Trojaner-Board - Avira läuft nicht - Dieses Programm wurde durch eine Gruppenrichtlinie blockiert

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Avira läuft nicht - Dieses Programm wurde durch eine Gruppenrichtlinie blockiert (https://www.trojaner-board.de/157639-avira-laeuft-programm-wurde-gruppenrichtlinie-blockiert.html)

Avira läuft nicht - Dieses Programm wurde durch eine Gruppenrichtlinie blockiert

Hallo,

nachdem ich gesehen habe, dass viele andere schon das gleiche Problem wie ich hatten und hier im Forum viele kompetente Helfer unterwegs sind, wende ich mich an Euch:

Auf meinem Laptop (Windows Vista) läuft seit ein paar Tagen Avira nicht mehr, es lässt sich nicht deinstallieren und es kommt der Fehlerhinweis "Dieses Programm wurde durch eine Gruppenrichtlinie blockiert".

Sensible Passwörter habe ich bereits auf einem sauberen PC geändert.

FRST habe ich mir schon heruntergeladen und einen Scan laufen lassen.

FRST:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-08-2014

Ran by Kathi (ATTENTION: The logged in user is not administrator) on KATHARINA on 15-08-2014 17:39:00

Running from c:\Users\Kathi\Downloads

Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

() C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

() C:\Users\Kathi\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

(Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe

(Dropbox, Inc.) C:\Users\Kathi\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

(Intel Corporation) C:\Windows\System32\igfxext.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe

(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION

HKU\S-1-5-21-3121953689-2843351358-1462341086-1004\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21392 2012-02-03] ()

HKU\S-1-5-21-3121953689-2843351358-1462341086-1004\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-09-18] (Google Inc.)

HKU\S-1-5-21-3121953689-2843351358-1462341086-1004\...\Run: [Amazon Cloud Player] => C:\Users\Kathi\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3145536 2014-05-08] ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk

ShortcutTarget: Printkey2000.lnk -> C:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software)

Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Kathi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate=02/11/2013&type=hp1000

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn

SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000

SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7AURU_deDE502

SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7AURU_deDE502

BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)

BHO: No Name -> {41564952-412D-5637-00A7-7A786E7484D7} ->  No File

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: Softonic Helper Object -> {E87806B5-E908-45FD-AF5E-957D83E58E68} -> C:\Program Files\Softonic\Softonic\1.6.7.4\bh\Softonic.dll (Softonic.com)

BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Softonic Toolbar - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files\Softonic\Softonic\1.6.7.4\SoftonicTlbr.dll (Softonic.com)

Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Kathi\AppData\Roaming\Mozilla\Firefox\Profiles\xd1mt82e.default

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Kathi\AppData\Roaming\Mozilla\Firefox\Profiles\xd1mt82e.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2013-12-17]

FF Extension: DHL Packstation Bestellhelfer - C:\Users\Kathi\AppData\Roaming\Mozilla\Firefox\Profiles\xd1mt82e.default\Extensions\{b8cbd8e0-e642-11dd-ba2f-0800200c9a66} [2012-12-08]

FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-10-23]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-12-28]

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012-08-30]

FF HKLM\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-11-02]
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR RestoreOnStartup: "hxxp://www.google.com/"

CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx []
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-15] (Avira Operations GmbH & Co. KG)

R2 iphlpsvc; C:\Windows\System32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)

R2 lmhosts; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)

S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]

R2 NlaSvc; C:\Windows\System32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]

R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-25] ()

R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)

S2 APNMCP; "C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)

R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-15 17:39 - 2014-08-15 17:39 - 00016940 _____ () C:\Users\Kathi\Downloads\FRST.txt

2014-08-15 17:38 - 2014-08-15 17:39 - 00000000 ____D () C:\FRST

2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Kathi\Downloads\FRST.exe

2014-08-12 20:43 - 2014-08-12 20:50 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe

2014-08-12 20:42 - 2014-08-12 20:49 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe

2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com

2014-08-03 13:58 - 2014-08-03 13:59 - 00000000 ____D () C:\ProgramData\EtilkOdmol

2014-08-03 13:58 - 2014-08-03 13:58 - 00000000 ____D () C:\ProgramData\OxyuNhira

2014-08-03 13:43 - 2014-06-10 12:27 - 00017344 _____ (Dll-Files.com) C:\Windows\system32\roboot.exe

2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)

2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-15 17:39 - 2014-08-15 17:39 - 00016940 _____ () C:\Users\Kathi\Downloads\FRST.txt

2014-08-15 17:39 - 2014-08-15 17:38 - 00000000 ____D () C:\FRST

2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Kathi\Downloads\FRST.exe

2014-08-15 17:37 - 2009-08-11 21:16 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job

2014-08-15 17:36 - 2009-07-21 20:26 - 01251946 _____ () C:\Windows\WindowsUpdate.log

2014-08-15 17:34 - 2014-04-27 21:32 - 00000000 ___RD () C:\Users\Kathi\Dropbox

2014-08-15 17:34 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Dropbox

2014-08-15 17:33 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite

2014-08-15 17:32 - 2014-05-29 12:02 - 00000264 _____ () C:\Windows\Tasks\SpeedUpMyPC Startup.job

2014-08-15 17:32 - 2012-08-18 23:35 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-08-15 17:32 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-15 17:32 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-15 17:32 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-15 17:31 - 2006-11-02 14:58 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-08-15 17:08 - 2013-06-30 22:48 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job

2014-08-12 23:00 - 2014-06-16 11:05 - 00015080 _____ () C:\Users\Kathi\Desktop\Hochzeitsgeschenke.xlsx

2014-08-12 23:00 - 2014-05-29 12:02 - 00000270 _____ () C:\Windows\Tasks\SpeedUpMyPC Maintenance.job

2014-08-12 21:46 - 2012-08-18 23:35 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-08-12 20:50 - 2014-08-12 20:43 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe

2014-08-12 20:49 - 2014-08-12 20:42 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe

2014-08-11 23:09 - 2014-06-16 23:09 - 00018357 _____ () C:\Users\Kathi\Desktop\malediven.xlsx

2014-08-11 23:06 - 2014-06-15 16:51 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit - Standesamt

2014-08-11 22:08 - 2014-02-16 18:46 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit

2014-08-10 14:08 - 2012-01-02 21:32 - 00000000 ____D () C:\Users\Kathi\Documents\Passwörter

2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com

2014-08-04 21:06 - 2012-05-15 18:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-08-03 23:26 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi

2014-08-03 23:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis

2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool

2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc

2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration

2014-08-03 14:10 - 2012-10-23 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-08-03 14:10 - 2012-05-15 18:16 - 00000858 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-08-03 14:10 - 2012-05-15 18:16 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-08-03 13:59 - 2014-08-03 13:58 - 00000000 ____D () C:\ProgramData\EtilkOdmol

2014-08-03 13:58 - 2014-08-03 13:58 - 00000000 ____D () C:\ProgramData\OxyuNhira

2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)

2014-07-23 10:52 - 2011-12-28 16:24 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-07-22 21:04 - 2014-04-27 21:32 - 00000919 _____ () C:\Users\Kathi\Desktop\Dropbox.lnk

2014-07-22 21:04 - 2014-04-27 21:31 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-07-18 23:55 - 2006-11-02 12:33 - 01566246 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-18 19:59 - 2006-11-02 14:49 - 00149220 _____ () C:\Windows\setupact.log

2014-07-18 19:54 - 2012-09-18 20:12 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-07-17 18:58 - 2012-03-23 19:56 - 00000000 ____D () C:\ProgramData\tmp

2014-07-17 18:17 - 2009-08-11 02:37 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Adobe

2014-07-17 18:16 - 2012-09-18 20:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-07-17 18:16 - 2012-02-26 00:06 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-07-17 18:01 - 2008-01-21 05:02 - 00742522 _____ () C:\Windows\PFRO.log

2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls

2014-07-16 17:50 - 2013-08-16 18:35 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-16 17:42 - 2006-11-02 12:24 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

ZeroAccess:

C:\Users\Kathi\AppData\Local\Google\Desktop\Install
 

Some content of TEMP:

====================

C:\Users\Kathi\AppData\Local\Temp\AskSLib.dll

C:\Users\Kathi\AppData\Local\Temp\avgnt.exe

C:\Users\Kathi\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpq754wn.dll

C:\Users\Kathi\AppData\Local\Temp\firefoxjre_exe-1.exe

C:\Users\Kathi\AppData\Local\Temp\firefoxjre_exe-2.exe

C:\Users\Kathi\AppData\Local\Temp\firefoxjre_exe.exe

C:\Users\Kathi\AppData\Local\Temp\fp_pl_pfs_installer.exe

C:\Users\Kathi\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Kathi\AppData\Local\Temp\tmp677D.exe

C:\Users\Kathi\AppData\Local\Temp\{C1500184-25BC-4E86-84ED-9B5FFBC17724}-23.0.1271.95_23.0.1271.64_chrome_updater.exe

C:\Users\Wichsis\AppData\Local\Temp\AskSLib.dll

C:\Users\Wichsis\AppData\Local\Temp\drm_dyndata_7330017.dll

C:\Users\Wichsis\AppData\Local\Temp\softonic_ggl_1.6.7.4.exe

C:\Users\Wichsis\AppData\Local\Temp\yontoo-c3.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 

==================== End Of Log ============================

--- --- ---

Addition:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version:15-08-2014

Ran by Kathi at 2014-08-15 17:39:40

Running from c:\Users\Kathi\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

32 Bit HP CIO Components Installer (Version: 2.1.4 - Hewlett-Packard) Hidden

Adobe Flash Player 11 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.4.402.278 - Adobe Systems Incorporated)

Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Reader 9.2 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A92000000001}) (Version: 9.2.0 - Adobe Systems Incorporated)

Adobe Shockwave Player 11.6 (HKLM\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)

Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.4.0.33 - Amazon Services LLC)

Atheros WLAN Client (HKLM\...\{3832FA99-2EDD-41E0-94AD-FBF9FABAFEF9}) (Version: 14.00.0000 - WLAN)

Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)

Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C0600}) (Version: 12.6.0.1900 - APN, LLC)

BatteryLifeExtender (HKLM\...\{AA16A9E5-40E9-44F5-801E-6B3D3CFE79E5}) (Version: 1.0.0 - Samsung)

Business Contact Manager für Outlook 2007 SP1 (HKLM\...\Business Contact Manager) (Version: 3.0.7311.0 - Microsoft Corporation)

Business Contact Manager für Outlook 2007 SP1 (Version: 3.0.7311.0 - Microsoft Corporation) Hidden

bwin Poker 1.0.0 (HKCU\...\bwin Poker_is1) (Version: 1.0.0 - bwin)

capella 7 (HKLM\...\{7BDBF713-CB99-4B66-800B-F563BC7F0560}) (Version: 7.1.21 - capella software AG)

CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2604 - CyberLink Corp.)

CyberLink DVD Suite (Version: 6.0.2604 - CyberLink Corp.) Hidden

CyberLink LabelPrint (HKLM\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.20.3605 - CyberLink Corp.)

CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2809 - CyberLink Corp.)

CyberLink Power2Go (Version: 6.0.2809 - CyberLink Corp.) Hidden

CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2426 - CyberLink Corp.)

CyberLink PowerDirector (Version: 7.0.2426 - CyberLink Corp.) Hidden

CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815 - CyberLink Corp.)

CyberLink PowerDVD 8 (Version: 8.0.2815 - CyberLink Corp.) Hidden

CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1410 - CyberLink Corp.)

CyberLink PowerProducer (Version: 5.0.1.1410 - CyberLink Corp.) Hidden

dm-Fotowelt (HKLM\...\dm-Fotowelt) (Version: 5.1.3 - CEWE Stiftung u Co. KGaA)

Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)

Easy Battery Manager (HKLM\...\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}) (Version: 3.2.1.7 - Samsung)

Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 2.3 - Samsung Electronics Co., Ltd.)

Easy Network Manager (HKLM\...\{A7581D39-EA20-4883-A480-80C21047052B}) (Version: 4.0.2 - Samsung)

Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.0.2.6 - )

Free YouTube to MP3 Converter version 3.12.35.514 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)

Google Chrome (HKLM\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)

Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden

IKEA Home Planner (HKLM\...\{B3276CB1-20B6-4AF9-AAEC-E72C83816495}) (Version: 2.0.3 - IKEA IT)

imagine digital freedom - Samsung (HKLM\...\{8E106A57-A17E-431D-B48F-175E42EB9F74}) (Version: 1.0.2.2 - Samsung Electronics Co. Ltd.,)

Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - Intel Corporation)

Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)

Java 7 Update 7 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217007FF}) (Version: 7.0.70 - Oracle)

Java Auto Updater (Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden

Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden

Microsoft Office 2003 Web Components (HKLM\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8003.0 - Microsoft Corporation)

Microsoft Office 2007 Primary Interop Assemblies (HKLM\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)

Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Small Business Connectivity Components (HKLM\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)

Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)

Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)

Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) (Version: 9.2.3042.00 - Microsoft Corporation) Hidden

Microsoft SQL Server Native Client (HKLM\...\{1D1D8ADC-BF08-4E61-9393-5FA305B16864}) (Version: 9.00.3042.00 - Microsoft Corporation)

Microsoft SQL Server VSS Writer (HKLM\...\{5C759B74-34F4-43C6-A5D9-039CB754C5E9}) (Version: 9.00.3042.00 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 16.0.1 (x86 de) (HKCU\...\Mozilla Firefox 16.0.1 (x86 de)) (Version: 16.0.1 - Mozilla)

Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

PCTroubleshooting (HKLM\...\{68CAE442-579C-4D84-AA5F-253852522ED5}) (Version: 2.0.0.4 - Samsung Electronics Co.,LTD.)

PrintKey2000 (HKLM\...\PrintKey2000) (Version:  - )

Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0004 - Realtek)

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5837 - Realtek Semiconductor Corp.)

Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.)

Samsung Kies (Version: 2.2.0.12014_18 - Samsung Electronics Co., Ltd.) Hidden

Samsung Magic Doctor (HKLM\...\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}) (Version: 5.0 - Samsung Electronics Co., LTD)

Samsung Recovery Solution III (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 3.0.0.9 - Samsung)

Samsung Update Plus (HKLM\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.4.103.0 - SAMSUNG Electronics Co., Ltd.)

SimCity™ Societies (HKLM\...\{0B5154C0-8F00-4616-B0AB-6240AE80D9CE}) (Version: 1.0.0.0 - Electronic Arts)

Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)

Skype™ 6.3 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.3.105 - Skype Technologies S.A.)

SmartWebPrinting (Version: 110.0.182.000 - Hewlett-Packard) Hidden

Softonic toolbar  on IE (HKLM\...\Softonic) (Version:  - Softonic) <==== ATTENTION

SpeedUpMyPC (HKLM\...\{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1) (Version: 6.0.1.1 - Uniblue Systems Limited) <==== ATTENTION

Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)

swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.3.2 - Synaptics)

Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.3042.00 - Microsoft Corporation)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)

User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )

VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)

Yahoo Community Smartbar (HKLM\...\{B5945149-A282-42E9-B43A-815E404F0580}) (Version: 1.185.66.12678 - Linkury Inc.) <==== ATTENTION
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

Could not list Restore Points. Check "winmgmt" service or repair WMI.
 
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

::1             localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 
 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?

Task: C:\Windows\Tasks\SpeedUpMyPC Maintenance.job => ? <==== ATTENTION

Task: C:\Windows\Tasks\SpeedUpMyPC Startup.job => ? <==== ATTENTION

Task: C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job => ?

Task: C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job => C:\Windows\system32\msfeedssync.exe
 

==================== Loaded Modules (whitelisted) =============
 

2009-06-15 11:26 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Samsung Magic Doctor\HookDllPS2.dll

2009-06-15 11:24 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\SAMSUNG\EasySpeedUpManager\HookDllPS2.dll

2009-06-15 11:24 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll

2008-12-24 05:29 - 2008-12-24 05:29 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll

2008-12-24 05:30 - 2008-12-24 05:30 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll

2012-02-03 18:50 - 2012-02-03 18:50 - 00021392 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

2012-02-03 18:44 - 2012-02-03 18:44 - 00503208 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\FirmwareUpdateAgent.Common.dll

2012-02-03 18:44 - 2012-02-03 18:44 - 00639912 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\CommonModule.dll

2012-02-19 18:44 - 2012-02-19 18:44 - 00115137 _____ () C:\Users\Kathi\AppData\Local\Temp\08f56ff6-864d-4a92-944a-57b870198cb2\CliSecureRT.dll

2012-02-03 18:44 - 2012-02-03 18:44 - 00007168 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\IPCServer.dll

2012-02-03 18:43 - 2012-02-03 18:43 - 00003584 _____ () C:\Program Files\Samsung\Kies\External\FirmwareUpdate\ISharedIPCInterface.dll

2013-12-20 23:55 - 2014-05-08 19:26 - 03145536 _____ () C:\Users\Kathi\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

2014-08-15 17:33 - 2014-08-15 17:33 - 00043008 _____ () c:\users\kathi\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpq754wn.dll

2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Kathi\AppData\Roaming\Dropbox\bin\libcef.dll

2012-10-23 18:37 - 2014-07-17 07:42 - 03800688 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

2014-07-17 18:16 - 2014-07-17 18:16 - 17029808 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/15/2014 05:33:54 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/15/2014 05:04:46 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/15/2014 05:04:00 PM) (Source: MsiInstaller) (EventID: 1013) (User: NT-AUTORITÄT)

Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.
 

Error: (08/15/2014 05:03:50 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )

Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
 

Error: (08/12/2014 08:06:05 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/11/2014 07:03:33 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/10/2014 07:00:28 PM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\KATHI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\XD1MT82E.DEFAULT\SAFEBROWSING-TO_DELETE> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (08/10/2014 07:00:28 PM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\KATHI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\XD1MT82E.DEFAULT\SAFEBROWSING> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (08/10/2014 07:00:28 PM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\KATHI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\XD1MT82E.DEFAULT\SAFEBROWSING> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (08/10/2014 07:00:28 PM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\KATHI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\XD1MT82E.DEFAULT\SAFEBROWSING-BACKUP> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 
 

System errors:

=============

Error: (08/15/2014 05:35:20 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)

Description: 0x80070032
 

Error: (08/15/2014 05:33:54 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Parallel port driver%%1058
 

Error: (08/15/2014 05:32:11 PM) (Source: HTTP) (EventID: 15016) (User: )

Description: \Device\Http\ReqQueueKerberos
 

Error: (08/15/2014 05:16:36 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Avira Browser-Schutz101Neustart des Diensts
 

Error: (08/15/2014 05:16:36 PM) (Source: Service Control Manager) (EventID: 7006) (User: )

Description: ScRegSetValueExWFailureActions%%5
 

Error: (08/15/2014 05:16:36 PM) (Source: Service Control Manager) (EventID: 7006) (User: )

Description: ScRegSetValueExWFailureActions%%5
 

Error: (08/15/2014 05:04:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Parallel port driver%%1058
 

Error: (08/15/2014 05:04:16 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)

Description: 0x80070032
 

Error: (08/15/2014 05:03:07 PM) (Source: HTTP) (EventID: 15016) (User: )

Description: \Device\Http\ReqQueueKerberos
 

Error: (08/12/2014 11:04:07 PM) (Source: bowser) (EventID: 8003) (User: )

Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "ALEX-PC",

der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{0685C0AA-B32D-4432-9948-2DD5804032-Transport zu sein scheint.

Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
 
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2014-04-26 22:52:09.820

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-04-26 22:52:09.656

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-04-26 22:52:09.480

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-04-26 22:52:09.322

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz

Percentage of memory in use: 46%

Total physical RAM: 3031.88 MB

Available physical RAM: 1631.35 MB

Total Pagefile: 6300.17 MB

Available Pagefile: 4840.21 MB

Total Virtual: 2047.88 MB

Available Virtual: 1893.5 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:109.88 GB) (Free:3.74 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive d: () (Fixed) (Total:110 GB) (Free:71.21 GB) NTFS
 

==================== MBR & Partition Table ==================
 

==================== End Of Log ============================

Schon jetzt vielen Dank für Eure Hilfe!

Viele Grüße
Katharina

:hallo:

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...:abklatsch:

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
Bitte kein Crossposting (posten in mehreren Foren).
Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
Poste die Logfiles direkt in Deinen Thread in Code-Tags.
Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean :daumenhoc bekommst.

Los geht's:

Bitte deinstalliere folgende Programme:

Yahoo Community Smartbar
Softonic toolbar on IE
SpeedUpMyP

Schritt 1

http://filepony.de/icon/frst.png http://deeprybka.trojaner-board.de/b...st/frstfix.png

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:

Code:

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION

Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.

Starte FRST und drücke auf den Fix-Button.
Das Tool erstellt eine "Fixlog.txt" -Datei.
Poste mir bitte deren Inhalt.

Avira solltest Du nun wieder bedienen können und darfst es für Schritt 2 auch gleich wieder deaktivieren (Echtzeitschutz). ;)

http://www.trojaner-board.de/attachm...iten-avira.png

Schritt 2
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo Jürgen,

vielen Dank für Deine Hilfe :dankeschoen:

Ich habe Softonic toolbar on IE und SpeedUpMyP deinstalliert.
Yahoo Community Smartbar konnte ich leider nicht finden.
Wenn ich das in die Suche eingebe, findest es das auch nur in der FRST- und Additionsdatei.

Soll ich nun trotzdem die weiteren Schritte ausführen?

Viele Grüße
Katharina

Hi,
ja mach einfach mit den nächsten Schritten weiter... :)

Ok, super.

Hier die Fixlog.txt-Datei:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:15-08-2014

Ran by Kathi at 2014-08-15 18:55:49 Run:1

Running from C:\Users\Kathi\Downloads

Boot Mode: Normal
 

==============================================
 

Content of fixlist:

*****************

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION

*****************
 

HKLM => Group Policy Restriction on software not found.

HKLM => Group Policy Restriction on software not found.

HKLM => Group Policy Restriction on software not found.
 

==== End of Fixlog ====

Avira kann ich leider noch nicht bedienen.
Es kommt nach wie vor die Fehlermeldung mit der Gruppenrichtlinie, wenden Sie sich an Ihren Systemadministrator.

Hi,
Du musst alle unsere Tools als Administratror ausführen.

Code:

(ATTENTION: The logged in user is not administrator)

Zitat:

Gehen Sie folgendermaßen vor, um ein Programm mit Administratorrechten auszuführen:

Klicken Sie mit der rechten Maustaste auf das Programmsymbol, und klicken Sie danach auf Als Administrator ausführen.
Wenn Sie zur Eingabe eines Administratorkennworts bzw. zur Bestätigung aufgefordert werden, geben Sie das Administratorkennwort ein, oder klicken Sie auf Weiter.

http://support.microsoft.com/kb/922708/de

Macht aber nichts, machen wir später. Laufen ja auch keine Avira-Prozesse.
Mach jetzt bitte mit Schritt 2 weiter. Halte Dich aber genau an die Anweisungen. ;)

Hier die Combofix-Datei. Er hat gemeckert, dass Avira Desktop aktiv wäre, was ja aber nicht der Fall war. Habe ich deshalb ignoriert.

Code:

ComboFix 14-08-15.01 - Wichsis 15.08.2014  19:13:38.1.2 - x86

Microsoft® Windows Vista™ Home Basic   6.0.6001.1.1252.49.1031.18.3032.1336 [GMT 2:00]

ausgeführt von:: c:\users\Kathi\Desktop\ComboFix.exe

AV: Avira Desktop *Enabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}

SP: Avira Desktop *Enabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Kathi\AppData\Local\Google\Desktop\Install

c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\???\???\???\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\@

c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\???\???\???\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\U\00000001.@

c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\???\???\???\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\U\00000002.@

c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\C3C1~1\01C8~1\CFFE~1\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\@

c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\C3C1~1\01C8~1\CFFE~1\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\U\00000001.@

c:\users\Kathi\AppData\Local\Google\Desktop\Install\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\C3C1~1\01C8~1\CFFE~1\{c7ed97b9-5c51-63b8-4ec8-f1a70c852fb6}\U\00000002.@

D:\install.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-07-15 bis 2014-08-15  ))))))))))))))))))))))))))))))

.

.

2014-08-15 17:21 . 2014-08-15 17:21        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-08-15 17:21 . 2014-08-15 17:21        --------        d-----w-        c:\users\Wichsis\AppData\Local\temp

2014-08-15 15:58 . 2014-08-15 15:58        62576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{C633E6EE-22F1-4EA2-AD7B-977174453D10}\offreg.dll

2014-08-15 15:38 . 2014-08-15 16:55        --------        d-----w-        C:\FRST

2014-08-15 15:24 . 2014-07-02 03:11        8217224        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{C633E6EE-22F1-4EA2-AD7B-977174453D10}\mpengine.dll

2014-08-04 19:09 . 2014-08-04 19:09        --------        d-----w-        c:\users\Kathi\AppData\Roaming\dll-files.com

2014-08-03 11:58 . 2014-08-03 11:59        --------        d-----w-        c:\programdata\EtilkOdmol

2014-08-03 11:58 . 2014-08-03 11:58        --------        d-----w-        c:\programdata\OxyuNhira

2014-08-03 11:43 . 2014-08-03 11:43        --------        d-----w-        c:\programdata\Logs

2014-08-03 11:43 . 2014-06-10 10:27        17344        ----a-w-        c:\windows\system32\roboot.exe

2014-07-30 18:35 . 2014-07-30 18:35        --------        d-----w-        c:\program files\Mozilla Firefox(23)

2014-07-16 20:32 . 2014-07-17 05:42        46704        ----a-w-        c:\program files\Mozilla Firefox\browser\components\browsercomps.dll

2014-07-16 20:32 . 2014-07-17 05:42        28272        ----a-w-        c:\program files\Mozilla Firefox\plugin-hang-ui.exe

2014-07-16 20:32 . 2014-07-17 05:42        822384        ----a-w-        c:\program files\Mozilla Firefox\icuuc52.dll

2014-07-16 20:32 . 2014-07-17 05:42        1022576        ----a-w-        c:\program files\Mozilla Firefox\icuin52.dll

2014-07-16 20:32 . 2014-07-17 05:42        10594416        ----a-w-        c:\program files\Mozilla Firefox\icudt52.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-07-23 08:52 . 2011-12-28 14:24        231584        ------w-        c:\windows\system32\MpSigStub.exe

2014-07-17 16:16 . 2012-09-18 18:11        699056        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2014-07-17 16:16 . 2012-02-25 22:06        71344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2014-07-03 16:39 . 2013-08-06 20:00        97648        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2014-06-05 11:07 . 2013-08-06 20:00        136216        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2007-03-12 16:59 . 2007-03-12 16:59        299008        ----a-w-        c:\program files\navigram_register.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2014-05-15 12:13        297128        ----a-w-        c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-02-03 943504]

"Browser Infrastructure Helper"="c:\users\Wichsis\AppData\Local\Smartbar\Application\Smartbar.exe" [2013-10-09 20760]

"OxyuNhira"="c:\programdata\OxyuNhira\OxyuNhira.dat" [2014-08-03 254880]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-19 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-19 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-19 145944]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-04-21 7420448]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1049896]

"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2008-12-24 103720]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]

"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]

"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]

"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]

"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-03-12 210216]

"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-02-03 3508624]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-08-15 751184]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

.

c:\users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Printkey2000.lnk - c:\program files\PrintKey2000\Printkey2000.exe [2014-5-11 869376]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork        REG_MULTI_SZ           PLA DPS BFE mpssvc

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-07-18 17:46        1104200        ----a-w-        c:\program files\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-18 21:35]

.

2014-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-18 21:35]

.

2014-08-15 c:\windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job

- c:\windows\system32\msfeedssync.exe [2011-12-28 04:32]

.

2014-08-15 c:\windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job

- c:\windows\system32\msfeedssync.exe [2011-12-28 04:32]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate=02/11/2013&type=hp1000

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN

uSearchAssistant = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000

IE: Free YouTube to MP3 Converter - c:\program files\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default\

FF - prefs.js: browser.startup.homepage - hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate={installDate}&type=hp1000

FF - prefs.js: browser.search.selectedEngine - Web Search

FF - prefs.js: keyword.URL - hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&fr=linkury-tb&installDate={installDate}&type=hp1000&p=

FF - ExtSQL: !HIDDEN! 2012-08-30 22:12; smartwebprinting@hp.com; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

BHO-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)

Toolbar-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)

ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)

HKCU-Run-EtilkOdmol - (no file)

c:\users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Wichsis\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup

AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe

AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe

AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe

AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe

AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe

AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe

AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe

AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe

AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe

AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe

AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe

AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe

AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe

AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe

AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe

AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe

AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe

AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2014-08-15 19:21

Windows 6.0.6001 Service Pack 1 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}]

@DACL=(02 0000)

@="Dropbox Autoplay COM Server"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]

@DACL=(02 0000)

@="Java Plug-in 10.7.2"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}]

@DACL=(02 0000)

@="Java Plug-in 1.7.0_07"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBB}]

@DACL=(02 0000)

@="Java Plug-in 1.7.0_07"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBC}]

@DACL=(02 0000)

@="Java Plug-in 1.7.0_07"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA}]

@DACL=(02 0000)

@="Java Plug-in 1.7.0"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

@DACL=(02 0000)

@="Java Plug-in 10.7.2"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

@DACL=(02 0000)

@="DropboxExt"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

@DACL=(02 0000)

@="DropboxExt"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

@DACL=(02 0000)

@="DropboxExt"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

@DACL=(02 0000)

@="DropboxExt"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]

@DACL=(02 0000)

@="DropboxExt"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]

@DACL=(02 0000)

@="DropboxExt"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]

@DACL=(02 0000)

@="DropboxExt"

.

[HKEY_USERS\S-1-5-21-3121953689-2843351358-1462341086-1004_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]

@DACL=(02 0000)

@="DropboxExt"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Zeit der Fertigstellung: 2014-08-15  19:23:51

ComboFix-quarantined-files.txt  2014-08-15 17:23

.

Vor Suchlauf: 3.493.724.160 Bytes frei

Nach Suchlauf: 6.464.237.568 Bytes frei

.

- - End Of File - - 99F5CE7D08D62FE176EC203D0E658832

61A349592C4728853F4A90FF78F7628E

Gut...:daumenhoc

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2

http://filepony.de/icon/malwarebytes_anti_malware.png Malwarebytes Antimalware

Download-Link
Installiere das Programm in den vorgegebenen Pfad.
Starte Malwarebytes' Anti-Malware (MBAM).
Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten".
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...)
Poste mir den Inhalt der Logdatei (geht so...). Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread.

Schritt 3

http://filepony.de/icon/frst.png http://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut (mit Administrator-Rechte), und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

Hier schon mal die AdwCleaner-Datei

Code:

# AdwCleaner v3.305 - Bericht erstellt am 15/08/2014 um 19:46:03

# Aktualisiert 14/08/2014 von Xplode

# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 1 (32 bits)

# Benutzername : Wichsis - KATHARINA

# Gestartet von : C:\Users\Kathi\Downloads\adwcleaner_3.305.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\Tarma Installer

Ordner Gelöscht : C:\Users\Kathi\AppData\LocalLow\Smartbar

Ordner Gelöscht : C:\Users\Kathi\AppData\LocalLow\Softonic

Ordner Gelöscht : C:\Users\Wichsis\AppData\Local\Smartbar

Ordner Gelöscht : C:\Users\Wichsis\AppData\LocalLow\Smartbar

Ordner Gelöscht : C:\Users\Wichsis\AppData\LocalLow\Softonic

Ordner Gelöscht : C:\Users\Wichsis\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Wichsis\AppData\Roaming\OpenCandy

Datei Gelöscht : C:\Windows\system32\roboot.exe
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 

Verknüpfung Desinfiziert : C:\Users\Wichsis\Desktop\Search.lnk

Verknüpfung Desinfiziert : C:\Users\Wichsis\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Search.lnk
 

***** [ Registrierungsdatenbank ] *****
 

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\smartbarbackup

Schlüssel Gelöscht : HKCU\Software\smartbarlog

Schlüssel Gelöscht : HKLM\Software\Uniblue

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4
 

***** [ Browser ] *****
 

-\\ Internet Explorer v8.0.6001.19088
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
 

-\\ Mozilla Firefox v31.0 (x86 de)
 

[ Datei : C:\Users\Kathi\AppData\Roaming\Mozilla\Firefox\Profiles\xd1mt82e.default\prefs.js ]
 
 

[ Datei : C:\Users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default\prefs.js ]
 

Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=nt&fr=linkury-tb&installDate={installDate}&type=[...]

Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search");

Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate={installDate}[...]

Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&fr=linkury-tb&installDate={installDate}&type=hp1000&[...]
 

-\\ Google Chrome v36.0.1985.125
 

[ Datei : C:\Users\Kathi\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [8171 octets] - [15/08/2014 19:44:39]

AdwCleaner[S0].txt - [6714 octets] - [15/08/2014 19:46:03]
 

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [6774 octets] ##########

Malwarebytes:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 15.08.2014

Suchlauf-Zeit: 20:02:33

Logdatei: 

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.08.15.09

Rootkit Datenbank: v2014.08.04.01

Lizenz: Testversion

Malware Schutz: Aktiviert

Bösartiger Webseiten Schutz: Aktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows Vista Service Pack 1

CPU: x86

Dateisystem: NTFS

Benutzer: Wichsis
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 316969

Verstrichene Zeit: 14 Min, 48 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Aktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 8

PUP.Optional.Snapdo.T, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [5246447e86f5f14519905d4a33cf6d93], 

PUP.Optional.QuickShare.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}, In Quarantäne, [afe9b60c4338b185c2fd5c479c667c84], 

PUP.Optional.QuickShare.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}, In Quarantäne, [afe9b60c4338b185c2fd5c479c667c84], 

PUP.Optional.Softonic.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, In Quarantäne, [acecead8ccaf82b4ac312a4328da946c], 

PUP.Optional.Softonic.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, In Quarantäne, [acecead8ccaf82b4ac312a4328da946c], 

PUP.Optional.Softonic.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, In Quarantäne, [5642447e76051e18a6380865b64c867a], 

PUP.Optional.Softonic.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, In Quarantäne, [5642447e76051e18a6380865b64c867a], 

PUP.Optional.Softonic.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Softonic, In Quarantäne, [791f5b67ed8ebe787406619db949629e], 
 

Registrierungswerte: 1

Spyware.Password, HKU\S-1-5-21-3121953689-2843351358-1462341086-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|OxyuNhira, regsvr32.exe "C:\ProgramData\OxyuNhira\OxyuNhira.dat", Löschen bei Neustart, [7226556d453674c2de95aafe2bd644bc]
 

Registrierungsdaten: 6

PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[b9dfcdf5fa81df578c9c4e7a25dfe61a]

PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=hp&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[613751712b501a1ca48511b722e218e8]

PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[a0f89d25512a211526017850b450e41c]

PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[9ff9952d8eedd85e31f96761917334cc]

PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[6632388a0e6d023427048e3aaf5512ee]

PUP.Optional.HelperBar.A, HKU\S-1-5-21-3121953689-2843351358-1462341086-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b3b97fe1-733e-c16a-594c-aecc25092492&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=02/11/2013&type=hp1000),Ersetzt,[10889230354660d6c75f08c0887cde22]
 

Ordner: 0

(No malicious items detected)
 

Dateien: 2

Spyware.Password, C:\ProgramData\OxyuNhira\OxyuNhira.dat, In Quarantäne, [7226556d453674c2de95aafe2bd644bc], 

PUP.Optional.SmartBar, C:\Windows\Installer\4a570b.msi, In Quarantäne, [c1d7d6ec265584b23d0745e98e728f71], 
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

Und hier die FRST-Logdatei:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-08-2014

Ran by Wichsis (administrator) on KATHARINA on 15-08-2014 20:30:09

Running from C:\Users\Kathi\Downloads

Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

() C:\Program Files\CyberLink\Shared files\RichVideo.exe

(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe

(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

() C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Microsoft Corporation) C:\Windows\System32\wuauclt.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\ielowutil.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe

(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Windows\System32\conime.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION

HKU\S-1-5-21-3121953689-2843351358-1462341086-1000\...\Run: [KiesHelper] => C:\Program Files\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)

HKU\S-1-5-21-3121953689-2843351358-1462341086-1000\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\system32\Macromed\Flash\FlashUtil32_14_0_0_145_Plugin.exe [851632 2014-07-17] (Adobe Systems Incorporated)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk

ShortcutTarget: Printkey2000.lnk -> C:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software)

Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN

BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-10-23]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-12-28]

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012-08-30]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-11-02]
 

Chrome: 

=======

CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx []
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-15] (Avira Operations GmbH & Co. KG)

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]

R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-25] ()

R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)

S2 APNMCP; "C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)

R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-15] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)

U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)

S3 catchme; \??\C:\Users\Wichsis\AppData\Local\Temp\catchme.sys [X]

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-15 20:00 - 2014-08-15 20:27 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-08-15 19:59 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-08-15 19:59 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-08-15 19:59 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-15 19:46 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll

2014-08-15 19:44 - 2014-08-15 19:46 - 00000000 ____D () C:\AdwCleaner

2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe

2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt

2014-08-15 19:11 - 2014-08-15 19:23 - 00000000 ____D () C:\ComboFix

2014-08-15 19:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-08-15 19:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-08-15 19:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-08-15 19:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-08-15 19:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-08-15 19:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-08-15 19:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-08-15 19:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-08-15 19:10 - 2014-08-15 19:23 - 00000000 ____D () C:\Qoobox

2014-08-15 19:10 - 2014-08-15 19:21 - 00000000 ____D () C:\Windows\erdnt

2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe

2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt

2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt

2014-08-15 17:39 - 2014-08-15 20:30 - 00013560 _____ () C:\Users\Kathi\Downloads\FRST.txt

2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt

2014-08-15 17:38 - 2014-08-15 20:30 - 00000000 ____D () C:\FRST

2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Kathi\Downloads\FRST.exe

2014-08-12 20:43 - 2014-08-12 20:50 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe

2014-08-12 20:42 - 2014-08-12 20:49 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe

2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com

2014-08-03 13:58 - 2014-08-15 20:19 - 00000000 ____D () C:\ProgramData\OxyuNhira

2014-08-03 13:58 - 2014-08-03 13:59 - 00000000 ____D () C:\ProgramData\EtilkOdmol

2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)

2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-15 20:30 - 2014-08-15 17:39 - 00013560 _____ () C:\Users\Kathi\Downloads\FRST.txt

2014-08-15 20:30 - 2014-08-15 17:38 - 00000000 ____D () C:\FRST

2014-08-15 20:28 - 2009-08-11 21:16 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job

2014-08-15 20:28 - 2009-07-21 20:26 - 01284970 _____ () C:\Windows\WindowsUpdate.log

2014-08-15 20:27 - 2014-08-15 20:00 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-15 20:27 - 2012-08-18 23:35 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-08-15 20:27 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite

2014-08-15 20:21 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite

2014-08-15 20:20 - 2008-01-21 05:02 - 00744618 _____ () C:\Windows\PFRO.log

2014-08-15 20:20 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-15 20:20 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-15 20:20 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-15 20:19 - 2014-08-03 13:58 - 00000000 ____D () C:\ProgramData\OxyuNhira

2014-08-15 20:19 - 2006-11-02 14:58 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-08-15 20:19 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Speech

2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-15 19:46 - 2014-08-15 19:44 - 00000000 ____D () C:\AdwCleaner

2014-08-15 19:46 - 2013-11-02 23:21 - 00000846 _____ () C:\Users\Wichsis\Desktop\Search.lnk

2014-08-15 19:46 - 2012-08-18 23:35 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe

2014-08-15 19:27 - 2014-04-27 21:32 - 00000000 ___RD () C:\Users\Kathi\Dropbox

2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt

2014-08-15 19:23 - 2014-08-15 19:11 - 00000000 ____D () C:\ComboFix

2014-08-15 19:23 - 2014-08-15 19:10 - 00000000 ____D () C:\Qoobox

2014-08-15 19:23 - 2009-08-11 03:13 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Google

2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default

2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public

2014-08-15 19:21 - 2014-08-15 19:10 - 00000000 ____D () C:\Windows\erdnt

2014-08-15 19:21 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini

2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe

2014-08-15 18:45 - 2009-08-11 02:42 - 00106960 _____ () C:\Users\Wichsis\AppData\Local\GDIPFONTCACHEV1.DAT

2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt

2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt

2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt

2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Kathi\Downloads\FRST.exe

2014-08-15 17:34 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Dropbox

2014-08-15 17:08 - 2013-06-30 22:48 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job

2014-08-12 23:00 - 2014-06-16 11:05 - 00015080 _____ () C:\Users\Kathi\Desktop\Hochzeitsgeschenke.xlsx

2014-08-12 20:50 - 2014-08-12 20:43 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe

2014-08-12 20:49 - 2014-08-12 20:42 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe

2014-08-11 23:09 - 2014-06-16 23:09 - 00018357 _____ () C:\Users\Kathi\Desktop\malediven.xlsx

2014-08-11 23:06 - 2014-06-15 16:51 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit - Standesamt

2014-08-11 22:08 - 2014-02-16 18:46 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit

2014-08-10 14:08 - 2012-01-02 21:32 - 00000000 ____D () C:\Users\Kathi\Documents\Passwörter

2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com

2014-08-04 21:06 - 2012-05-15 18:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-08-03 23:26 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi

2014-08-03 23:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis

2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool

2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc

2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration

2014-08-03 23:26 - 2006-11-02 12:22 - 37748736 _____ () C:\Windows\system32\config\software_previous

2014-08-03 23:26 - 2006-11-02 12:22 - 17301504 _____ () C:\Windows\system32\config\system_previous

2014-08-03 23:23 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous

2014-08-03 23:23 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous

2014-08-03 14:10 - 2012-10-23 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-08-03 14:10 - 2012-05-15 18:16 - 00000858 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-08-03 14:10 - 2012-05-15 18:16 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-08-03 13:59 - 2014-08-03 13:58 - 00000000 ____D () C:\ProgramData\EtilkOdmol

2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous

2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous

2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)

2014-07-23 10:52 - 2011-12-28 16:24 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-07-22 21:04 - 2014-04-27 21:32 - 00000919 _____ () C:\Users\Kathi\Desktop\Dropbox.lnk

2014-07-22 21:04 - 2014-04-27 21:31 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-07-18 23:55 - 2006-11-02 12:33 - 01566246 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-18 19:59 - 2006-11-02 14:49 - 00149220 _____ () C:\Windows\setupact.log

2014-07-18 19:54 - 2012-09-18 20:12 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-07-17 18:58 - 2012-03-23 19:56 - 00000000 ____D () C:\ProgramData\tmp

2014-07-17 18:17 - 2009-08-11 02:37 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Adobe

2014-07-17 18:16 - 2012-09-18 20:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-07-17 18:16 - 2012-02-26 00:06 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls

2014-07-16 17:50 - 2013-08-16 18:35 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-16 17:42 - 2006-11-02 12:24 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
 

Some content of TEMP:

====================

C:\Users\Kathi\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpq754wn.dll

C:\Users\Wichsis\AppData\Local\temp\catchme.dll

C:\Users\Wichsis\AppData\Local\temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-08-15 20:28
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Gut....

Versuchen wir den Fix nochmal (als Admin) ;)

Schritt 1

http://filepony.de/icon/frst.png http://deeprybka.trojaner-board.de/b...st/frstfix.png

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:

Code:

2014-08-03 13:58 - 2014-08-15 20:19 - 00000000 ____D () C:\ProgramData\OxyuNhira

2014-08-03 13:58 - 2014-08-03 13:59 - 00000000 ____D () C:\ProgramData\EtilkOdmol

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION

EmptyTemp:

Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.

Starte FRST und drücke auf den Fix-Button.
Das Tool erstellt eine "Fixlog.txt" -Datei.
Poste mir bitte deren Inhalt.

Der PC startet neu und dann machste bitte gleich nochmal nen Scan mit FRST. :)

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:15-08-2014

Ran by Wichsis at 2014-08-15 20:45:57 Run:2

Running from C:\Users\Wichsis\Desktop

Boot Mode: Normal
 

==============================================
 

Content of fixlist:

*****************

2014-08-03 13:58 - 2014-08-15 20:19 - 00000000 ____D () C:\ProgramData\OxyuNhira

2014-08-03 13:58 - 2014-08-03 13:59 - 00000000 ____D () C:\ProgramData\EtilkOdmol

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION

EmptyTemp:

*****************
 

C:\ProgramData\OxyuNhira => Moved successfully.

C:\ProgramData\EtilkOdmol => Moved successfully.

HKLM => Group Policy Restriction on software restored successfully.

HKLM => Group Policy Restriction on software restored successfully.

HKLM => Group Policy Restriction on software restored successfully.

EmptyTemp: => Removed 357 MB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog ====

Und hier das Scan-Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-08-2014

Ran by Wichsis (administrator) on KATHARINA on 15-08-2014 20:54:13

Running from C:\Users\Wichsis\Desktop

Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

() C:\Program Files\CyberLink\Shared files\RichVideo.exe

(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe

(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

() C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avira_de____fm.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

(Microsoft Corporation) C:\Windows\System32\wuauclt.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKU\S-1-5-21-3121953689-2843351358-1462341086-1000\...\Run: [KiesHelper] => C:\Program Files\Samsung\Kies\KiesHelper.exe [943504 2012-02-03] (Samsung)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk

ShortcutTarget: Printkey2000.lnk -> C:\Program Files\PrintKey2000\Printkey2000.exe (Fred's Software)

Startup: C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN

BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Wichsis\AppData\Roaming\Mozilla\Firefox\Profiles\an2mua9h.default

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-10-23]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-12-28]

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012-08-30]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-11-02]
 

Chrome: 

=======

CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx []
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-15] (Avira Operations GmbH & Co. KG)

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]

R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-25] ()

R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)

S2 APNMCP; "C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-03] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)

R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-15] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)

U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)

S3 catchme; \??\C:\Users\Wichsis\AppData\Local\Temp\catchme.sys [X]

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-15 20:54 - 2014-08-15 20:54 - 00012926 _____ () C:\Users\Wichsis\Desktop\FRST.txt

2014-08-15 20:00 - 2014-08-15 20:51 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-08-15 19:59 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-08-15 19:59 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-08-15 19:59 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-15 19:46 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll

2014-08-15 19:44 - 2014-08-15 19:46 - 00000000 ____D () C:\AdwCleaner

2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe

2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt

2014-08-15 19:11 - 2014-08-15 19:23 - 00000000 ____D () C:\ComboFix

2014-08-15 19:11 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-08-15 19:11 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-08-15 19:11 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-08-15 19:11 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-08-15 19:11 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-08-15 19:11 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-08-15 19:11 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-08-15 19:11 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-08-15 19:10 - 2014-08-15 19:23 - 00000000 ____D () C:\Qoobox

2014-08-15 19:10 - 2014-08-15 19:21 - 00000000 ____D () C:\Windows\erdnt

2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe

2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt

2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt

2014-08-15 17:39 - 2014-08-15 20:30 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt

2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt

2014-08-15 17:38 - 2014-08-15 20:54 - 00000000 ____D () C:\FRST

2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe

2014-08-12 20:43 - 2014-08-12 20:50 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe

2014-08-12 20:42 - 2014-08-12 20:49 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe

2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com

2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)

2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-15 20:54 - 2014-08-15 20:54 - 00012926 _____ () C:\Users\Wichsis\Desktop\FRST.txt

2014-08-15 20:54 - 2014-08-15 17:38 - 00000000 ____D () C:\FRST

2014-08-15 20:53 - 2009-08-11 21:16 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{7030CE83-CC54-445E-964F-73E63606DF74}.job

2014-08-15 20:53 - 2009-07-21 20:26 - 01294441 _____ () C:\Windows\WindowsUpdate.log

2014-08-15 20:51 - 2014-08-15 20:00 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-15 20:51 - 2012-08-18 23:35 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-08-15 20:51 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite

2014-08-15 20:49 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite

2014-08-15 20:48 - 2008-01-21 05:02 - 00745920 _____ () C:\Windows\PFRO.log

2014-08-15 20:48 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-15 20:48 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-15 20:48 - 2006-11-02 14:45 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-15 20:47 - 2006-11-02 14:58 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-08-15 20:46 - 2012-08-18 23:35 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-08-15 20:30 - 2014-08-15 17:39 - 00026282 _____ () C:\Users\Kathi\Downloads\FRST.txt

2014-08-15 20:19 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Speech

2014-08-15 19:59 - 2014-08-15 19:59 - 00000899 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-15 19:59 - 2014-08-15 19:59 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-08-15 19:58 - 2014-08-15 19:58 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Kathi\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-15 19:46 - 2014-08-15 19:44 - 00000000 ____D () C:\AdwCleaner

2014-08-15 19:46 - 2013-11-02 23:21 - 00000846 _____ () C:\Users\Wichsis\Desktop\Search.lnk

2014-08-15 19:42 - 2014-08-15 19:42 - 01356107 _____ () C:\Users\Kathi\Downloads\adwcleaner_3.305.exe

2014-08-15 19:27 - 2014-04-27 21:32 - 00000000 ___RD () C:\Users\Kathi\Dropbox

2014-08-15 19:23 - 2014-08-15 19:23 - 00017045 _____ () C:\ComboFix.txt

2014-08-15 19:23 - 2014-08-15 19:11 - 00000000 ____D () C:\ComboFix

2014-08-15 19:23 - 2014-08-15 19:10 - 00000000 ____D () C:\Qoobox

2014-08-15 19:23 - 2009-08-11 03:13 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Google

2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default

2014-08-15 19:23 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public

2014-08-15 19:21 - 2014-08-15 19:10 - 00000000 ____D () C:\Windows\erdnt

2014-08-15 19:21 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini

2014-08-15 19:07 - 2014-08-15 19:07 - 05571320 ____R (Swearware) C:\Users\Kathi\Desktop\ComboFix.exe

2014-08-15 18:45 - 2009-08-11 02:42 - 00106960 _____ () C:\Users\Wichsis\AppData\Local\GDIPFONTCACHEV1.DAT

2014-08-15 17:40 - 2014-08-15 17:40 - 00025127 _____ () C:\Users\Kathi\Desktop\FRST.txt

2014-08-15 17:40 - 2014-08-15 17:40 - 00022313 _____ () C:\Users\Kathi\Desktop\Addition.txt

2014-08-15 17:39 - 2014-08-15 17:39 - 00022313 _____ () C:\Users\Kathi\Downloads\Addition.txt

2014-08-15 17:37 - 2014-08-15 17:37 - 01092096 _____ (Farbar) C:\Users\Wichsis\Desktop\FRST.exe

2014-08-15 17:34 - 2014-04-27 21:29 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Dropbox

2014-08-15 17:08 - 2013-06-30 22:48 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{DC24E08D-D800-4C9D-9DE2-5FF59CBB27E4}.job

2014-08-12 23:00 - 2014-06-16 11:05 - 00015080 _____ () C:\Users\Kathi\Desktop\Hochzeitsgeschenke.xlsx

2014-08-12 20:50 - 2014-08-12 20:43 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de(1).exe

2014-08-12 20:49 - 2014-08-12 20:42 - 151513264 _____ () C:\Users\Kathi\Downloads\avira_free_antivirus06_de.exe

2014-08-11 23:09 - 2014-06-16 23:09 - 00018357 _____ () C:\Users\Kathi\Desktop\malediven.xlsx

2014-08-11 23:06 - 2014-06-15 16:51 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit - Standesamt

2014-08-11 22:08 - 2014-02-16 18:46 - 00000000 ____D () C:\Users\Kathi\Desktop\Hochzeit

2014-08-10 14:08 - 2012-01-02 21:32 - 00000000 ____D () C:\Users\Kathi\Documents\Passwörter

2014-08-04 21:09 - 2014-08-04 21:09 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\dll-files.com

2014-08-04 21:06 - 2012-05-15 18:16 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-08-03 23:26 - 2011-12-28 18:30 - 00000000 ____D () C:\Users\Kathi

2014-08-03 23:26 - 2009-08-11 02:35 - 00000000 ____D () C:\Users\Wichsis

2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool

2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc

2014-08-03 23:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration

2014-08-03 23:26 - 2006-11-02 12:22 - 37748736 _____ () C:\Windows\system32\config\software_previous

2014-08-03 23:26 - 2006-11-02 12:22 - 17301504 _____ () C:\Windows\system32\config\system_previous

2014-08-03 23:23 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous

2014-08-03 23:23 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous

2014-08-03 14:10 - 2012-10-23 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-08-03 14:10 - 2012-05-15 18:16 - 00000858 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-08-03 14:10 - 2012-05-15 18:16 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous

2014-08-03 00:01 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous

2014-07-30 20:35 - 2014-07-30 20:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox(23)

2014-07-23 10:52 - 2011-12-28 16:24 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-07-22 21:04 - 2014-04-27 21:32 - 00000919 _____ () C:\Users\Kathi\Desktop\Dropbox.lnk

2014-07-22 21:04 - 2014-04-27 21:31 - 00000000 ____D () C:\Users\Kathi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-07-18 23:55 - 2006-11-02 12:33 - 01566246 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-18 19:59 - 2006-11-02 14:49 - 00149220 _____ () C:\Windows\setupact.log

2014-07-18 19:54 - 2012-09-18 20:12 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-07-17 18:58 - 2012-03-23 19:56 - 00000000 ____D () C:\ProgramData\tmp

2014-07-17 18:17 - 2009-08-11 02:37 - 00000000 ____D () C:\Users\Wichsis\AppData\Local\Adobe

2014-07-17 18:16 - 2012-09-18 20:11 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-07-17 18:16 - 2012-02-26 00:06 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-07-16 21:52 - 2014-07-16 21:52 - 00039424 _____ () C:\Users\Kathi\Desktop\Ablauf Kirche.xls

2014-07-16 17:50 - 2013-08-16 18:35 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-16 17:42 - 2006-11-02 12:24 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
 

Some content of TEMP:

====================

C:\Users\Wichsis\AppData\Local\temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-08-15 20:28
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Ja, ja das hast mich vorhin mit dem Benutzerkonto reingelegt was... ;)

So, jetzt noch etwas was den Abend versüßt... :D

(Der Scan dauert laaaang!)

Schritt 1

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 2
Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

Ich habe gerade gemerkt, dass ich vergessen hatte, Avira und die Firewall zu deaktivieren.
Das habe ich jetzt nachgeholt. Bislang sind 37 % gescannt und es wurden auch schon 77 infizierte Dateien gefunden :-(

Soll ich das jetzt weiterlaufen lassen oder nochmal von vorne, da die ganze Zeit Avira und Firewall aktiv waren?