http://isearch.babylon.com/?affID=113131&
 

Hallo zusammen,

durch google bin ich auf Eure Seite gestoßen und hoffe dass Ihr mir helfen könnt.

Mich hat der

hxxp://isearch.babylon.com/?affID=113131&

erwischt.
Wie bekomme ich ihn wieder los????

Vielen Dank schon einmal.

Hallo ich bin smeenk und ich werde versuchen dir mit deinem Problem zu helfen :)


Systemscan mit ZOEK

Bitte lade die zoek.exe von hier: http://hijackthis.nl/smeenk/

• Bitte deaktiviere während des Scans alle Virenscanner, da sie das Ergebnis beeinflussen.
• Starte die Zoek.exe mit einem Doppelklick (nur Windows XP-Benutzer).
• Windows Vista/7 Benutzer starten das Tool bitte per Rechtsklick auf das Icon und wählen "Als Administrator starten".
• Klicke auf "Options" und wähle die folgenden Optionen aus:
  • Recently Created
  • Startup Information
  • Firefox Look
  • Chrome Look
  • System Restore Point
  • Auto Clean
• Nun klicke auf "Run script" und warte geduldig, bis der Scan durchgelaufen ist.
• Wenn das Tool fertig ist, wird sich Notepad mit dem Logfile öffnen (ggfs. erst nach einem Neustart).
  Nachträglich kannst Du den Bericht unter c:\zoek-results.log einsehen.
• Poste mir das Log File zoek-results.log

Systemscan mit OTL

Lade dir bitte OTL (von Oldtimer) herunter und speichere es auf deinen Desktop.

• Doppelklick auf die OTL.exe.
• Unter Extra Registry, wähle bitte Use SafeList.
• Setze den Haken bei Scan all Users.
• Klicke nun auf Run Scan.
• Wenn der Scan beendet ist, werden 2 Logfiles (OTL.txt und Extras.txt) erstellt.
• Poste den Inhalt dieser Logfiles hier in den Thread.

Bitte poste in deiner nächsten Antwort:

• Log von zoek
• Logs von OTL

Zoek.exe Version 4.0.0.2 Updated 23-04-2013
Tool run by Mela on 26.04.2013 at 18:05:51,16.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected

==== System Restore Info ======================

26.04.2013 18:07:00 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31ad400d-1b06-4e33-a59a-90c2c140cba0} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{31ad400d-1b06-4e33-a59a-90c2c140cba0} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{31ad400d-1b06-4e33-a59a-90c2c140cba0} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\web assistant updater deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\web assistant updater deleted successfully

==== FireFox Fix ======================

ProfilePath: C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default

---- Lines conduit removed from prefs.js ----

user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.sweetim.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"searchfor\",\"search.mywebsearch.com\":\"searchfor\",\"search.mindspark.com\":\"searchfor\",\"search.co nduit.com\":\"q\",\"search.zugo.com\":\"p\",\"www2.mystart.com\":\"q\",\"www.mystart.com\":\"q\",\"www.bigseekpro.com\":\"q\",\"bigseekpro.com\":\"q\" ,\"bigspeedpro.com\":\"q\",\"search.esnips.com\":\"searchQuery\",\"search.foxtab.com\":\"q\",\"search.brothersoft.com\":\"keyword\",\"search.softonic. com\":\"q\",\"www.dogpile.com\":\"q\",\"search.infospace.com\":\"q\",\"search.iobit.com\":\"q\",\"search.iminent.com\":\"\",\"search.facemoods.com\":\ "s\",\"www.plusnetwork.com\":\"q\",\"www.alothome.com\":\"q\",\"alothome.com\":\"q\",\"search.alothome.com\":\"q\",\"search.chatvibes.com\":\"q\",\"se arch.blekko.com\":\"\",\"www.searchnu.com\":\"q\",\"searchnu.com\":\"q\",\"search.icq.com\":\"q\",\"search.etype.com\":\"query\",\"isearch.babylon.com \":\"q\",\"search.utorrent.com\":\"\",\"search.bittorrent.com\":\"\",\"search.bearshare.com\":\"q\",\"search.bearshare.net\":\"q\",\"searchya.com\":\" q\",\"int.search-results.com\":\"q\",\"search.searchcompletion.com\":\"q\",\"www.adoresearch.com\":\"q\",\"www.searchcore.net\":\"q\",\"googosearch.info\":\"terms\",\" bar.searchqu.com\":\"q\",\"search.speedbit.com\":\"q\",\"search.toggle.com\":\"q\",\"click.searchnation.net\":\"query\",\"isearch.whitesmoke.com\":\"q \",\"search.handycafe.com\":\"q\",\"searchassist.babylon.com\":\"q\",\"searchnation.net\":\"query\",\"video.searchcompletion.com\":\"q\",\"www.searchb rowsing.com\":\"q\",\"search.anchorfree.net\":\"q\",\"ag.ru\":\"q\",\"search.hotspotshield.com\":\"q\",\"dts.search-results.com\":\"q\",\"uk.search-results.com\":\"q\",\"search.chatzum.com\":\"q\",\"search.phpnuke.org\":\"q\",\"www.i-mysearch.com\":\"q\",\"search.smartaddressbar.com\":\"q\",\"www.search-guru.com\":\"q\",\"mysearch.sweetim.com\":\"q\",\"searchgby.com\":\"\",\"thespecialsearch.com\":\"q\",\"search.bpath.com\":\"q\",\"start.funmoods.com\ ":\"s\",\"fr.search-results.com\":\"q\",\"de.search-results.com\":\"q\",\"it.search-results.com\":\"q\",\"es.search-results.com\":\"q\",\"search.imesh.com\":\"q\",\"search.swagbucks.com\":\"q\",\"isearch.avg.com\":\"q\",\"search.avg.com\":\"q\",\"search.yippy.com\": \"query\",\"cludr.com\":\"q\",\"search.vmn.net\":\"q\",\"www.gigablast.com\":\"q\",\"www.metacrawler.com\":\"q\",\"www.webcrawler.com\":\"q\",\"www.ix quick.com\":\"\",\"www.search.com\":\"q\",\"www.excite.com\":\"q\",\"duckduckgo.com\":\"q\",\"search.lycos.com\":\"q\",\"webfetch.com\":\"q\",\"monste rcrawler.com\":\"q\",\"go.com\":\"p\",\"hotbot.com\":\"keyword\",\"home.myplaycity.com\":\"s\",\"www.findamo.com\":\"q\",\"search.gboxapp.com\":\"q\", \"start.iplay.com\":\"q\",\"home.speedbit.com\":\"q\",\"home.sweetim.com\":\"q\",\"search.alot.com\":\"q\",\"search.searchplusnetwork.com\":\"q\",\"ww w.searchqu.net\":\"\"}|||8641339235567492");

---- Lines conduit modified from prefs.js ----


---- Lines conduit removed from user.js ----


---- Lines snap.do removed from prefs.js ----

user_pref("browser.newtab.url", "hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=9ee750ce-c67d-499f-9bea-952b6e479ec2&searchtype=nt&installDate={installDate}");
user_pref("keyword.URL", "hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=9ee750ce-c67d-499f-9bea-952b6e479ec2&searchtype=ds&installDate={installDate}&q=");
user_pref("keyword.URL", "hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=9ee750ce-c67d-499f-9bea-952b6e479ec2&searchtype=ds&installDate={installDate}&q=");

---- Lines snap.do modified from prefs.js ----


---- Lines snap.do removed from user.js ----


---- Lines WebSearch removed from prefs.js ----


---- Lines WebSearch modified from prefs.js ----


---- Lines WebSearch removed from user.js ----


---- Lines searchnu removed from prefs.js ----


---- Lines searchnu modified from prefs.js ----


---- Lines searchnu removed from user.js ----


---- Lines babylon removed from prefs.js ----


---- Lines babylon modified from prefs.js ----


---- Lines babylon removed from user.js ----


---- Lines iminent removed from prefs.js ----


---- Lines iminent modified from prefs.js ----


---- Lines iminent removed from user.js ----


---- Lines searchqu removed from prefs.js ----


---- Lines searchqu modified from prefs.js ----


---- Lines searchqu removed from user.js ----


---- Lines ask.com removed from prefs.js ----

user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
user_pref("extensions.wrc.SearchRules.ask.com.url", "^http(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");

---- Lines ask.com modified from prefs.js ----


---- Lines ask.com removed from user.js ----


---- Lines search.com removed from prefs.js ----


---- Lines search.com modified from prefs.js ----


---- Lines search.com removed from user.js ----


---- Lines icq.com removed from prefs.js ----


---- Lines icq.com modified from prefs.js ----


---- Lines icq.com removed from user.js ----


---- Lines Web Search removed from prefs.js ----

user_pref("browser.search.selectedEngine", "Web Search");
user_pref("browser.search.selectedEngine", "Web Search");

---- Lines Web Search modified from prefs.js ----


---- Lines Web Search removed from user.js ----


---- Lines speedbit removed from prefs.js ----


---- Lines speedbit modified from prefs.js ----


---- Lines speedbit removed from user.js ----


---- Lines funmoods removed from prefs.js ----


---- Lines funmoods modified from prefs.js ----


---- Lines funmoods removed from user.js ----


---- Lines etype.com removed from prefs.js ----


---- Lines etype.com modified from prefs.js ----


---- Lines etype.com removed from user.js ----


---- Lines Search-Results removed from prefs.js ----

user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");

---- Lines Search-Results modified from prefs.js ----


---- Lines Search-Results removed from user.js ----


---- Lines helperbar removed from prefs.js ----


---- Lines helperbar modified from prefs.js ----

user_pref("extensions.enabledAddons", "{9ee750ce-c67d-499f-9bea-952b6e479ec2}:1.0,helperbar@helperbar.com:1.0,wrc@avast.com:7.0.1426,{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}:15.0.4,{336D0C35-8A85-403a-B9D2-65C292C39087}:2.0.0.441,{972ce4c6-7e08-4474-a285-3208198ce6fd}:13.0");

---- Lines helperbar removed from user.js ----


---- Lines SweetIM removed from prefs.js ----


---- Lines SweetIM modified from prefs.js ----


---- Lines SweetIM removed from user.js ----


---- FireFox user.js and prefs.js backups ----

user__1811_.backup
prefs__1811_.backup

==== Deleting Files \ Folders ======================

"C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default\searchplugins\Web Search.xml" deleted
"C:\END" deleted
"C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default\searchplugins\Web Search.xml" deleted
"C:\Users\Public\Desktop\YTD Video Downloader.lnk" deleted
"C:\Users\Mela\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\MACTrackBarLib.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Microsoft.Practices.EnterpriseLibrary.Logging.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\ProductsRemovalTool.exe" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\QuickShare.exe" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.GUI.Multimedia.Loader.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.EventManager.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.Base.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.ChromeLocalPlugin.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.DefaultBrowser.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.FireFoxLocalPlugin.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.ShareManagerLocalPlugin.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Personalization.BusinessEntities.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Personalization.BusinessLogic.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Personalization.Settings.UserSettingsManager.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.AutomaticUpdates.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.BrowserHelperUtils.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.ProcessDownMonitor.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductsRemovalLibary.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettings.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettingsAutoUpdater.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.SideBySide.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\Smartbar.Resources.Utilities.dll" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll" deleted
"C:\Users\Mela\AppData\Roaming\Temp" deleted
"C:\Program Files (x86)\facemoods.com" deleted
"C:\Program Files (x86)\IncrediMail_MediaBar_Deutsch_2" deleted
"C:\Program Files (x86)\1ClickDownload" deleted
"C:\Program Files (x86)\Conduit" deleted
"C:\Users\Mela\AppData\Roaming\OCS" not deleted
"C:\Users\Mela\AppData\Roaming\DesktopIconForAmazon" deleted
"C:\Program Files\Web Assistant" deleted
"C:\Users\Mela\AppData\Roaming\YoudaGames" deleted
"C:\Users\Mela\AppData\Roaming\OpenCandy" deleted
"C:\ProgramData\boost_interprocess" deleted
"C:\Users\Mela\AppData\Local\CRE" deleted
"C:\Users\Mela\AppData\Local\PackageAware" deleted
"C:\Users\Mela\AppData\Local\Smartbar" deleted
"C:\Users\Mela\AppData\Local\Conduit" deleted
"C:\Users\Mela\AppData\LocalLow\facemoods.com" deleted
"C:\Users\Mela\AppData\LocalLow\Smartbar" deleted
"C:\Users\Mela\AppData\LocalLow\Conduit" deleted
"C:\Users\Mela\AppData\LocalLow\ConduitEngine" deleted
"C:\Users\Mela\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd" deleted
"C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default\extensions\staged" deleted
"C:\Users\Mela\AppData\Roaming\OCS\SM" not deleted
"C:\Users\Mela\AppData\Roaming\OCS\SM\IO" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application" deleted
"C:\Users\Mela\AppData\Local\Smartbar\Application\de" deleted

==== Files Recently Created / Modified ======================

====== C:\windows ====
====== C:\Users\Mela\AppData\Local\Temp ====
====== C:\windows\SysWOW64 =====
====== C:\windows\SysWOW64\drivers =====
====== C:\windows\Sysnative =====
====== C:\windows\Sysnative\drivers =====
2013-04-24 17:14:14 B98F8C6E31CD07B2E6F71F7F648E38C0 1656680 ----a-w- C:\windows\Sysnative\drivers\ntfs.sys
2013-04-11 14:15:53 8F6322049018354F45F05A2FD2D4E5E0 223752 ----a-w- C:\windows\Sysnative\drivers\fvevol.sys
====== C:\windows\Tasks ======
====== C:\windows\Temp ======
======= C:\Program Files =====
======= C:\Program Files (x86) =====
2013-04-25 19:14:37 -------- d-----w- C:\Program Files (x86)\ESET
2013-04-09 12:53:48 -------- d-----w- C:\Program Files (x86)\MSECache
======= C: =====
====== C:\Users\Mela\AppData\Roaming ======
2013-04-06 12:47:00 -------- d-----w- C:\users\Mela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2013-04-03 12:50:19 -------- d-----w- C:\users\Mela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
====== C:\Users\Mela ======

====== C: exe-files ==
2013-04-25 19:14:41 CE0D0B11986FD2C0247AE88A59B36A6E 579904 ----a-w- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
2013-04-25 19:14:41 BDB7D97012F9B3102DB72AA76A24942A 546944 ----a-w- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
2013-04-25 19:14:41 7C9EEC809FB9CDA26EFC245C001EA980 2347384 ----a-w- C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
2013-04-25 19:14:41 7ABF8849E76732C357F419B1AF5668F2 546944 ----a-w- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScannerA.exe
2013-04-25 19:14:41 6D4ED8A5C071F29730A6F0B943FEEA3A 122584 ----a-w- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe
=== C: other files ==
2013-04-24 17:14:14 B98F8C6E31CD07B2E6F71F7F648E38C0 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden"
"TomTomHOME.exe"="C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
"KiesTrayAgent"="C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe"
"KiesPDLR"="C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe"
"Facebook Update"="C:\Users\Mela\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"
"KiesPreload"="C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload"
@="C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe"
"Browser Infrastructure Helper"="C:\Users\Mela\AppData\Local\Smartbar\Application\QuickShare.exe startup"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun"
"BrMfcWnd"="C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN"
"QLBController"="C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe /start"
"avast"="C:\Program Files\AVAST Software\Avast\avastUI.exe /nogui"
"PDF Complete"="C:\Program Files (x86)\PDF Complete\pdfsty.exe"
"facemoods"="C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\facemoodssrv.exe /md I"
"APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"ControlCenter3"="C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun"
"AgentMonitor"="C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe"
"PDFPrint"="C:\Program Files (x86)\PDF24\pdf24.exe"
"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden"
"TomTomHOME.exe"="C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
"KiesTrayAgent"="C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe"
"KiesPDLR"="C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe"
"Facebook Update"="C:\Users\Mela\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"
"KiesPreload"="C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload"
@="C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe"
"Browser Infrastructure Helper"="C:\Users\Mela\AppData\Local\Smartbar\Application\QuickShare.exe startup"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe /hidden"
"Ocs_SM"="C:\Users\Mela\AppData\Roaming\OCS\SM\SearchAnonymizer.exe"
"SysTrayApp"="C:\Program Files\IDT\WDM\sttray64.exe"
"SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe "

==== Startup Registry Disabled ======================

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run-]
"Google Update"="\"C:\\Users\\Mela\\AppData\\Local\\Google\\Update\\GoogleUpdate.exe\" /c"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]
"Adobe Reader Speed Launcher"="\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Reader_sl.exe\""
"Adobe ARM"="\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""
"TkBellExe"="\"c:\\program files (x86)\\real\\realplayer\\Update\\realsched.exe\" -osboot"
"QuickTime Task"="\"C:\\Program Files (x86)\\QuickTime\\QTTask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files (x86)\\iTunes\\iTunesHelper.exe\""


==== Startup Folders ======================

2012-05-13 19:05:54 1235 ----a-w- C:\users\Mela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
2011-03-24 00:21:11 836 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk

==== Task Scheduler Jobs ======================

C:\windows\tasks\Adobe Flash Player Updater.job --a------ [Undertermined Task]
C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-3329929173-2124052641-421559559-1000Core.job --a------ C:\Users\Mela\AppData\Local\Facebook\Update\FacebookUpdate.exe [26.01.2013 19:27]
C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-3329929173-2124052641-421559559-1000UA.job --a------ [Undertermined Task]
C:\windows\tasks\GoogleUpdateTaskMachineCore.job --a------ [Undertermined Task]
C:\windows\tasks\GoogleUpdateTaskMachineUA.job --a------ [Undertermined Task]
C:\windows\tasks\HPCeeScheduleForMela.job --a------ [Undertermined Task]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default
- DVDVideoSoftTB DE - %ProfilePath%\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
- QuickShare Widget - %ProfilePath%\extensions\{9ee750ce-c67d-499f-9bea-952b6e479ec2}

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default
10737B44923217BC0E67D26A9FC1F0AA - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll - RealNetworks(tm) Chrome Background Extension Plug-In (32-bit)
2645990C521342DCD08963D2DF6CD0D2 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll - RealPlayer(tm) HTML5VideoShim Plug-In (32-bit)


==== Deleting Files \ Folders ======================

"C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default\extensions\{9ee750ce-c67d-499f-9bea-952b6e479ec2}" deleted

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
bhphemoobgnikcoofkgackkaimpfmenm - C:\Users\Mela\AppData\Local\CRE\bhphemoobgnikcoofkgackkaimpfmenm.crx[]
dlnembnfbcpjnepmfjmngjenhhajpdfd - C:\Program Files\Web Assistant\source.crx[]
icmlaeflemplmjndnaapfdbbnpncnbda - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[07.03.2013 01:29]
ihflimipbcaljfnojhhknppphnnciiif - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\facemoods.crx[]
jfmjfhklogoienhpfnppmbcbjfjnkonk - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx[08.05.2012 13:25]
ngnjhfpfhadncgafgbneeljaginimmmk - C:\Users\Mela\AppData\Local\Temp\tbch.crx[]
omaonpoimgkmbllpdihbnmgphjoipdhf - C:\Program Files (x86)\Logitech\Harmony Remote Driver\harmony_chrome.crx[01.05.2012 22:45]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
amfclgbdpgndipgoegfpkkgobahigbcl - C:\Users\Mela\AppData\Local\Smartbar/Application\0Extension.crx[]
bhphemoobgnikcoofkgackkaimpfmenm - C:\Users\Mela\AppData\Local\CRE\bhphemoobgnikcoofkgackkaimpfmenm.crx[]
nikpibnbobmbdbheedjfogjlikpgpnhp - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx[]

Google Docs - Mela - Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - Mela - Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
DVDVideoSoftTB DE - Mela - Default\Extensions\bhphemoobgnikcoofkgackkaimpfmenm
avast WebRep - Mela - Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda
Funmoods - Mela - Default\Extensions\ihflimipbcaljfnojhhknppphnnciiif
RealPlayer HTML5Video Downloader Extension - Mela - Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk
MyHarmony Chrome Plugin - Mela - Default\Extensions\omaonpoimgkmbllpdihbnmgphjoipdhf

==== Chrome Fix ======================

C:\Users\Mela\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhphemoobgnikcoofkgackkaimpfmenm deleted successfully
C:\Users\Mela\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihflimipbcaljfnojhhknppphnnciiif deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://mystart.incredimail.com/?a=1ex65ZZo36P"
"Search Page"="hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=9ee750ce-c67d-499f-9bea-952b6e479ec2&searchtype=ds&q={searchTerms}&installDate={installDate}"
"Search Bar"="hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=9ee750ce-c67d-499f-9bea-952b6e479ec2&searchtype=ds&q={searchTerms}&installDate={installDate}"
"Use Search Asst"="yes"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://search.chatzum.com/?orig=HP&affid=61&cztbid=573262109"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://search.chatzum.com/?orig=HP&affid=61&cztbid=573262109"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=9ee750ce-c67d-499f-9bea-952b6e479ec2&searchtype=ds&q={searchTerms}&installDate={installDate}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=9ee750ce-c67d-499f-9bea-952b6e479ec2&searchtype=ds&q={searchTerms}&installDate={installDate}"
"SearchAssistant"="hxxp://feed.snap.do/?publisher=QuickOC&dpid=QuickOC&co=DE&userid=9ee750ce-c67d-499f-9bea-952b6e479ec2&searchtype=ds&q={searchTerms}&installDate={installDate}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{006ee092-9658-4fd6-bd8e-a21a348e59f5}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}] not found

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="hxxp://www.google.com"
"Use Search Asst"="no"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{990af1c2-5a27-4460-8149-ecc6bc122af3} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{990af1c2-5a27-4460-8149-ecc6bc122af3} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64182481-4F71-486b-A045-B233BD0DA8FC} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{64182481-4F71-486b-A045-B233BD0DA8FC} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{990af1c2-5a27-4460-8149-ecc6bc122af3} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{990af1c2-5a27-4460-8149-ecc6bc122af3} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{64182481-4F71-486b-A045-B233BD0DA8FC} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{990af1c2-5a27-4460-8149-ecc6bc122af3} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_USERS\S-1-5-21-3329929173-2124052641-421559559-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{C424171E-592A-415A-9EB1-DFD6D95D3530} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{990af1c2-5a27-4460-8149-ecc6bc122af3} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} deleted successfully
HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\bhphemoobgnikcoofkgackkaimpfmenm deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\ihflimipbcaljfnojhhknppphnnciiif deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\ngnjhfpfhadncgafgbneeljaginimmmk deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\bhphemoobgnikcoofkgackkaimpfmenm deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp deleted successfully

==== Empty IE Cache ======================

C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Mela\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Mela\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Mela\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\serviceprofiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Mela\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\users\Mela\AppData\Local\Mozilla\Firefox\Profiles\k0n760wh.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\users\Mela\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

After Reboot

==== Empty Temp Folders ======================

C:\windows\Temp successfully emptied
C:\Users\Mela\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Mela\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Users\Mela\AppData\Roaming\OCS" not found

OTL TXT:OTL Logfile:
--- --- ---

OTL EXTRAS Logfile:
--- --- ---

Öffne nochmal ZOEK und kopiere untenstehende Code in das Textfeld:

Drucke "Run Script".

Poste mir das neue Log von Zoek.

Zoek.exe Version 4.0.0.2 Updated 23-04-2013
Tool run by Mela on 26.04.2013 at 19:19:31,29.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected

==== Older Logs ======================

C:\zoek-results26.04.2013-1837.log 35569 bytes

==== FireFox Fix ======================

ProfilePath: C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default

---- Lines ChatZum removed from prefs.js ----

user_pref("browser.search.defaultenginename", "ChatZum");
user_pref("browser.search.order.1", "ChatZum");

---- Lines ChatZum modified from prefs.js ----


---- Lines ChatZum removed from user.js ----


---- Lines mystart removed from prefs.js ----

user_pref("browser.startup.homepage", "hxxp://mystart.incredimail.com/?a=1ex65ZZo36P");
user_pref("browser.startup.homepage", "hxxp://mystart.incredimail.com/?a=1ex65ZZo36P");

---- Lines mystart modified from prefs.js ----


---- Lines mystart removed from user.js ----


---- FireFox user.js and prefs.js backups ----

user__1811_.backup
user__1920_.backup
prefs__1811_.backup
prefs__1920_.backup

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"facemoods"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Browser Infrastructure Helper"=-

==== Firefox Extensions ======================

ProfilePath: C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default
- DVDVideoSoftTB DE - %ProfilePath%\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default
10737B44923217BC0E67D26A9FC1F0AA - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll - RealNetworks(tm) Chrome Background Extension Plug-In (32-bit)
2645990C521342DCD08963D2DF6CD0D2 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll - RealPlayer(tm) HTML5VideoShim Plug-In (32-bit)


==== Deleting Files \ Folders ======================

"C:\Users\Mela\AppData\Roaming\Mozilla\Firefox\Profiles\k0n760wh.default\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}" deleted

==== Reset Google Chrome ======================

C:\users\Mela\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\users\Mela\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

Merkst Du noch einige Probleme? :)


Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

AdwCleaner Logfile:
--- --- ---

Sieht gut aus :daumenhoc


Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers



Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

Malwarebytes Anti-Rootkit BETA 1.05.0.1001
Malwarebytes : Free anti-malware download

Database version: v2013.04.27.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Mela :: MELA-HP [administrator]

27.04.2013 11:16:21
mbar-log-2013-04-27 (11-16-21).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 32029
Time elapsed: 21 minute(s), 4 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Results of screen317's Security Check version 0.99.62
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
JavaFX 2.1.0
Java(TM) 6 Update 31
Java 7 Update 17
Adobe Flash Player 11.7.700.169
Adobe Reader 10.1.6 Adobe Reader out of Date!
Mozilla Firefox (13.0)
Google Chrome 26.0.1410.43
Google Chrome 26.0.1410.64
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

Adobe Reader braucht eine Update: Adobe - Adobe Reader herunterladen - Alle Versionen (McAfee Security Scan abwahlen ;))


Damit wären wir fertig. Wir räumen jetzt noch ein wenig auf und dann habe ich am Ende etwas Lesestoff für dich.


Tools deinstallieren

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: jetzt auf re-enable klicken.
2. Downloade Dir bitte auf jeden Fall delfix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • DelFix entfernt u. a. alle verwendeten Programme und löscht sich abschließend selbst.
3. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Abschließend noch Tipps zu folgenden Themen:

• Systemupdates
• Softwareupdates
• Sicherheitssoftware
• Sicheres Surfen

Damit wünsche ich dir noch viel Spaß beim Surfen im Internet :daumenhoc

... und vielleicht möchtest du ja das Trojaner-Board unterstützen?

Grüße
Smeenk

Au, weija. Das hätte ich nie, niemals alleine geschafft. Vielen, vielen Dank für Deine super Hilfe!!!!!!:dankeschoen::dankeschoen::dankeschoen::dankeschoen::dankeschoen::dankeschoen:

Hi sharkbay98

Ich habe dir gerne geholfen :)

Gruß
Smeenk