61e5e2f07671036161de814ec]

PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[8c2364aeadcf10267008113bbc49758b]

PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), ,[2f806da51b6174c2fc7a212b9c6907f9]

PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), ,[c1ee35dd9be1a393adcaf95314f1fe02]

PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[dcd3b85a74083ff77bfd1438a95c817f]

PUP.Optional.SafeFinder.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[d5dac64ca9d3a78fea8e222a2cd98f71]
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

Also gleich wie vorher, ... was mache ich falsch?
Viele Grüße
Romanos