Hallo Timo,
ich konnte leider erst heute wieder arbeiten...
Hier das Ergebnis des Junkware Removel Tools:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.9 (11.15.2014:2)
OS: Microsoft Windows XP x86
Ran by gabi on 17.11.2014 at 14:06:29,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL
~~~ Registry Keys
~~~ Files
Successfully deleted: [File] "C:\WINDOWS\wininit.ini"
~~~ Folders
~~~ FireFox
Successfully deleted the following from C:\Dokumente und Einstellungen\gabi\Anwendungsdaten\mozilla\firefox\profiles\099mirur.default\prefs.js
user_pref("google.toolbar.button_option.cached.gtbSearchBlogs", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchBlogs\" t
user_pref("google.toolbar.button_option.cached.gtbSearchPhotos", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchPhotos\"
user_pref("google.toolbar.button_option.cached.gtbSearchScholar", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchScholar
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_CTK0Y7F4MTG6NKYH03WT-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o
user_pref("google.toolbar.search-icon", "data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7PT7/3zF6/9Ptu//RbHx/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 17.11.2014 at 14:15:06,07
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Hallo Timo,
darf ich meine Schutzsoftware wieder aktivieren?
Gruss
Gabi
Hallo Timo,
hier das Ergebnis von mbam...
Malwarebytes Anti-Malware
www.malwarebytes.org
Protection, 17.11.2014 14:26:10, SYSTEM, PC003, Protection, Malware Protection, Starting,
Protection, 17.11.2014 14:26:10, SYSTEM, PC003, Protection, Malware Protection, Started,
Protection, 17.11.2014 14:26:10, SYSTEM, PC003, Protection, Malicious Website Protection, Starting,
Update, 17.11.2014 14:26:13, SYSTEM, PC003, Manual, Rootkit Database, 2014.9.18.1, 2014.11.12.1,
Update, 17.11.2014 14:26:25, SYSTEM, PC003, Manual, Malware Database, 2014.9.19.5, 2014.11.17.3,
Protection, 17.11.2014 14:26:26, SYSTEM, PC003, Protection, Refresh, Starting,
Protection, 17.11.2014 14:26:35, SYSTEM, PC003, Protection, Malicious Website Protection, Started,
Protection, 17.11.2014 14:26:36, SYSTEM, PC003, Protection, Malicious Website Protection, Stopping,
Protection, 17.11.2014 14:26:36, SYSTEM, PC003, Protection, Malicious Website Protection, Stopped,
Protection, 17.11.2014 14:26:53, SYSTEM, PC003, Protection, Refresh, Success,
Protection, 17.11.2014 14:26:53, SYSTEM, PC003, Protection, Malicious Website Protection, Starting,
Protection, 17.11.2014 14:27:28, SYSTEM, PC003, Protection, Malicious Website Protection, Started,
Scan, 17.11.2014 14:52:12, SYSTEM, PC003, Manual, Start: % 1 "% 2", Dauer: % 1 min 24 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 4 Malwareerkennung, 3-Malwareerkennung,
Protection, 17.11.2014 14:52:13, SYSTEM, PC003, Protection, Malicious Website Protection, Stopping,
Protection, 17.11.2014 14:52:13, SYSTEM, PC003, Protection, Malicious Website Protection, Stopped,
Protection, 17.11.2014 14:52:13, SYSTEM, PC003, Protection, Malicious Website Protection, Starting,
Protection, 17.11.2014 14:52:58, SYSTEM, PC003, Protection, Malicious Website Protection, Started,
Protection, 17.11.2014 14:54:49, SYSTEM, PC003, Protection, Malware Protection, Starting,
Protection, 17.11.2014 14:54:49, SYSTEM, PC003, Protection, Malware Protection, Started,
Protection, 17.11.2014 14:54:49, SYSTEM, PC003, Protection, Malicious Website Protection, Starting,
Protection, 17.11.2014 14:56:02, SYSTEM, PC003, Protection, Malicious Website Protection, Started,
(end)
und das ergebnis des von frst:
FRST Logfile:
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-11-2014 03
Ran by gabi (administrator) on PC003 on 17-11-2014 15:04:12
Running from D:\rasselfisch\a_pdf
Loaded Profile: gabi (Available profiles: gabi & Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Acronis) C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
(SingleClick Systems) C:\Programme\Dell Network Assistant\hnm_svc.exe
(Malwarebytes Corporation) C:\Programme\Malwarebytes Anti-Malware\mbamscheduler.exe
(CANON INC.) C:\WINDOWS\system32\CNAB4RPK.EXE
(Citrix Systems, Inc.) C:\Programme\Citrix\ICA Client\ssonsvr.exe
(Malwarebytes Corporation) C:\Programme\Malwarebytes Anti-Malware\mbamservice.exe
(Software 2000 Limited) C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE
(McAfee, Inc.) C:\Programme\Gemeinsame Dateien\McAfee\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Programme\Gemeinsame Dateien\McAfee\Platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
(McAfee, Inc.) C:\WINDOWS\system32\mfevtps.exe
(XIMETA, Inc.) C:\Programme\NDAS\System\ndassvc.exe
(HP) C:\WINDOWS\system32\HPZipm12.exe
(McAfee, Inc.) C:\Programme\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Programme\Gemeinsame Dateien\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\mfefire.exe
(Malwarebytes Corporation) C:\Programme\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe
() C:\Programme\Dell\Media Experience\DMXLauncher.exe
(InstallShield Software Corporation) C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
(Sonic Solutions) C:\WINDOWS\system32\DLA\DLACTRLW.EXE
() C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
(Hewlett-Packard Co.) C:\Programme\HP\HP Software Update\hpwuSchd2.exe
(Acronis) C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis) C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
(Acronis) C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
(Google Inc.) C:\Programme\Picasa2\PicasaMediaDetector.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Hewlett-Packard Co.) C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
(McAfee, Inc.) C:\Programme\McAfee Security Scan\3.8.150\SSScheduler.exe
(XIMETA, Inc.) C:\Programme\NDAS\System\ndasmgmt.exe
(McAfee, Inc.) C:\Programme\Gemeinsame Dateien\McAfee\Platform\McUICnt.exe
() C:\Programme\Google\Google Desktop Search\GoogleDesktopIndex.exe
() C:\Programme\Google\Google Desktop Search\GoogleDesktopDisplay.exe
(Hewlett-Packard Co.) C:\Programme\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
(Dropbox, Inc.) C:\Dokumente und Einstellungen\gabi\Anwendungsdaten\Dropbox\bin\Dropbox.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [DMXLauncher] => C:\Programme\Dell\Media Experience\DMXLauncher.exe [94208 2005-10-05] ()
HKLM\...\Run: [ISUSPM Startup] => C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\isuspm.exe [249856 2005-06-10] (InstallShield Software Corporation)
HKLM\...\Run: [ISUSScheduler] => C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe [81920 2005-06-10] (InstallShield Software Corporation)
HKLM\...\Run: [DLA] => C:\WINDOWS\System32\DLA\DLACTRLW.EXE [122940 2005-09-08] (Sonic Solutions)
HKLM\...\Run: [Google Desktop Search] => C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe [169984 2006-08-29] ()
HKLM\...\Run: [HP Software Update] => C:\Programme\HP\HP Software Update\HPWuSchd2.exe [49152 2005-05-11] (Hewlett-Packard Co.)
HKLM\...\Run: [TrueImageMonitor.exe] => C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe [1176768 2006-09-22] (Acronis)
HKLM\...\Run: [AcronisTimounterMonitor] => C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe [1949912 2006-09-22] (Acronis)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe [82832 2006-09-22] (Acronis)
HKLM\...\Run: [Picasa Media Detector] => C:\Programme\Picasa2\PicasaMediaDetector.exe [366400 2006-12-12] (Google Inc.)
HKLM\...\Run: [Samsung PanelMgr] => C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe [520192 2007-05-30] ()
HKLM\...\Run: [] => [X]
HKLM\...\Run: [mcui_exe] => C:\Programme\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.)
HKLM\...\Run: [igfxhkcmd] => C:\WINDOWS\system32\hkcmd.exe [77824 2005-10-14] (Intel Corporation)
HKLM\...\Run: [igfxpers] => C:\WINDOWS\system32\igfxpers.exe [114688 2005-10-14] (Intel Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [mcpltui_exe] => C:\Programme\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.)
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-4224918936-2246675992-548615425-1006\...\Run: [MSMSGS] => C:\Programme\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-4224918936-2246675992-548615425-1006\...\Run: [updateMgr] => "C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
HKU\S-1-5-21-4224918936-2246675992-548615425-1006\...\Run: [hcjucfuf.exe] => C:\Dokumente und Einstellungen\gabi\Anwendungsdaten\Identities\hcjucfuf.exe [180736 2008-04-14] (Duplexed Lox)
HKU\S-1-5-21-4224918936-2246675992-548615425-1006\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-4224918936-2246675992-548615425-1006\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoControlPanel] 0
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL => C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [111616 2006-08-29] ()
Lsa: [Authentication Packages] msv1_0 relog_ap
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Dell Network Assistant.lnk
ShortcutTarget: Dell Network Assistant.lnk -> (No File)
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Programme\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\TrekStor NDAS-Geräte-Manager.lnk
ShortcutTarget: TrekStor NDAS-Geräte-Manager.lnk -> C:\Programme\NDAS\System\ndasmgmt.exe (XIMETA, Inc.)
Startup: C:\Dokumente und Einstellungen\gabi\Startmenü\Programme\Autostart\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Dokumente und Einstellungen\gabi\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4224918936-2246675992-548615425-1006\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4224918936-2246675992-548615425-1006\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKU\S-1-5-21-4224918936-2246675992-548615425-1006\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - DefaultScope {7C398219-0018-4A01-AF22-DCCE40C03297} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE739D20140113&p={SearchTerms}
SearchScopes: HKCU - {4B2B281D-39E9-40BE-82FA-EA3AB445A370} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}
SearchScopes: HKCU - {7C398219-0018-4A01-AF22-DCCE40C03297} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE739D20140113&p={SearchTerms}
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Programme\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: McAfee Phishing Filter -> {27B4851A-3207-45A2-B947-BE8AFE6163AB} -> c:\progra~1\mcafee\msk\mskapbho.dll No File
BHO: DriveLetterAccess -> {5CA3D70E-1895-11CF-8E15-001234567890} -> C:\WINDOWS\System32\DLA\DLASHX_W.DLL (Sonic Solutions)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO: CBrowserHelperObject Object -> {CA6319C0-31B7-401E-A518-A07C3DB8F777} -> C:\Programme\BAE\BAE.dll (Dell Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKU\S-1-5-21-4224918936-2246675992-548615425-1006 -> &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-4224918936-2246675992-548615425-1006 -> &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-4224918936-2246675992-548615425-1006 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1357665689101
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Filter: application/x-internet-signup - {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Programme\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\gabi\Anwendungsdaten\Mozilla\Firefox\Profiles\099mirur.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Programme\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Programme\mozilla firefox\plugins\NPMGWRAP.DLL (Network Associates Inc)
FF Plugin ProgramFiles/Appdata: C:\Programme\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Programme\mozilla firefox\browser\plugins\ieatgpc.dll (Cisco WebEx LLC)
FF Plugin ProgramFiles/Appdata: C:\Programme\mozilla firefox\browser\plugins\npatgpc.dll (Cisco WebEx LLC)
FF Plugin ProgramFiles/Appdata: C:\Dokumente und Einstellungen\gabi\Anwendungsdaten\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF SearchPlugin: C:\Dokumente und Einstellungen\gabi\Anwendungsdaten\Mozilla\Firefox\Profiles\099mirur.default\searchplugins\siteadvisor.xml
FF Extension: United States English Spellchecker - C:\Dokumente und Einstellungen\gabi\Anwendungsdaten\Mozilla\Firefox\Profiles\099mirur.default\Extensions\en-US@dictionaries.addons.mozilla.org [2013-03-24]
FF Extension: Google Toolbar for Firefox - C:\Dokumente und Einstellungen\gabi\Anwendungsdaten\Mozilla\Firefox\Profiles\099mirur.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-06-10]
FF Extension: Google Toolbar for Firefox - C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2014-11-11]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-10-18]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Programme\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Programme\McAfee\SiteAdvisor [2014-01-13]
FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Programme\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Programme\McAfee\MSK [2014-01-13]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Programme\McAfee\SiteAdvisor\McChPlg.crx [2014-01-13]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AcrSch2Svc; C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe [226192 2006-09-22] (Acronis) [File not signed]
S3 gusvc; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [135608 2006-12-04] (Google)
R2 hnmsvc; C:\Programme\Dell Network Assistant\hnm_svc.exe [111912 2007-08-27] (SingleClick Systems)
R2 HomeNetSvc; C:\Programme\Gemeinsame Dateien\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 MBAMScheduler; C:\Programme\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Programme\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
R2 McAfee SiteAdvisor Service; C:\Programme\Gemeinsame Dateien\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.)
R2 McAPExe; C:\Programme\McAfee\MSC\McAPExe.exe [145568 2014-04-25] (McAfee, Inc.)
U2 mcbootdelaystartsvc; C:\Programme\Gemeinsame Dateien\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
S3 McComponentHostService; C:\Programme\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 McMPFSvc; C:\Programme\Gemeinsame Dateien\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Programme\Gemeinsame Dateien\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Programme\McAfee\VirusScan\mcods.exe [472072 2014-09-04] (McAfee, Inc.)
R2 mcpltsvc; C:\Programme\Gemeinsame Dateien\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Programme\Gemeinsame Dateien\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 MDM; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [322120 2003-06-19] (Microsoft Corporation)
R2 mfecore; C:\Programme\Gemeinsame Dateien\McAfee\AMCore\mcshield.exe [655936 2014-08-20] (McAfee, Inc.)
R2 mfefire; C:\Programme\Gemeinsame Dateien\McAfee\SystemCore\\mfefire.exe [169800 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\WINDOWS\system32\mfevtps.exe [179600 2014-06-20] (McAfee, Inc.)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [114288 2014-11-11] (Mozilla Foundation)
R2 MSK80Service; C:\Programme\Gemeinsame Dateien\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 ndassvc; C:\Programme\NDAS\System\ndassvc.exe [304640 2006-03-20] (XIMETA, Inc.) [File not signed]
S3 NetSvc; C:\Programme\Intel\PROSetWired\NCS\Sync\NetSvc.exe [147456 2004-11-19] (Intel(R) Corporation) [File not signed]
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
R2 Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [69632 2004-09-29] (HP) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S4 abp480n5; C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS [23552 2003-04-02] (Microsoft Corporation)
R3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [62832 2014-06-20] (McAfee, Inc.)
S2 DgiVecp; C:\WINDOWS\system32\Drivers\DgiVecp.sys [41984 2006-06-12] (Samsung Electronics Co., Ltd.) [File not signed]
R2 DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [25628 2005-09-08] (Sonic Solutions) [File not signed]
R1 DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [5628 2005-08-25] (Sonic Solutions) [File not signed]
R2 DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2496 2005-09-08] (Sonic Solutions) [File not signed]
R2 DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [86524 2005-09-08] (Sonic Solutions) [File not signed]
R2 DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [14684 2005-09-08] (Sonic Solutions) [File not signed]
R2 DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [6364 2005-09-08] (Sonic Solutions) [File not signed]
R1 DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [22684 2005-08-25] (Sonic Solutions) [File not signed]
R2 DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [94332 2005-09-08] (Sonic Solutions) [File not signed]
R2 DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [87036 2005-09-08] (Sonic Solutions) [File not signed]
R0 DRVMCDB; C:\WINDOWS\System32\Drivers\DRVMCDB.SYS [89264 2005-09-12] (Sonic Solutions) [File not signed]
R2 DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [40544 2005-08-12] (Sonic Solutions) [File not signed]
S3 HipShieldK; C:\WINDOWS\System32\drivers\HipShieldK.sys [147912 2013-09-23] (McAfee, Inc.)
R0 lfsfilt; C:\WINDOWS\System32\DRIVERS\lfsfilt.sys [140160 2006-03-20] (XIMETA, Inc.) [File not signed]
R0 lpx; C:\WINDOWS\System32\DRIVERS\lpx.sys [44288 2006-03-20] (XIMETA, Inc.) [File not signed]
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [114904 2014-11-17] (Malwarebytes Corporation)
R3 mfeapfk; C:\WINDOWS\System32\drivers\mfeapfk.sys [135968 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [238176 2014-06-20] (McAfee, Inc.)
S3 mfebopk; C:\WINDOWS\System32\drivers\mfebopk.sys [67816 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [369248 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [576048 2014-06-20] (McAfee, Inc.)
R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [350240 2014-08-20] (McAfee, Inc.)
S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [81296 2014-08-20] (McAfee, Inc.)
S3 mfendisk; C:\WINDOWS\System32\DRIVERS\mfendisk.sys [87520 2014-06-20] (McAfee, Inc.)
R3 mfendiskmp; C:\WINDOWS\System32\DRIVERS\mfendisk.sys [87520 2014-06-20] (McAfee, Inc.)
R1 mfetdi2k; C:\WINDOWS\System32\drivers\mfetdi2k.sys [93624 2014-06-20] (McAfee, Inc.)
R3 ndasbus; C:\WINDOWS\System32\DRIVERS\ndasbus.sys [59136 2006-03-20] (XIMETA, Inc.) [File not signed]
S3 ndasscsi; C:\WINDOWS\System32\DRIVERS\ndasscsi.sys [115584 2006-03-20] (XIMETA, Inc.) [File not signed]
R2 Packet; C:\WINDOWS\System32\DRIVERS\packet.sys [12672 2006-12-18] (SingleClick Systems) [File not signed]
R0 PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [36560 2006-09-27] (Sonic Solutions) [File not signed]
R0 snapman; C:\WINDOWS\System32\DRIVERS\snapman.sys [107056 2006-11-21] (Acronis) [File not signed]
R3 STHDA; C:\WINDOWS\System32\drivers\sthda.sys [1107224 2006-02-10] (SigmaTel, Inc.)
R2 tifsfilter; C:\WINDOWS\System32\DRIVERS\tifsfilt.sys [33488 2006-11-21] (Acronis) [File not signed]
R0 timounter; C:\WINDOWS\System32\DRIVERS\timntr.sys [397296 2006-11-21] (Acronis) [File not signed]
U0 mfewfpk; No ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
S2 SSPORT; \??\C:\WINDOWS\system32\Drivers\SSPORT.sys [X]
U1 WS2IFSL; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-17 15:00 - 2014-11-17 15:00 - 00002177 _____ () C:\Dokumente und Einstellungen\gabi\Desktop\mbam.txt
2014-11-17 14:59 - 2014-11-17 14:59 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\McAfee
2014-11-17 14:26 - 2014-11-17 14:56 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-11-17 14:25 - 2014-11-17 14:25 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-17 14:25 - 2014-11-17 14:25 - 00000000 ____D () C:\Programme\Malwarebytes Anti-Malware
2014-11-17 14:25 - 2014-11-17 14:25 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes Anti-Malware
2014-11-17 14:25 - 2014-11-17 14:25 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2014-11-17 14:25 - 2014-10-01 11:11 - 00054360 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-11-17 14:25 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-11-17 14:15 - 2014-11-17 14:15 - 00002184 _____ () C:\Dokumente und Einstellungen\gabi\Desktop\JRT.txt
2014-11-14 09:26 - 2014-11-14 09:26 - 00008053 _____ () C:\WINDOWS\system32\hs_err_pid5936.log
2014-11-13 13:07 - 2014-11-13 13:07 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-11-12 12:55 - 2014-11-12 13:10 - 00000000 ____D () C:\AdwCleaner
2014-11-12 08:25 - 2014-11-12 08:25 - 00000253 _____ () C:\Dokumente und Einstellungen\gabi\Desktop\Fixlist.txt
2014-11-11 12:40 - 2014-11-17 15:04 - 00000000 ____D () C:\FRST
2014-11-11 08:35 - 2014-11-11 08:36 - 00000000 ____D () C:\Programme\Mozilla Firefox
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-17 15:04 - 2006-09-07 08:19 - 00000000 ____D () C:\Dokumente und Einstellungen\gabi\Lokale Einstellungen\Temp
2014-11-17 15:02 - 2013-01-09 09:07 - 00000416 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{346AF10A-10C9-4231-BD9F-1AA42B3867E8}.job
2014-11-17 14:59 - 2011-11-16 15:02 - 00000000 ___RD () C:\Dokumente und Einstellungen\gabi\Eigene Dateien\Dropbox
2014-11-17 14:59 - 2011-11-16 14:59 - 00000000 ____D () C:\Dokumente und Einstellungen\gabi\Anwendungsdaten\Dropbox
2014-11-17 14:59 - 2006-09-07 08:19 - 00000000 ___RD () C:\Dokumente und Einstellungen\gabi\Startmenü\Programme\Autostart
2014-11-17 14:59 - 2004-08-13 12:47 - 00000000 ___RD () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2014-11-17 14:58 - 2011-11-16 15:00 - 00000000 ____D () C:\Dokumente und Einstellungen\gabi\Startmenü\Programme\Dropbox
2014-11-17 14:55 - 2014-03-28 08:14 - 00000220 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Benachrichtigung – Anmeldung.job
2014-11-17 14:55 - 2004-08-13 12:53 - 01242158 _____ () C:\WINDOWS\WindowsUpdate.log
2014-11-17 14:55 - 2004-08-13 12:49 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-11-17 14:55 - 2004-08-13 12:49 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-11-17 14:54 - 2004-08-13 12:40 - 00013668 _____ () C:\WINDOWS\system32\wpa.dbl
2014-11-17 14:53 - 2004-08-13 13:00 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-11-17 14:52 - 2013-01-08 18:45 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB975558_WM8$
2014-11-17 14:52 - 2006-09-07 08:19 - 00000300 ___SH () C:\Dokumente und Einstellungen\gabi\ntuser.ini
2014-11-17 14:52 - 2006-09-07 08:19 - 00000000 ____D () C:\Dokumente und Einstellungen\gabi
2014-11-17 14:52 - 2004-08-13 13:00 - 00032544 _____ () C:\WINDOWS\SchedLgU.Txt
2014-11-17 14:51 - 2012-03-30 07:44 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-11-17 14:25 - 2004-08-13 12:47 - 00000000 ___RD () C:\Programme
2014-11-17 08:31 - 2007-07-13 19:34 - 00271360 _____ () C:\Dokumente und Einstellungen\gabi\Eigene Dateien\Persönliche Ordner(1).pst
2014-11-14 11:49 - 2010-04-22 11:06 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun
2014-11-13 08:51 - 2012-03-30 07:44 - 00701104 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2014-11-13 08:51 - 2011-07-07 07:11 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2014-11-13 08:37 - 2013-08-14 17:11 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-11-13 08:23 - 2010-08-30 09:13 - 100445232 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-11-12 08:13 - 2012-04-26 07:18 - 00000000 ____D () C:\Programme\Mozilla Maintenance Service
2014-11-10 11:52 - 2006-09-09 12:40 - 00000056 __RSH () C:\WINDOWS\system32\45FD57CF33.sys
2014-11-10 11:52 - 2006-09-09 12:39 - 00005852 ___SH () C:\WINDOWS\system32\KGyGaAvL.sys
2014-11-10 11:52 - 2006-09-09 12:39 - 00000000 ____D () C:\Dokumente und Einstellungen\gabi\Eigene Dateien\My PSP Files
2014-11-10 08:00 - 2013-03-05 16:07 - 00002249 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\SendBlaster.lnk
2014-11-08 15:00 - 2014-03-28 08:14 - 00000214 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job
2014-11-04 08:40 - 2014-01-27 08:23 - 00334991 _____ () C:\WINDOWS\setupapi.log
2014-11-04 08:38 - 2007-08-27 12:14 - 00000000 ____D () C:\Programme\Gemeinsame Dateien\McAfee
2014-10-27 15:20 - 2006-08-29 14:57 - 00002509 _____ () C:\Dokumente und Einstellungen\gabi\Desktop\Microsoft Office Word 2003.lnk
2014-10-27 09:39 - 2004-08-13 12:47 - 01194742 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
Some content of TEMP:
====================
C:\Dokumente und Einstellungen\gabi\Lokale Einstellungen\Temp\0038541389599583mcinst.exe
C:\Dokumente und Einstellungen\gabi\Lokale Einstellungen\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpiitnwg.dll
C:\Dokumente und Einstellungen\gabi\Lokale Einstellungen\Temp\install_flashplayer12x32au_mssa_awc_aih.exe
C:\Dokumente und Einstellungen\gabi\Lokale Einstellungen\Temp\install_reader10_de_mssa_aih.exe
C:\Dokumente und Einstellungen\gabi\Lokale Einstellungen\Temp\install_reader11_de_mssa_aih.exe
C:\Dokumente und Einstellungen\gabi\Lokale Einstellungen\Temp\Quarantine.exe
C:\Dokumente und Einstellungen\gabi\Lokale Einstellungen\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
--- --- ---
--- --- ---
Hinweis: 
AdwCleaner auf deinen Desktop.
Malwarebytes Anti-Malware 