Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt

alter_schwed · 19.11.2013, 13:02

Hallo,

wie im Betreff angegeben, kann ich im Firefox nicht abstellen, dass die "certified toolbar" aktiv wird und/oder sich einnistet. Würde es gerne loswerden. Das Windows XP ist schwedisch, aber ich kann beide Sprachen und kenne sowohl die deutsche als auch die schwedische Windows XP Version soweit als dass ich Programme installieren kann und in der Systemsteuerung herummachen kann.

Tom

schrauber · 19.11.2013, 13:11

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

alter_schwed · 19.11.2013, 14:52

okay, hier kommts:! Die # taste auf der Webseite habe ich nicht gefunden...

--snip
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-11-2013
Ran by Birgitta (administrator) on BIRGITTA-9FD6B2 on 19-11-2013 14:34:13
Running from C:\Documents and Settings\Birgitta\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 6
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

() C:\windows\system32\Ati2evxx.exe
() C:\windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\windows\System32\bcmwltry.exe
(Microsoft Corporation) C:\windows\System32\SCardSvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\windows\system32\Ati2evxx.exe
(Simplygen) C:\Program Files\HomeTab\ProtectedSearch.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dell Inc.) C:\WINDOWS\system32\WLTRAY.exe
(Seagate) C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(ZTE) C:\Program Files\Connect Manager\Bin\mcserver.exe
(Huawei Technologies Co., Ltd.) C:\Documents and Settings\Birgitta\Application Data\Mobile Partner\ouc.exe
(Microsoft Corporation) C:\windows\system32\cmd.exe
() C:\Program Files\Connect Manager\Bin\dbus-daemon.exe
() C:\Program Files\Connect Manager\Bin\db_daemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Documents and Settings\All Users\Application Data\DatacardService\DCService.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
(Microsoft Corporation) C:\windows\system32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\windows\system32\wscntfy.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\windows\system32\wuauclt.exe
(Huawei Technologies Co., Ltd.) C:\Documents and Settings\Birgitta\Application Data\Mobile Partner\LiveUpdate.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ATIModeChange] - C:\WINDOWS\system32\Ati2mdxx.exe [28672 2001-09-04] (ATI Technologies, Inc.)
HKLM\...\Run: [ATIPTA] - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [335872 2003-07-29] (ATI Technologies, Inc.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\hpwuschd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [384800 2012-12-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\WINDOWS\system32\WLTRAY.EXE [1347584 2005-12-19] (Dell Inc.)
HKLM\...\Run: [DiscWizardMonitor.exe] - C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe [2638152 2011-06-30] (Seagate)
HKLM\...\Run: [Seagate Scheduler2 Service] - C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe [395152 2011-06-30] (Seagate)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll ()
HKCU\...\Run: [HW_OPENEYE_OUC_Mobile Partner] - C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [110592 2009-07-27] (Huawei Technologies Co., Ltd.)
MountPoints2: E - E:\AutoRun.exe
MountPoints2: {28a17bc0-8230-11e1-8338-000bdba7cd9e} - nmusbcfg.exe
MountPoints2: {2a6e2b54-b443-11e0-832a-000bdba7cd9e} - E:\windows\Data\AutoRun.exe
MountPoints2: {8d8849f0-e4ee-11e2-8394-000bdba7cd9e} - E:\AutoRun.exe
MountPoints2: {8d8849f3-e4ee-11e2-8394-000bdba7cd9e} - E:\AutoRun.exe
MountPoints2: {a559e010-f935-11e2-8396-000bdba7cd9e} - E:\AutoRun.exe
MountPoints2: {e90f46b1-fe6b-11e0-8331-000bdba7cd9e} - E:\AutoRun.exe
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MCtlSvc.lnk
ShortcutTarget: MCtlSvc.lnk -> C:\Program Files\Connect Manager\Bin\mcserver.exe (ZTE)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
SearchScopes: HKLM - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKLM - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.7&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.7&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: HomeTab - {ad3daa4e-8c03-4eeb-9926-a500ee85d639} - C:\Documents and Settings\Birgitta\Application Data\HomeTab\HomeTab.dll (Simply Tech LTD.)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - HomeTab - {ad3daa4e-8c03-4eeb-9926-a500ee85d639} - C:\Documents and Settings\Birgitta\Application Data\HomeTab\HomeTab.dll (Simply Tech LTD.)
Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1372873530110
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2210608 2006-10-27] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.10.2 10.0.10.3

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default
FF NewTab: about:home
FF DefaultSearchEngine: Web Search
FF SearchEngineOrder.1: Web Search
FF SelectedSearchEngine: Web Search
FF Homepage: about:home
FF Keyword.URL: hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\allaannonser-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\prisjakt-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\tyda-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\wikipedia-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-sv-SE.xml
FF Extension: No Name - C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\Extensions\WTB_GLOBAL.sqlite
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [85280 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [109344 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [323584 2003-07-29] ()
R2 DCService.exe; C:\Documents and Settings\All Users\Application Data\DatacardService\DCService.exe [229376 2010-08-19] ()
R2 SgtSch2Svc; C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe [845808 2011-06-30] (Seagate)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [1200128 2005-12-19] (Dell Inc.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83944 2012-11-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [134336 2012-11-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36552 2012-11-22] (Avira Operations GmbH & Co. KG)
R3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl5.sys [424320 2005-11-02] (Broadcom Corporation)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2008-10-28] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2008-10-28] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2008-10-28] (HP)
R3 HSFHWICH; C:\Windows\System32\DRIVERS\HSFHWICH.sys [189056 2003-07-03] (Conexant Systems, Inc.)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-09] (MBB Incorporated)
R3 O2SCBUS; C:\Windows\System32\DRIVERS\ozscr.sys [91395 2003-12-11] (O2Micro)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 STAC97; C:\Windows\System32\drivers\stac97.sys [258704 2004-05-12] (SigmaTel, Inc.)
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [125472 2013-09-11] (Acronis)
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [83392 2013-09-11] (Acronis)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [126976 2011-03-09] (ZTE Corporation)
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [117504 2010-08-27] (Huawei Technologies Co., Ltd.)
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
U1 WS2IFSL; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-19 14:34 - 2013-11-19 14:35 - 00015107 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST
2013-11-19 14:32 - 2013-11-19 14:29 - 01090881 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST.exe
2013-11-01 09:33 - 2013-11-01 09:33 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\HomeTab
2013-10-21 12:15 - 2013-11-19 12:52 - 00000000 ____D C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2013-11-19 14:35 - 2013-11-19 14:34 - 00015107 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST
2013-11-19 14:29 - 2013-11-19 14:32 - 01090881 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST.exe
2013-11-19 14:29 - 2011-07-22 11:17 - 00000000 ____D C:\Documents and Settings\Birgitta\My Documents\Hämtade filer
2013-11-19 14:19 - 2011-07-22 09:50 - 01779434 _____ C:\windows\WindowsUpdate.log
2013-11-19 12:52 - 2013-10-21 12:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-19 12:50 - 2003-05-29 02:32 - 00548064 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-19 12:45 - 2013-09-01 20:26 - 00000284 _____ C:\windows\Tasks\Protected Search.job
2013-11-19 12:45 - 2012-04-03 11:08 - 00000982 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-19 12:45 - 2011-07-22 09:59 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-19 12:45 - 2004-08-04 11:00 - 00002206 _____ C:\windows\system32\wpa.dbl
2013-11-10 02:46 - 2011-07-22 10:00 - 00000178 ___SH C:\Documents and Settings\Birgitta\ntuser.ini
2013-11-10 02:46 - 2011-07-22 10:00 - 00000000 ____D C:\Documents and Settings\Birgitta
2013-11-10 02:46 - 2011-07-22 09:59 - 00032638 _____ C:\windows\SchedLgU.Txt
2013-11-09 18:00 - 2012-04-03 11:08 - 00000986 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-02 09:33 - 2013-07-04 21:25 - 00000374 _____ C:\windows\Tasks\Browser Updater.job
2013-11-02 08:38 - 2013-07-04 22:25 - 00000000 ____D C:\Documents and Settings\Birgitta\Local Settings\Application Data\Adobe
2013-11-02 08:38 - 2011-07-22 10:56 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Adobe
2013-11-01 09:33 - 2013-11-01 09:33 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\HomeTab
2013-11-01 09:33 - 2013-07-04 21:25 - 00000000 ____D C:\Program Files\HomeTab
2013-11-01 07:58 - 2013-09-15 00:43 - 00000000 ____D C:\windows\system32\NtmsData
2013-11-01 07:57 - 2011-07-22 09:48 - 00000000 ____D C:\windows\Registration
2013-10-22 08:20 - 2013-01-30 09:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-21 08:57 - 2013-07-04 21:25 - 00000000 ____D C:\Documents and Settings\Birgitta\Local Settings\Application Data\HomeTab

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2004-08-04 11:00] - [2008-04-14 05:42] - 0108544 ____A (Microsoft Corporation) 0e776ed5f7cc9f94299e70461b7b8185 

C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

--- --- ---

und hier addition:FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 18-11-2013
Ran by Birgitta at 2013-11-19 14:39:46
Running from C:\Documents and Settings\Birgitta\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}

==================== Installed Programs ======================

32 Bit HP CIO Components Installer (Version: 6.1.1)
Adobe Flash Player 10 ActiveX (Version: 10.3.181.34)
Adobe Flash Player 11 Plugin (Version: 11.8.800.168)
Adobe Reader XI (11.0.03) (Version: 11.0.03)
ATI - Software Uninstall Utility (Version: 6.14.10.1005)
ATI Control Panel (Version: 6.14.10.5028)
ATI Display Driver (Version: 7.91.2-030729a-010470C-Dell)
Avira Free Antivirus (Version: 13.0.0.2890)
Broadcom Gigabit Integrated Controller (Version: 3.61)
BufferChm (Version: 140.0.212.000)
CCleaner (Version: 4.03)
Conexant D480 MDC V.9x Modem
Connect Manager (Version: 1.00.0000)
Coupon Printer for Windows (Version: 5.0.0.0)
D2600 (Version: 140.0.690.000)
Dell ResourceCD
Dell Wireless WLAN Card (Version: 4.10.47.3)
DeviceDiscovery (Version: 140.0.212.000)
DJ_SF_05_D2600_Software_Min (Version: 140.0.690.000)
Google Update Helper (Version: 1.3.21.165)
GPBaseService2 (Version: 140.0.211.000)
HomeTab 4.9 (Version: 4.9)
HP Customer Participation Program 14.0 (Version: 14.0)
HP Deskjet D2600 Printer Driver Software 14.0 Rel. 5 (Version: 14.0)
HP Imaging Device Functions 14.0 (Version: 14.0)
HP Photo Creations (Version: 1.0.0.2024)
HP Smart Web Printing 4.60 (Version: 4.60)
HP Solution Center 14.0 (Version: 14.0)
HP Update (Version: 5.002.002.002)
HPProductAssistant (Version: 140.0.212.000)
HPSSupply (Version: 140.0.211.000)
MarketResearch (Version: 140.0.212.000)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Office Access MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Enterprise 2007 (Version: 12.0.4518.1014)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Software Update for Web Folders  (English) 12 (Version: 12.0.4518.1014)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mobile Partner (Version: 16.002.21.02.24)
Mozilla Firefox 24.0 (x86 sv-SE) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0)
O2Micro Smartcard Driver (Version: 2.20.0000)
Seagate DiscWizard (Version: 13.0.14387)
SeaTools for Windows (Version: 1.2.0.7)
Shop for HP Supplies (Version: 14.0)
SigmaTel AC97 Audio Drivers (Version: 4029)
Skype™ 6.6 (Version: 6.6.106)
SmartWebPrinting (Version: 140.0.186.000)
SolutionCenter (Version: 140.0.213.000)
Status (Version: 140.0.212.000)
Toolbox (Version: 140.0.428.000)
TrayApp (Version: 140.0.212.000)
Update for Windows XP (KB898461) (Version: 1)
WebFldrs XP (Version: 9.50.7523)
WebReg (Version: 140.0.212.017)
Windows XP Service Pack 3 (Version: 20080414.031525)
VLC media player 2.0.8 (Version: 2.0.8)

==================== Restore Points  =========================

30-07-2013 18:34:05 System Checkpoint
26-08-2013 06:41:06 System Checkpoint
27-08-2013 09:01:24 System Checkpoint
01-09-2013 15:53:11 System Checkpoint
01-09-2013 20:17:14 Installed SeaTools for Windows
11-09-2013 19:39:51 Installed Seagate DiscWizard
14-09-2013 22:07:20 Installed Adobe Reader XI (11.0.03).
14-09-2013 22:12:53 Installed DirectX 9.0
21-09-2013 20:03:29 System Checkpoint
30-09-2013 16:03:12 System Checkpoint
01-10-2013 16:11:53 System Checkpoint
02-10-2013 16:45:40 System Checkpoint
21-10-2013 08:33:01 System Checkpoint
22-10-2013 08:44:11 System Checkpoint
23-10-2013 09:44:12 System Checkpoint
01-11-2013 08:16:59 System Checkpoint

==================== Hosts content: ==========================

2004-08-04 11:00 - 2004-08-04 11:00 - 00000734 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: C:\windows\Tasks\Browser Updater.job => C:\Program Files\HomeTab\TBUpdater.dll
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\Protected Search.job => C:\Program Files\HomeTab\ProtectedSearch.exe

==================== Loaded Modules (whitelisted) =============

2011-07-22 10:12 - 2003-07-29 14:11 - 00086016 _____ () C:\windows\system32\Ati2evxx.dll
2013-09-01 19:24 - 2005-12-19 09:08 - 00757760 _____ () C:\windows\System32\bcm1xsup.dll
2013-07-04 21:40 - 2012-09-19 18:17 - 00397088 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2013-07-04 21:25 - 2013-08-29 07:22 - 00107592 _____ () C:\Program Files\HomeTab\InstallHelper.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00594944 _____ () C:\Program Files\Connect Manager\Bin\dbus-1.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00093696 _____ () C:\Program Files\Connect Manager\Bin\itapi.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00026112 _____ () C:\Program Files\Connect Manager\Bin\log.dll
2011-07-22 10:16 - 2010-10-14 10:37 - 00971776 _____ () C:\Program Files\Connect Manager\Bin\libxml2.dll
2011-07-22 10:16 - 2010-10-14 10:37 - 00080688 _____ () C:\Program Files\Connect Manager\Bin\zlib1.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00054784 _____ () C:\Program Files\Connect Manager\Bin\coder.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00043008 _____ () C:\Program Files\Connect Manager\Bin\audio.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00034816 _____ () C:\Program Files\Connect Manager\Bin\libConfig.dll
2011-07-22 10:16 - 2011-04-18 02:46 - 00020992 _____ () C:\Program Files\Connect Manager\Bin\libctlsvr.dll
2011-07-22 10:16 - 2007-09-09 16:07 - 00151552 _____ () C:\Program Files\Connect Manager\Bin\libexpat.dll
2011-07-22 10:16 - 2010-12-06 07:12 - 00341504 _____ () C:\Program Files\Connect Manager\Bin\sqlite3.dll
2013-10-21 12:15 - 2013-10-21 12:16 - 03279768 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/02/2013 01:34:51 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (11/02/2013 01:34:48 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (11/02/2013 01:34:31 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (11/02/2013 01:14:45 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (11/02/2013 01:11:28 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (11/02/2013 01:08:26 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (11/02/2013 08:41:12 AM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (08/26/2013 03:23:05 PM) (Source: Application Hang) (User: )
Description: Hanging application firefox.exe, version 22.0.0.4917, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (08/26/2013 03:17:43 PM) (Source: Application Hang) (User: )
Description: Hanging application firefox.exe, version 22.0.0.4917, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (07/04/2013 07:14:30 PM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.


System errors:
=============
Error: (11/09/2013 05:40:11 PM) (Source: W32Time) (User: )
Description: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. 
No attempt to contact a source will be made for 14 minutes.
NtpClient has no source of accurate time.

Error: (11/09/2013 05:40:11 PM) (Source: W32Time) (User: )
Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Error: (10/21/2013 07:42:10 AM) (Source: Windows Update Agent) (User: )
Description: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.

Error: (10/21/2013 07:41:44 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: The server {4EB61BAC-A3B6-4760-9581-655041EF4D69} did not register with DCOM within the required timeout.

Error: (10/02/2013 04:43:27 PM) (Source: Windows Update Agent) (User: )
Description: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.

Error: (09/22/2013 10:44:42 AM) (Source: Dhcp) (User: )
Description: The IP address lease 192.168.0.3 for the Network Card with network address 00904BB371DA has been
denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).

Error: (09/21/2013 08:06:35 PM) (Source: W32Time) (User: )
Description: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. 
No attempt to contact a source will be made for 14 minutes.
NtpClient has no source of accurate time.

Error: (09/21/2013 08:06:35 PM) (Source: W32Time) (User: )
Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Error: (09/15/2013 01:57:18 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: The server {D61A27C6-8F53-11D0-BFA0-00A024151983} did not register with DCOM within the required timeout.

Error: (09/14/2013 10:48:46 PM) (Source: Dhcp) (User: )
Description: The IP address lease 192.168.0.3 for the Network Card with network address 00904BB371DA has been
denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 29%
Total physical RAM: 2047.23 MB
Available physical RAM: 1453.22 MB
Total Pagefile: 3944.92 MB
Available Pagefile: 3390.4 MB
Total Virtual: 2047.88 MB
Available Virtual: 1972.71 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:111.79 GB) (Free:101.04 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 112 GB) (Disk ID: 49460703)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)

==================== End Of Log ============================

--- --- ---

schrauber · 20.11.2013, 09:52

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

alter_schwed · 21.11.2013, 10:36

Hallo,

hier kommts...

#
Combofix Logfile:

Code:

ATTFilter

ComboFix 13-11-19.01 - Birgitta 2013-11-21   8:41.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2047.1683 [GMT 1:00]
Running from: c:\documents and settings\Birgitta\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\FlashPlayerApp.exe
c:\windows\Tasks\Protected Search.job
.
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_DCSERVICE.EXE
-------\Service_DCService.exe
.
.
(((((((((((((((((((((((((   Files Created from 2013-10-21 to 2013-11-21  )))))))))))))))))))))))))))))))
.
.
2013-11-19 13:33 . 2013-11-19 13:33	--------	d-----w-	C:\FRST
2013-11-01 08:33 . 2013-11-01 08:33	--------	d-----w-	c:\documents and settings\Birgitta\Application Data\HomeTab
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-14 22:48 . 2011-07-22 09:19	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-11 19:41 . 2013-09-11 19:40	601408	----a-w-	c:\windows\system32\drivers\timntr.sys
2013-09-11 19:40 . 2013-09-11 19:40	125472	----a-w-	c:\windows\system32\drivers\vididr.sys
2013-09-11 19:40 . 2013-09-11 19:40	83392	----a-w-	c:\windows\system32\drivers\vsflt53.sys
2013-09-11 19:40 . 2013-09-11 19:40	169088	----a-w-	c:\windows\system32\drivers\snapman.sys
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{ad3daa4e-8c03-4eeb-9926-a500ee85d639}]
2013-10-25 14:58	1092680	----a-w-	c:\documents and settings\Birgitta\Application Data\HomeTab\HomeTab.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ad3daa4e-8c03-4eeb-9926-a500ee85d639}"= "c:\documents and settings\Birgitta\Application Data\HomeTab\HomeTab.dll" [2013-10-25 1092680]
.
[HKEY_CLASSES_ROOT\clsid\{ad3daa4e-8c03-4eeb-9926-a500ee85d639}]
[HKEY_CLASSES_ROOT\wtb.Band.1]
[HKEY_CLASSES_ROOT\TypeLib\{a5b662cc-93f1-46a2-8d11-27ea4fcbc401}]
[HKEY_CLASSES_ROOT\wtb.Band]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HW_OPENEYE_OUC_Mobile Partner"="c:\program files\Mobile Partner\UpdateDog\ouc.exe" [2009-07-27 110592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 28672]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-29 335872]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-12-04 384800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"DiscWizardMonitor.exe"="c:\program files\Seagate\DiscWizard\DiscWizardMonitor.exe" [2011-06-30 2638152]
"Seagate Scheduler2 Service"="c:\program files\Common Files\Seagate\Schedule2\schedhlp.exe" [2011-06-30 395152]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
MCtlSvc.lnk - c:\program files\Connect Manager\Bin\mcserver.exe [2011-7-22 63248]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmaTel StacMon]
2004-04-29 13:15	90169	------w-	c:\program files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\HomeTab\\ProtectedSearch.exe"=
"c:\\Program Files\\HomeTab\\TBUpdater.dll"=
.
R0 vididr;Acronis Virtual Disk;c:\windows\system32\drivers\vididr.sys [9/11/2013 8:40 PM 125472]
R0 vidsflt53;Acronis Disk Storage Filter (53);c:\windows\system32\drivers\vsflt53.sys [9/11/2013 8:40 PM 83392]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [7/4/2013 9:40 PM 36552]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [7/4/2013 9:40 PM 85280]
R2 SgtSch2Svc;Seagate Scheduler2 Service;c:\program files\Common Files\Seagate\Schedule2\schedul2.exe [6/30/2011 1:48 PM 845808]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [7/4/2013 10:15 PM 72832]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [6/21/2013 9:53 AM 162408]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [7/4/2013 10:15 PM 102784]
S3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [7/22/2011 10:16 AM 9216]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [7/22/2011 10:16 AM 126976]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-11-02 c:\windows\Tasks\Browser Updater.job
- c:\program files\HomeTab\TBUpdater.dll [2013-07-04 04:10]
.
2013-11-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-03 10:07]
.
2013-11-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-03 10:07]
.
.
------- Supplementary Scan -------
.
uStart Page = about:newtab
uDefault_Search_URL = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
mStart Page = about:newtab
mSearch Bar = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{93be812b-478a-4c53-9a2d-cebab64b1efa} - {ad3daa4e-8c03-4eeb-9926-a500ee85d639} - c:\documents and settings\Birgitta\Application Data\HomeTab\HomeTab.dll
TCP: DhcpNameServer = 10.0.10.2 10.0.10.3
FF - ProfilePath - c:\documents and settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 2012-09-26 14:48; smartwebprinting@hp.com; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-11-21 09:03
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1801674531-1343024091-250163379-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ad3daa4e-8c03-4eeb-9926-a500ee85d639}]
@Denied: (A 2) (Administrators)
@Denied: (A 2) (S-1-5-21-1801674531-1343024091-250163379-1003)
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"Flags"=dword:00000400
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\Ati2evxx.exe
c:\documents and settings\Birgitta\Application Data\Mobile Partner\ouc.exe
c:\program files\Connect Manager\Bin\dbus-daemon.exe
c:\program files\Connect Manager\Bin\db_daemon.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2013-11-21  09:10:23 - machine was rebooted
ComboFix-quarantined-files.txt  2013-11-21 08:10
.
Pre-Run: 108*358*553*600 bytes free
Post-Run: 108*255*916*032 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\windows
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\windows="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 8D1D5FA4266BB1B01AED6B0709EC685E

--- --- ---
8F558EB6672622401DA993E1E865C861

schrauber · 21.11.2013, 14:21

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

alter_schwed · 22.11.2013, 12:34

Hallo hier kommts.

Nach dem Durchlauf von ADWCleaner wurde Avira aktiv und schickte
A0022594.dll in die Garantäne nachdem TR/Trash.Gen gemeldet wurde.

#
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.11.21.06

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
Birgitta :: BIRGITTA-9FD6B2 [Administrator]

2013-11-21 15:36:32
mbam-log-2013-11-21 (15-36-32).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 191393
Laufzeit: 21 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 12
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5bd13d4b-e49a-4782-a80e-7a949a06332d}_is1 (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{08b8e913-bd4e-4a50-991e-c5a24ed7c738} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{a5b662cc-93f1-46a2-8d11-27ea4fcbc401} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\wtb.SourceSinkImpl.1 (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\wtb.SourceSinkImpl (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{ad3daa4e-8c03-4eeb-9926-a500ee85d639} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\wtb.Band.1 (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\wtb.Band (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AD3DAA4E-8C03-4EEB-9926-A500EE85D639} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{AD3DAA4E-8C03-4EEB-9926-A500EE85D639} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{AD3DAA4E-8C03-4EEB-9926-A500EE85D639} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{AD3DAA4E-8C03-4EEB-9926-A500EE85D639} (PUP.Optional.HomeTab.A) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 4
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Search_URL (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=) Gut: (hxxp://www.google.com/) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Search Bar (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=) Gut: (hxxp://www.google.com/) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 8
C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Documents and Settings\Birgitta\Local Settings\Application Data\SimplyTech\Toolbar (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\chrome (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com\chrome (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com\components (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com\plugins (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 32
C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\home.htm (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\jquery-ui-1.10.1.custom.min.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\jquiso.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\socket.io.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\style.css (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\vars.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Documents and Settings\Birgitta\Local Settings\Application Data\SimplyTech\Toolbar\settings.dat (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\Microsoft.Win32.TaskScheduler.xml (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\cinshlpr.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\hometab_icon.ico (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\InstallHelper.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\Interop.IWshRuntimeLibrary.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\Microsoft.Win32.TaskScheduler.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\ProtectedSearch.exe (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\ProtectedSearch.ico (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\STInst32.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\STInst32.exe (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\System.Data.SQLite.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\TaskSchedulerCreator.exe (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\TBUpdater.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\ToolbarUninstall.exe (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\unins000.dat (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\unins000.exe (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\chrome\HomeTab.crx (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com\chrome.manifest (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com\install.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com\install.rdf (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com\pop.htm (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com\chrome\HomeTab_4028.jar (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com\components\wtb_complete.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\HomeTab\support@HomeTab.com\plugins\npwiddit.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Documents and Settings\Birgitta\Application Data\HomeTab\HomeTab.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

--AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.012 - Report created 22/11/2013 at 09:08:48
# Updated 11/11/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Birgitta - BIRGITTA-9FD6B2
# Running from : C:\Documents and Settings\Birgitta\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Documents and Settings\Birgitta\Local Settings\Application Data\HomeTab
Folder Deleted : C:\Documents and Settings\Birgitta\Local Settings\Application Data\SimplyTech
Folder Deleted : C:\Documents and Settings\Birgitta\Application Data\HomeTab
Folder Deleted : C:\Documents and Settings\Birgitta\Application Data\SimplyTech
File Deleted : C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\searchplugins\Web Search.xml
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\Web Search.xml
File Deleted : C:\windows\Tasks\Browser Updater.job

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\HomeTab.DLL
Key Deleted : HKLM\SOFTWARE\Classes\wtb.NotificationSource
Key Deleted : HKLM\SOFTWARE\Classes\wtb.NotificationSource.1
Key Deleted : HKLM\SOFTWARE\Classes\wtb.ToolbarInfo
Key Deleted : HKLM\SOFTWARE\Classes\wtb.ToolbarInfo.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3FC27B34-0C19-49DA-875E-1875DDD4A6B2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A928E66C-F501-4E66-9953-855C712F93B2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program Files\HomeTab\ProtectedSearch.exe]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program Files\HomeTab\TBUpdater.dll]
Key Deleted : HKCU\Software\HomeTab
Key Deleted : HKCU\Software\simplytech
Key Deleted : HKCU\Software\AppDataLow\Software\simplytech

***** [ Browsers ] *****

-\\ Internet Explorer v6.0.2900.5512

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Search [Search Bar]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Search [Search Page]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Search Bar]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Search Page]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [(Default)]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [(Default)]

-\\ Mozilla Firefox v24.0 (sv-SE)

[ File : C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\prefs.js ]

Line Deleted : user_pref("browser.search.defaultengine", "Web Search");
Line Deleted : user_pref("browser.search.defaultenginename", "Web Search");
Line Deleted : user_pref("browser.search.order.1", "Web Search");
Line Deleted : user_pref("browser.search.selectedEngine", "Web Search");
Line Deleted : user_pref("keyword.URL", "hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=");

*************************

AdwCleaner[R0].txt - [5016 octets] - [22/11/2013 08:44:27]
AdwCleaner[S0].txt - [3993 octets] - [22/11/2013 09:08:48]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4053 octets] ##########

--- --- ---

--

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Microsoft Windows XP x86
Ran by Birgitta on 2013-11-22 at 10:47:15,30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\apn"
Successfully deleted: [Folder] "C:\Program Files\coupons"

~~~ FireFox

Emptied folder: C:\Documents and Settings\Birgitta\Application Data\mozilla\firefox\profiles\qpp52zv4.default\minidumps [3 files]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 2013-11-22 at 11:19:55,12
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--
FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-11-2013
Ran by Birgitta (administrator) on BIRGITTA-9FD6B2 on 22-11-2013 12:01:36
Running from C:\Documents and Settings\Birgitta\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 6
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

() C:\windows\system32\Ati2evxx.exe
() C:\windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\windows\System32\bcmwltry.exe
(Microsoft Corporation) C:\windows\System32\SCardSvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\windows\system32\Ati2evxx.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dell Inc.) C:\WINDOWS\system32\WLTRAY.exe
(Seagate) C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(ZTE) C:\Program Files\Connect Manager\Bin\mcserver.exe
(Huawei Technologies Co., Ltd.) C:\Documents and Settings\Birgitta\Application Data\Mobile Partner\ouc.exe
(Microsoft Corporation) C:\windows\system32\cmd.exe
() C:\Program Files\Connect Manager\Bin\dbus-daemon.exe
() C:\Program Files\Connect Manager\Bin\db_daemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
(Microsoft Corporation) C:\windows\system32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\windows\system32\wscntfy.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\windows\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST(1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ATIModeChange] - C:\WINDOWS\system32\Ati2mdxx.exe [28672 2001-09-04] (ATI Technologies, Inc.)
HKLM\...\Run: [ATIPTA] - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [335872 2003-07-29] (ATI Technologies, Inc.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\hpwuschd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [384800 2012-12-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\WINDOWS\system32\WLTRAY.EXE [1347584 2005-12-19] (Dell Inc.)
HKLM\...\Run: [DiscWizardMonitor.exe] - C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe [2638152 2011-06-30] (Seagate)
HKLM\...\Run: [Seagate Scheduler2 Service] - C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe [395152 2011-06-30] (Seagate)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll ()
HKCU\...\Run: [HW_OPENEYE_OUC_Mobile Partner] - C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [110592 2009-07-27] (Huawei Technologies Co., Ltd.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MCtlSvc.lnk
ShortcutTarget: MCtlSvc.lnk -> C:\Program Files\Connect Manager\Bin\mcserver.exe (ZTE)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKLM - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1372873530110
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2210608 2006-10-27] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.10.2 10.0.10.3

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default
FF NewTab: about:home
FF Homepage: about:home
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\allaannonser-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\prisjakt-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\tyda-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\wikipedia-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-sv-SE.xml
FF Extension: No Name - C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\Extensions\WTB_GLOBAL.sqlite
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [85280 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [109344 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [323584 2003-07-29] ()
R2 SgtSch2Svc; C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe [845808 2011-06-30] (Seagate)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [1200128 2005-12-19] (Dell Inc.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83944 2012-11-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [134336 2012-11-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36552 2012-11-22] (Avira Operations GmbH & Co. KG)
R3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl5.sys [424320 2005-11-02] (Broadcom Corporation)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2008-10-28] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2008-10-28] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2008-10-28] (HP)
R3 HSFHWICH; C:\Windows\System32\DRIVERS\HSFHWICH.sys [189056 2003-07-03] (Conexant Systems, Inc.)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-09] (MBB Incorporated)
R3 O2SCBUS; C:\Windows\System32\DRIVERS\ozscr.sys [91395 2003-12-11] (O2Micro)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 STAC97; C:\Windows\System32\drivers\stac97.sys [258704 2004-05-12] (SigmaTel, Inc.)
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [125472 2013-09-11] (Acronis)
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [83392 2013-09-11] (Acronis)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [126976 2011-03-09] (ZTE Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [117504 2010-08-27] (Huawei Technologies Co., Ltd.)
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-22 11:58 - 2013-11-22 11:57 - 01090881 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST(1).exe
2013-11-22 11:19 - 2013-11-22 11:19 - 00000888 _____ C:\Documents and Settings\Birgitta\Desktop\JRT.txt
2013-11-22 10:46 - 2013-11-22 10:46 - 00000000 ____D C:\windows\ERUNT
2013-11-22 08:43 - 2013-11-22 09:08 - 00000000 ____D C:\AdwCleaner
2013-11-21 15:30 - 2013-11-21 15:30 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-11-21 15:29 - 00000784 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-11-21 15:28 - 2013-11-21 15:28 - 01034531 _____ (Thisisu) C:\Documents and Settings\Birgitta\Desktop\JRT.exe
2013-11-21 15:27 - 2013-11-21 15:27 - 01085542 _____ C:\Documents and Settings\Birgitta\Desktop\adwcleaner.exe
2013-11-21 13:58 - 2013-11-21 13:58 - 00001126 _____ C:\windows\setupapi.log
2013-11-21 11:12 - 2013-11-22 11:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-21 09:10 - 2013-11-21 09:10 - 00010976 _____ C:\ComboFix.txt
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\SECURITY.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\default.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\system.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\software.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\SAM.tmp.LOG
2013-11-21 08:38 - 2013-11-21 08:38 - 00000000 _RSHD C:\cmdcons
2013-11-21 08:38 - 2013-09-12 20:41 - 00000211 _____ C:\Boot.bak
2013-11-21 08:38 - 2004-08-03 23:00 - 00260272 __RSH C:\cmldr
2013-11-21 08:32 - 2011-06-26 07:45 - 00256000 _____ C:\windows\PEV.exe
2013-11-21 08:32 - 2010-11-07 18:20 - 00208896 _____ C:\windows\MBR.exe
2013-11-21 08:32 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00098816 _____ C:\windows\sed.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00080412 _____ C:\windows\grep.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00068096 _____ C:\windows\zip.exe
2013-11-21 08:31 - 2013-11-21 09:10 - 00000000 ____D C:\Qoobox
2013-11-21 08:30 - 2013-11-21 09:05 - 00000000 ____D C:\windows\erdnt
2013-11-21 08:23 - 2013-11-21 08:22 - 05146522 ____R (Swearware) C:\Documents and Settings\Birgitta\Desktop\ComboFix.exe
2013-11-19 14:39 - 2013-11-19 14:42 - 00013854 _____ C:\Documents and Settings\Birgitta\Desktop\Addition.txt
2013-11-19 14:34 - 2013-11-22 12:02 - 00011788 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders =======

2013-11-22 12:02 - 2013-11-19 14:34 - 00011788 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-11-22 12:00 - 2012-04-03 11:08 - 00000986 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-22 11:58 - 2012-04-03 11:08 - 00000982 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-22 11:57 - 2013-11-22 11:58 - 01090881 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST(1).exe
2013-11-22 11:57 - 2011-07-22 11:17 - 00000000 ____D C:\Documents and Settings\Birgitta\My Documents\Hämtade filer
2013-11-22 11:44 - 2013-11-21 11:12 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-22 11:43 - 2013-01-30 09:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-22 11:19 - 2013-11-22 11:19 - 00000888 _____ C:\Documents and Settings\Birgitta\Desktop\JRT.txt
2013-11-22 10:46 - 2013-11-22 10:46 - 00000000 ____D C:\windows\ERUNT
2013-11-22 09:14 - 2003-05-29 02:32 - 00548064 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-22 09:11 - 2011-07-22 09:50 - 01918209 _____ C:\windows\WindowsUpdate.log
2013-11-22 09:10 - 2011-07-22 09:59 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-22 09:09 - 2011-07-22 10:00 - 00000178 ___SH C:\Documents and Settings\Birgitta\ntuser.ini
2013-11-22 09:09 - 2011-07-22 10:00 - 00000000 ____D C:\Documents and Settings\Birgitta
2013-11-22 09:09 - 2011-07-22 09:59 - 00032638 _____ C:\windows\SchedLgU.Txt
2013-11-22 09:08 - 2013-11-22 08:43 - 00000000 ____D C:\AdwCleaner
2013-11-21 16:00 - 2013-07-03 19:17 - 00000000 __HDC C:\windows\$NtServicePackUninstall$
2013-11-21 15:30 - 2013-11-21 15:30 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-11-21 15:29 - 00000784 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-11-21 15:28 - 2013-11-21 15:28 - 01034531 _____ (Thisisu) C:\Documents and Settings\Birgitta\Desktop\JRT.exe
2013-11-21 15:27 - 2013-11-21 15:27 - 01085542 _____ C:\Documents and Settings\Birgitta\Desktop\adwcleaner.exe
2013-11-21 13:58 - 2013-11-21 13:58 - 00001126 _____ C:\windows\setupapi.log
2013-11-21 09:10 - 2013-11-21 09:10 - 00010976 _____ C:\ComboFix.txt
2013-11-21 09:10 - 2013-11-21 08:31 - 00000000 ____D C:\Qoobox
2013-11-21 09:10 - 2011-07-22 09:59 - 00000000 __SHD C:\Documents and Settings\LocalService
2013-11-21 09:10 - 2011-07-22 09:58 - 00000000 __SHD C:\Documents and Settings\NetworkService
2013-11-21 09:05 - 2013-11-21 08:30 - 00000000 ____D C:\windows\erdnt
2013-11-21 09:02 - 2004-08-04 11:00 - 00000227 _____ C:\windows\system.ini
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\SECURITY.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\default.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\system.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\software.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\SAM.tmp.LOG
2013-11-21 09:01 - 2003-05-29 02:30 - 00262144 _____ C:\windows\system32\config\SECURITY.bak
2013-11-21 09:01 - 2003-05-29 02:30 - 00262144 _____ C:\windows\system32\config\SAM.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 26214400 _____ C:\windows\system32\config\software.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 06815744 _____ C:\windows\system32\config\system.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 00262144 _____ C:\windows\system32\config\default.bak
2013-11-21 08:38 - 2013-11-21 08:38 - 00000000 _RSHD C:\cmdcons
2013-11-21 08:38 - 2003-05-29 02:30 - 00000327 __RSH C:\boot.ini
2013-11-21 08:22 - 2013-11-21 08:23 - 05146522 ____R (Swearware) C:\Documents and Settings\Birgitta\Desktop\ComboFix.exe
2013-11-21 08:19 - 2004-08-04 11:00 - 00002206 _____ C:\windows\system32\wpa.dbl
2013-11-19 14:42 - 2013-11-19 14:39 - 00013854 _____ C:\Documents and Settings\Birgitta\Desktop\Addition.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST
2013-11-02 08:38 - 2013-07-04 22:25 - 00000000 ____D C:\Documents and Settings\Birgitta\Local Settings\Application Data\Adobe
2013-11-02 08:38 - 2011-07-22 10:56 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Adobe
2013-11-01 07:58 - 2013-09-15 00:43 - 00000000 ____D C:\windows\system32\NtmsData
2013-11-01 07:57 - 2011-07-22 09:48 - 00000000 ____D C:\windows\Registration

Some content of TEMP:
====================
C:\Documents and Settings\Birgitta\Local Settings\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2004-08-04 11:00] - [2008-04-14 05:42] - 0108544 ____A (Microsoft Corporation) 0e776ed5f7cc9f94299e70461b7b8185 

C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

--- --- ---

--- --- ---

--

schrauber · 23.11.2013, 07:24

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

alter_schwed · 05.12.2013, 13:52

Hier kommen die logs. Das Problem mit dem Firefox scheint behoben, oder siehst Du noch etwas?
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=5eff0dd5956020468397dc3458d652c6
# engine=16138
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-05 12:30:39
# local_time=2013-12-05 01:30:39 (+0100, W. Europe Standard Time)
# country="Sweden"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1023 16777215 0 0 0 0 0 0
# compatibility_mode=1799 16774141 100 97 13233007 156874744 0 0
# scanned=33753
# found=0
# cleaned=0
# scan_time=10274

--
Results of screen317's Security Check version 0.99.76
Windows XP Service Pack 3 x86
Internet Explorer 6 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Avira Desktop
Antivirus out of date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.75.0.1300
CCleaner
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.8.800.168
Adobe Reader XI
Mozilla Firefox (25.0.1)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 14% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

--

--
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-12-2013 01
Ran by Birgitta (administrator) on BIRGITTA-9FD6B2 on 05-12-2013 12:08:47
Running from C:\Documents and Settings\Birgitta\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 6
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

() C:\WINDOWS\system32\ati2evxx.exe
() C:\WINDOWS\system32\WLTRYSVC.EXE
(Dell Inc.) C:\WINDOWS\system32\BCMWLTRY.EXE
(Microsoft Corporation) C:\WINDOWS\system32\scardsvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\WINDOWS\system32\ati2evxx.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dell Inc.) C:\WINDOWS\system32\WLTRAY.EXE
(Seagate) C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(ZTE) C:\Program Files\Connect Manager\Bin\mcserver.exe
(Huawei Technologies Co., Ltd.) C:\Documents and Settings\Birgitta\Application Data\Mobile Partner\ouc.exe
(Microsoft Corporation) C:\WINDOWS\system32\cmd.exe
() C:\Program Files\Connect Manager\Bin\dbus-daemon.exe
() C:\Program Files\Connect Manager\Bin\db_daemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ATIModeChange] - C:\WINDOWS\system32\Ati2mdxx.exe [28672 2001-09-04] (ATI Technologies, Inc.)
HKLM\...\Run: [ATIPTA] - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [335872 2003-07-29] (ATI Technologies, Inc.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\hpwuschd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [384800 2012-12-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\WINDOWS\system32\WLTRAY.EXE [1347584 2005-12-19] (Dell Inc.)
HKLM\...\Run: [DiscWizardMonitor.exe] - C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe [2638152 2011-06-30] (Seagate)
HKLM\...\Run: [Seagate Scheduler2 Service] - C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe [395152 2011-06-30] (Seagate)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll ()
HKCU\...\Run: [HW_OPENEYE_OUC_Mobile Partner] - C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [110592 2009-07-27] (Huawei Technologies Co., Ltd.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MCtlSvc.lnk
ShortcutTarget: MCtlSvc.lnk -> C:\Program Files\Connect Manager\Bin\mcserver.exe (ZTE)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKLM - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1372873530110
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks: URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\system32\shell32.dll [8461312 2008-04-14] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.10.2 10.0.10.3

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default
FF NewTab: about:home
FF Homepage: about:home
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\allaannonser-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\prisjakt-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\tyda-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\wikipedia-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-sv-SE.xml
FF Extension: No Name - C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\Extensions\WTB_GLOBAL.sqlite
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [85280 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [109344 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [323584 2003-07-29] ()
R2 SgtSch2Svc; C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe [845808 2011-06-30] (Seagate)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [1200128 2005-12-19] (Dell Inc.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83944 2012-11-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [134336 2012-11-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36552 2012-11-22] (Avira Operations GmbH & Co. KG)
R3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl5.sys [424320 2005-11-02] (Broadcom Corporation)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2008-10-28] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2008-10-28] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2008-10-28] (HP)
R3 HSFHWICH; C:\Windows\System32\DRIVERS\HSFHWICH.sys [189056 2003-07-03] (Conexant Systems, Inc.)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-09] (MBB Incorporated)
R3 O2SCBUS; C:\Windows\System32\DRIVERS\ozscr.sys [91395 2003-12-11] (O2Micro)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 STAC97; C:\Windows\System32\drivers\stac97.sys [258704 2004-05-12] (SigmaTel, Inc.)
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [125472 2013-09-11] (Acronis)
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [83392 2013-09-11] (Acronis)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [126976 2011-03-09] (ZTE Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [117504 2010-08-27] (Huawei Technologies Co., Ltd.)
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-05 12:07 - 2013-12-05 12:08 - 01092683 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST.exe
2013-12-05 10:38 - 2013-12-05 10:38 - 00001012 _____ C:\Documents and Settings\Birgitta\Desktop\security_check_2.txt
2013-12-05 10:31 - 2013-12-05 10:31 - 00001171 _____ C:\Documents and Settings\Birgitta\Desktop\security_check.txt
2013-12-04 17:46 - 2013-12-04 17:46 - 00891184 _____ C:\Documents and Settings\Birgitta\Desktop\SecurityCheck.exe
2013-11-22 11:19 - 2013-11-22 11:19 - 00000888 _____ C:\Documents and Settings\Birgitta\Desktop\JRT.txt
2013-11-22 10:46 - 2013-11-22 10:46 - 00000000 ____D C:\windows\ERUNT
2013-11-22 08:43 - 2013-11-22 09:08 - 00000000 ____D C:\AdwCleaner
2013-11-21 15:30 - 2013-11-21 15:30 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-11-21 15:29 - 00000784 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-11-21 15:28 - 2013-11-21 15:28 - 01034531 _____ (Thisisu) C:\Documents and Settings\Birgitta\Desktop\JRT.exe
2013-11-21 15:27 - 2013-11-21 15:27 - 01085542 _____ C:\Documents and Settings\Birgitta\Desktop\adwcleaner.exe
2013-11-21 13:58 - 2013-11-21 13:58 - 00001126 _____ C:\windows\setupapi.log
2013-11-21 11:12 - 2013-11-22 11:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-21 09:10 - 2013-11-21 09:10 - 00010976 _____ C:\ComboFix.txt
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\SECURITY.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\default.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\system.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\software.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\SAM.tmp.LOG
2013-11-21 08:38 - 2013-11-21 08:38 - 00000000 _RSHD C:\cmdcons
2013-11-21 08:38 - 2013-09-12 20:41 - 00000211 _____ C:\Boot.bak
2013-11-21 08:38 - 2004-08-03 23:00 - 00260272 __RSH C:\cmldr
2013-11-21 08:32 - 2011-06-26 07:45 - 00256000 _____ C:\windows\PEV.exe
2013-11-21 08:32 - 2010-11-07 18:20 - 00208896 _____ C:\windows\MBR.exe
2013-11-21 08:32 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00098816 _____ C:\windows\sed.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00080412 _____ C:\windows\grep.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00068096 _____ C:\windows\zip.exe
2013-11-21 08:31 - 2013-11-21 09:10 - 00000000 ____D C:\Qoobox
2013-11-21 08:30 - 2013-11-21 09:05 - 00000000 ____D C:\windows\erdnt
2013-11-21 08:23 - 2013-11-21 08:22 - 05146522 ____R (Swearware) C:\Documents and Settings\Birgitta\Desktop\ComboFix.exe
2013-11-19 14:39 - 2013-11-19 14:42 - 00013854 _____ C:\Documents and Settings\Birgitta\Desktop\Addition.txt
2013-11-19 14:34 - 2013-12-05 12:09 - 00011630 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders =======

2013-12-05 12:09 - 2013-11-19 14:34 - 00011630 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-12-05 12:08 - 2013-12-05 12:07 - 01092683 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST.exe
2013-12-05 12:00 - 2012-04-03 11:08 - 00000986 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-05 11:58 - 2012-04-03 11:08 - 00000982 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-05 10:38 - 2013-12-05 10:38 - 00001012 _____ C:\Documents and Settings\Birgitta\Desktop\security_check_2.txt
2013-12-05 10:34 - 2011-07-22 09:50 - 02040235 _____ C:\windows\WindowsUpdate.log
2013-12-05 10:33 - 2003-05-29 02:32 - 00548064 _____ C:\windows\system32\PerfStringBackup.INI
2013-12-05 10:31 - 2013-12-05 10:31 - 00001171 _____ C:\Documents and Settings\Birgitta\Desktop\security_check.txt
2013-12-05 10:27 - 2011-07-22 09:59 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-12-05 06:39 - 2011-07-22 10:00 - 00000178 ___SH C:\Documents and Settings\Birgitta\ntuser.ini
2013-12-05 06:39 - 2011-07-22 10:00 - 00000000 ____D C:\Documents and Settings\Birgitta
2013-12-05 06:39 - 2011-07-22 09:59 - 00032638 _____ C:\windows\SchedLgU.Txt
2013-12-04 22:27 - 2011-07-22 09:58 - 00000000 __SHD C:\Documents and Settings\NetworkService
2013-12-04 17:49 - 2011-07-22 11:17 - 00000000 ____D C:\Documents and Settings\Birgitta\My Documents\Hämtade filer
2013-12-04 17:46 - 2013-12-04 17:46 - 00891184 _____ C:\Documents and Settings\Birgitta\Desktop\SecurityCheck.exe
2013-12-04 17:38 - 2013-01-30 09:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-04 17:38 - 2011-07-22 09:59 - 00000000 __SHD C:\Documents and Settings\LocalService
2013-12-04 17:38 - 2004-08-04 11:00 - 00002206 _____ C:\windows\system32\wpa.dbl
2013-11-22 11:44 - 2013-11-21 11:12 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-22 11:19 - 2013-11-22 11:19 - 00000888 _____ C:\Documents and Settings\Birgitta\Desktop\JRT.txt
2013-11-22 10:46 - 2013-11-22 10:46 - 00000000 ____D C:\windows\ERUNT
2013-11-22 09:08 - 2013-11-22 08:43 - 00000000 ____D C:\AdwCleaner
2013-11-21 16:00 - 2013-07-03 19:17 - 00000000 __HDC C:\windows\$NtServicePackUninstall$
2013-11-21 15:30 - 2013-11-21 15:30 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-11-21 15:29 - 00000784 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-11-21 15:28 - 2013-11-21 15:28 - 01034531 _____ (Thisisu) C:\Documents and Settings\Birgitta\Desktop\JRT.exe
2013-11-21 15:27 - 2013-11-21 15:27 - 01085542 _____ C:\Documents and Settings\Birgitta\Desktop\adwcleaner.exe
2013-11-21 13:58 - 2013-11-21 13:58 - 00001126 _____ C:\windows\setupapi.log
2013-11-21 09:10 - 2013-11-21 09:10 - 00010976 _____ C:\ComboFix.txt
2013-11-21 09:10 - 2013-11-21 08:31 - 00000000 ____D C:\Qoobox
2013-11-21 09:05 - 2013-11-21 08:30 - 00000000 ____D C:\windows\erdnt
2013-11-21 09:02 - 2004-08-04 11:00 - 00000227 _____ C:\windows\system.ini
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\SECURITY.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\default.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\system.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\software.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\SAM.tmp.LOG
2013-11-21 09:01 - 2003-05-29 02:30 - 00262144 _____ C:\windows\system32\config\SECURITY.bak
2013-11-21 09:01 - 2003-05-29 02:30 - 00262144 _____ C:\windows\system32\config\SAM.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 26214400 _____ C:\windows\system32\config\software.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 06815744 _____ C:\windows\system32\config\system.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 00262144 _____ C:\windows\system32\config\default.bak
2013-11-21 08:38 - 2013-11-21 08:38 - 00000000 _RSHD C:\cmdcons
2013-11-21 08:38 - 2003-05-29 02:30 - 00000327 __RSH C:\boot.ini
2013-11-21 08:22 - 2013-11-21 08:23 - 05146522 ____R (Swearware) C:\Documents and Settings\Birgitta\Desktop\ComboFix.exe
2013-11-19 14:42 - 2013-11-19 14:39 - 00013854 _____ C:\Documents and Settings\Birgitta\Desktop\Addition.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST

Some content of TEMP:
====================
C:\Documents and Settings\Birgitta\Local Settings\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2004-08-04 11:00] - [2008-04-14 05:42] - 0108544 ____A (Microsoft Corporation) 0e776ed5f7cc9f94299e70461b7b8185 

C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

--- --- ---

schrauber · 06.12.2013, 10:04

Windows und IE updaten, Flash updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKLM - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

alter_schwed · 20.12.2013, 14:25

Leider funktioniert das mit dem Updaten nicht. Windows hat nach einem Reperaturversuchs von "Windows Update" die Update Funktionen rausgeworfen und jetzt funktioniert das Updaten nicht mehr. Auch bei den anderen Programmen wie Acrobat etc scheinen die Automatikfunktionen nicht "mehr" vorhanden zu sein.

schrauber · 21.12.2013, 12:07

Downloade dir bitte Windows Repair (All In One) von hier.

Installiere das Programm. Starte es, nachdem die Installation abgeschlossen wurde.
Klicke auf Step 2 und drücke unter Check Disk auf Do It.
Wenn der Vorgang abgeschlossen ist, klicke auf Step 3 und drücke unter System File Check auf Do It.
Nachdem der Vorgang abgeschlossen ist, klicke auf Start Repairs, wähle den Advanced Mode und drücke Start.
Gehe bitte sicher, dass die Kästchen wie unten zu sehen angehakt sind. Bitte hake zusätzlich noch Set Windows Services to Default Startup an.
Hake Restart System when Finished an.
Drücke Start.

alter_schwed · 22.12.2013, 16:17

Hallo,

es kann ja ein zeitlicher Zufall sein, aber beim Entpacken des heruntergeladenen Zips meldete sich Avira mit:

C:\Documents and Settings\...\vss_start.exe enthält 'TR/Dropper.Gen' was blocked.

Ich habe dann auch Remove geklickt.

Ich setze jetzt mit der von Dir genannten Reperatur fort...

Das Aussehen des "starts repair" ist anders. Außerdem will das Programm die Registry sichern was aber nicht gehen will, da ein anderer Process zu "busy" ist und dann friert das Programm ein.

Was soll ich jetzt tun?

schrauber · 23.12.2013, 09:02

Überspring das alles. Am Schluss auf Start klicken, dann die Häkchen setzen

alter_schwed · 03.01.2014, 16:12

Hier ist das Fixlist Protokoll:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-01-2014 01
Ran by Birgitta at 2014-01-03 16:11:27 Run:1
Running from C:\Documents and Settings\Birgitta\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKLM - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}

*****************

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\URL => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\SuggestionsURL_JSON => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\TopResultURLFallback => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\URL => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\SuggestionsURL_JSON => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\TopResultURLFallback => Value deleted successfully.

==== End of Fixlog ====

23.12.2013, 09:02	#14
schrauber /// the machine /// TB-Ausbilder	Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Überspring das alles. Am Schluss auf Start klicken, dann die Häkchen setzen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt

Log-Analyse und Auswertung: Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt