windows 7: Internetseiten werden nicht geöffnet / Werbefenster ploppen auf

Auurora · 15.01.2015, 02:47

Hallo lieber Helfer. Ich danke dir schonmal im vorraus !

Ich habe ein Problem mit Windows 7:
Öffnen von Internetseiten:
Viele Seiten brauchen längere Zeit um sich zu öffnen und auch Werbungen ploppen auf. Einige Seiten lassen sich gar nicht öffnen. Das Problem besteht schon seit längerem.

Ich hatte keine Ahnung was das zu bedeuten hat und habe mir nichts dabei gedacht.
Ich spiele ein Spiel im Internet "Drakensang Online"(das durch den virus auch betroffen ist). Da hat mir der Daaniel geraten mich an euch zu wenden, um meine Probleme zu beschreiben.

Unter anderem habe ich Kaspersky eine vollständige Untersuchung angewiesen, nach dem mir gesagt wurde ich soll ein gefundene bedrohung löschen woraufhin ich dies tat.

Ich hoffe, ich habe mein Problem so gut wie möglich beschreiben können, damit man mir helfen kann.

schrauber · 15.01.2015, 05:49

Hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Auurora · 15.01.2015, 07:03

Hallo, danke für deine schnelle antwort
ich hoffe ich schicke dir das richtige

FRST:
FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-01-2015 01
Ran by medion (administrator) on MEDION-PC on 15-01-2015 06:33:36
Running from C:\Users\medion\Downloads
Loaded Profiles: medion (Available profiles: medion)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Smartbar) C:\Users\medion\AppData\Local\Smartbar\Application\SafeFinder.exe
() C:\Program Files (x86)\Boost\BoostUpdater.exe
() C:\Program Files (x86)\BrowserSafeguard\BrowserSafeguard.exe
() C:\Program Files (x86)\PennyBee\PennyBee.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
() C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\medion\AppData\Local\Smartbar\Application\Lrcnta.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [BrowserSafeguard] => C:\Program Files (x86)\BrowserSafeguard\BrowserSafeguard.exe [930816 2014-08-02] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30872672 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\Run: [Browser Infrastructure Helper] => C:\Users\medion\AppData\Local\Smartbar\Application\SafeFinder.exe [28160 2014-08-27] (Smartbar)
HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\Run: [RocketTab] => C:\Users\medion\AppData\Local\Search Extensions\Client.exe [2647552 2015-01-07] ()
HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\Run: [RocketTab Update Task] => C:\Users\medion\AppData\Local\Search Extensions\uninstall.exe [6838272 2015-01-05] ()
HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\MountPoints2: {eef328ba-150e-11e4-a9bb-806e6f6e6963} - E:\autorun.exe
AppInit_DLLs: C:\Users\medion\AppData\Local\Smartbar\Application\Resources\crdlil64.dll => C:\Users\medion\AppData\Local\Smartbar\Application\Resources\crdlil64.dll [71680 2014-12-08] ()
Startup: C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BoostUpdater.lnk
ShortcutTarget: BoostUpdater.lnk -> C:\Program Files (x86)\Boost\BoostUpdater.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-767043884-2352323595-830612465-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [S-1-5-21-767043884-2352323595-830612465-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-767043884-2352323595-830612465-1000] => http=127.0.0.1:49204;https=127.0.0.1:49204
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A&q={searchTerms}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = Search,,
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q={searchTerms}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q={searchTerms}
HKU\S-1-5-21-767043884-2352323595-830612465-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q={searchTerms}
HKU\S-1-5-21-767043884-2352323595-830612465-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Astromenda Search
HKU\S-1-5-21-767043884-2352323595-830612465-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland
HKU\S-1-5-21-767043884-2352323595-830612465-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = istartsurf
HKU\S-1-5-21-767043884-2352323595-830612465-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_secureddownload_14_40_ff&cd=2XzuyEtN2Y1L1QzuyBzzzytBzy0CyE0FtA0F0FyDtB0EyB0EtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtCyC0A0DtCtAzytGtCtCzyzztGyE0CyBtDtGyBzytB0AtGtCyB0FtCtDyEtBtDtAzy0C0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytD0F0AyEtB0AzztG0AzzyEzztGyEtCyBzztGzy0B0B0BtGtBzz0FyDyE0AtByBtAzy0C0E2Q&cr=649507380&ir=
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q={searchTerms}
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-767043884-2352323595-830612465-1000 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-767043884-2352323595-830612465-1000 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-767043884-2352323595-830612465-1000 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-767043884-2352323595-830612465-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A&q={searchTerms}
BHO: SafeFinder SmartbarEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Boost -> {8DE6FC60-E023-4AD7-A3B7-591E1460E7F7} -> C:\Program Files (x86)\Boost\64Boost.dll (Jigsaw)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: SafeFinder SmartbarEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Boost -> {8DE6FC60-E023-4AD7-A3B7-591E1460E7F7} -> C:\Program Files (x86)\Boost\Boost.dll (Jigsaw)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: AllDaySavings -> {fbdff406-2c4c-5d35-8469-34bb67ea3353} -> C:\Program Files\A7F8482B-1D99-4EC9-B887-8B130AB7E131\kzhxnitccw.dll ()
Toolbar: HKLM - SafeFinder Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - SafeFinder Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: 127.0.0.1			d3oxij66pru1i3.cloudfront.net
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694
FF NewTab: hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmhoul8vGQhMJhn14eyvGkNHBzRbX9d-XK76jUm7jPwGDGgPXGo4jVfpzjTMy2OEFzyx5xuHNeX2Ph1X58qkgQ,,
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Yahoo DE
FF Keyword.URL: hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAspvbzZvQ2FfEt0HmHgw5xQWw,,&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF SearchPlugin: C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694\searchplugins\Astromenda.xml
FF SearchPlugin: C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694\searchplugins\bingp.xml
FF SearchPlugin: C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694\searchplugins\SafeFinder Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\istartsurf.xml
FF Extension: SafeFinder Smartbar - C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694\Extensions\{59d36f11-5a7b-c99b-8b94-fff559c30519} [2014-10-20]
FF Extension: Search App - C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694\Extensions\{1d33817b-02d7-4cfa-a618-2d2fe2f6add4}.xpi [2014-12-29]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-29]
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\3admhrwa.default\extensions\faststartff@gmail.com
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Модуль перевірки посилань - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-08-04]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [Not Found]
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM\...\Chrome\Extension: [pfkfdlcdbajamklbneflfbcmfgddmpae] - No Path
CHR HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\Chrome\Extension: [pfkfdlcdbajamklbneflfbcmfgddmpae] - No Path
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [pfkfdlcdbajamklbneflfbcmfgddmpae] - No Path
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2014-05-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AllDaySavingsService64; C:\Program Files (x86)\A7F8482B-1D99-4EC9-B887-8B130AB7E131\etmajyzoqm64.exe [172544 2014-07-31] () [File not signed]
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-05-28] (Kaspersky Lab ZAO)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S2 LPTSystemUpdater; C:\Program Files (x86)\LPT\srpts.exe [32768 2014-08-27] () <==== ATTENTION
R2 PennyBee; C:\Program Files (x86)\PennyBee\PennyBee.exe [54272 2014-09-17] () [File not signed] <==== ATTENTION
R2 Verifies and fixes application compatibility issues; C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [87208 2015-01-08] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-28] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-05-28] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-05-28] (Kaspersky Lab ZAO)
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x64.sys [75888 2011-09-08] (Atheros Communications, Inc.)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [46376 2014-07-31] (NetFilterSDK.com)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-15 06:33 - 2015-01-15 06:37 - 00024041 _____ () C:\Users\medion\Downloads\FRST.txt
2015-01-15 06:33 - 2015-01-15 06:34 - 00000000 ____D () C:\FRST
2015-01-15 06:30 - 2015-01-15 06:30 - 02125312 _____ (Farbar) C:\Users\medion\Downloads\FRST64(1).exe
2015-01-15 06:19 - 2015-01-15 06:19 - 02125312 _____ (Farbar) C:\Users\medion\Downloads\FRST64.exe
2015-01-14 23:01 - 2015-01-14 23:01 - 355434482 _____ () C:\Windows\MEMORY.DMP
2015-01-14 23:01 - 2015-01-14 23:01 - 00325744 _____ () C:\Windows\Minidump\011415-28454-01.dmp
2015-01-14 21:44 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 21:44 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 21:44 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 21:43 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 21:43 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 21:43 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 21:43 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 21:43 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 21:43 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 21:43 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 21:43 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 21:43 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 21:43 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 21:34 - 2015-01-14 21:34 - 05013680 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-01-13 23:02 - 2015-01-13 23:02 - 00058016 _____ () C:\Users\medion\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-13 23:01 - 2015-01-15 06:11 - 00000280 _____ () C:\Windows\setupact.log
2015-01-13 23:01 - 2015-01-13 23:01 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-13 23:00 - 2015-01-13 23:01 - 00267816 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-13 22:51 - 2015-01-13 22:51 - 00000000 ____D () C:\Program Files (x86)\DriverRestore
2015-01-13 06:03 - 2015-01-15 06:42 - 00000112 _____ () C:\ProgramData\1X03Yc.dat
2015-01-12 22:55 - 2015-01-12 21:27 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-01-12 22:55 - 2015-01-12 21:27 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-01-12 22:55 - 2015-01-12 21:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-12 21:20 - 2015-01-12 21:24 - 29727656 _____ (Oracle Corporation) C:\Users\medion\Downloads\jre-8u25-windows-i586(1).exe
2015-01-12 19:46 - 2015-01-12 19:49 - 29727656 _____ (Oracle Corporation) C:\Users\medion\Downloads\jre-8u25-windows-i586.exe
2015-01-10 22:23 - 2015-01-10 22:24 - 00000000 ____D () C:\Users\medion\Desktop\dso bilder
2015-01-10 21:20 - 2015-01-10 21:20 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-10 21:16 - 2015-01-15 06:16 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Compatibility Verifier
2015-01-10 21:05 - 2015-01-10 21:05 - 00262144 _____ () C:\Windows\system32\config\elam
2015-01-09 19:46 - 2015-01-10 00:23 - 00000000 ____D () C:\Users\medion\AppData\Local\7f313c40-9623-4e17-a373-ed41158fe3d8
2015-01-03 17:23 - 2015-01-03 17:24 - 00001363 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
2015-01-03 17:20 - 2015-01-03 17:24 - 00001338 _____ () C:\Users\medion\Desktop\Chrome.lnk
2015-01-03 17:20 - 2015-01-03 17:20 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome
2015-01-03 17:19 - 2015-01-03 17:20 - 00000000 ____D () C:\Users\medion\AppData\Local\Chrome
2014-12-29 03:50 - 2014-12-29 03:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-29 01:52 - 2014-12-29 01:52 - 00000000 __SHD () C:\Users\medion\AppData\Local\EmieBrowserModeList
2014-12-24 05:05 - 2014-12-24 05:05 - 00000000 ____D () C:\Users\medion\AppData\Roaming\ASP
2014-12-19 17:50 - 2014-12-19 17:50 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(5).exe
2014-12-19 17:49 - 2014-12-19 17:49 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(4).exe
2014-12-19 17:46 - 2014-12-19 17:46 - 00022528 _____ () C:\Users\medion\AppData\Local\dsisetup23430102.exe
2014-12-19 17:45 - 2014-12-19 17:45 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(3).exe
2014-12-19 17:42 - 2014-12-19 17:42 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(2).exe
2014-12-19 17:30 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-19 17:30 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-15 06:33 - 2014-08-01 17:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-15 06:30 - 2014-08-04 12:26 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-15 06:21 - 2009-07-14 05:45 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-15 06:21 - 2009-07-14 05:45 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-15 06:17 - 2014-07-26 22:58 - 01225214 _____ () C:\Windows\WindowsUpdate.log
2015-01-15 06:14 - 2014-10-04 22:25 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Skype
2015-01-15 06:11 - 2014-10-04 13:46 - 00000296 _____ () C:\Windows\Tasks\WSE_Astromenda.job
2015-01-15 06:11 - 2014-10-04 13:45 - 00000296 _____ () C:\Windows\Tasks\PennyBee.job
2015-01-15 06:11 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-15 03:10 - 2014-07-26 23:20 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{68480687-BE92-42A6-8330-8456ED388A7C}
2015-01-15 01:36 - 2014-10-29 21:31 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 01:30 - 2014-11-16 15:39 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 23:01 - 2014-08-01 16:31 - 00000000 ____D () C:\Windows\Minidump
2015-01-14 21:35 - 2014-08-01 17:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-14 21:34 - 2014-08-01 17:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-14 21:34 - 2014-08-01 17:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 00:17 - 2014-12-12 16:07 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online
2015-01-13 23:06 - 2014-08-02 13:35 - 00000000 ____D () C:\Program Files\AllDaySavings
2015-01-13 22:51 - 2014-08-02 14:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverRestore
2015-01-13 22:50 - 2014-10-20 13:04 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-01-13 22:49 - 2014-10-20 12:58 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Systweak
2015-01-12 22:55 - 2014-12-08 23:45 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-12 21:52 - 2014-08-01 16:08 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-12 21:52 - 2014-07-26 23:12 - 00001439 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-12 21:52 - 2014-07-26 23:12 - 00001417 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-01-12 21:29 - 2014-08-01 16:01 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-12 21:27 - 2014-12-08 23:49 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-01-12 21:27 - 2014-12-08 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-12 19:46 - 2014-08-01 16:08 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-10 23:51 - 2014-08-02 13:33 - 00000000 ____D () C:\Program Files\005
2015-01-10 21:05 - 2014-08-02 13:33 - 00000000 ____D () C:\Program Files (x86)\BrowserSafeguard
2015-01-07 22:32 - 2014-11-13 12:42 - 00000000 ____D () C:\Users\medion\AppData\Local\Search Extensions
2015-01-07 12:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-03 17:23 - 2014-10-04 13:59 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-03 16:52 - 2014-10-04 22:24 - 00000000 ____D () C:\ProgramData\Skype
2015-01-03 16:51 - 2014-10-04 22:24 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-30 12:59 - 2014-08-01 16:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-30 12:59 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-30 02:46 - 2014-10-04 21:46 - 00000224 _____ () C:\Users\medion\AppData\Roaming\WB.CFG
2014-12-30 02:34 - 2014-08-04 12:30 - 00002330 _____ () C:\Users\medion\Desktop\Sicherer Zahlungsverkehr.lnk
2014-12-29 01:36 - 2014-08-04 12:29 - 00001124 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-12-24 05:05 - 2014-08-01 15:54 - 00000000 ____D () C:\Program Files (x86)\Drakensang Online
2014-12-19 17:46 - 2014-10-10 20:46 - 00000010 _____ () C:\Users\medion\AppData\Local\DSI.DAT
2014-12-19 17:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

Files to move or delete:
====================
C:\ProgramData\1X03Yc.dat


Some content of TEMP:
====================
C:\Users\medion\AppData\Local\Temp\DRHelper_uninstallComplete.exe
C:\Users\medion\AppData\Local\Temp\lbk1nwn9.dll
C:\Users\medion\AppData\Local\Temp\pbvjckv0.dll
C:\Users\medion\AppData\Local\Temp\rge4qqws.dll
C:\Users\medion\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\medion\AppData\Local\Temp\System.Data.SQLite7f313c40-9623-4e17-a373-ed41158fe3d8.dll
C:\Users\medion\AppData\Local\Temp\zv43l6fh.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-27 23:44

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-01-2015 01
Ran by medion at 2015-01-15 06:45:43
Running from C:\Users\medion\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
allday savings (HKLM\...\A7F8482B-1D99-4EC9-B887-8B130AB7E131) (Version: 2.0.1 - allday savings)
Boost for Internet Explorer (HKLM-x32\...\Boost) (Version: 3.0.0.10 - Verti Technology Group, Inc.)
BrowserSafeguard with RocketTab (HKLM-x32\...\BrowserSafeguard) (Version:  - BrowserSafeguard with RocketTab) <==== ATTENTION
BrowserSafeguard with RocketTab (HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\RocketTab) (Version:  - BrowserSafeguard with RocketTab) <==== ATTENTION
CCleaner (HKLM\...\CCleaner) (Version: 4.17 - Piriform)
Chromium Browser (HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\Chromium) (Version: 41.0.2231.0 - Chrome)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
istartsurf uninstall (HKLM-x32\...\istartsurf uninstall) (Version:  - istartsurf) <==== ATTENTION
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
LPT System Updater Service (HKLM-x32\...\{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}) (Version: 1.0.0.0 - LPT) <==== ATTENTION
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - JDi Backup Ltd) <==== ATTENTION
Opera Stable 25.0.1614.63 (HKLM-x32\...\Opera 25.0.1614.63) (Version: 25.0.1614.63 - Opera Software ASA)
PennyBee (HKLM-x32\...\PennyBee) (Version: 1.0.4.1 - PennyBee) <==== ATTENTION!
PennyBeeUpdate (HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\PennyBee) (Version:  - PennyBeeUpdate) <==== ATTENTION
SafeFinder Smartbar (HKLM-x32\...\{1898B668-CCF5-429F-A86F-9837E5439D77}) (Version: 11.114.72.19232 - Linkury Ltd.) <==== ATTENTION
Search App by Ask (HKLM-x32\...\{4F524A2D-5350-4500-76A7-A758B70C1101}) (Version: 12.17.1.65 - APN, LLC) <==== ATTENTION
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Windows Essentials Codec Pack 5.0 (HKLM-x32\...\Windows Essentials Codec Pack) (Version: 5.0 - Windows Essentials Codec Pack)
WSE_Astromenda (HKLM-x32\...\WSE_Astromenda) (Version:  - WSE_Astromenda) <==== ATTENTION!

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

02-01-2015 23:39:55 Windows Update
04-01-2015 19:00:20 Windows-Sicherung
06-01-2015 17:13:07 Windows Update
12-01-2015 22:46:23 Removed Java 7 Update 71
12-01-2015 22:53:21 Removed Java 7 Update 71
13-01-2015 12:59:28 Windows Update
15-01-2015 01:30:16 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-10-20 12:58 - 00000867 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1			d3oxij66pru1i3.cloudfront.net

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0D604FC8-2ED3-4A2F-A129-DCCB13AA33C2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-08-21] (Piriform Ltd)
Task: {14F9F058-2C77-4D1E-A97C-8C145680A242} - \PennyBee No Task File <==== ATTENTION
Task: {601F9A9B-39ED-436C-A3ED-7E63E9EAA990} - System32\Tasks\Games\UpdateCheck_S-1-5-21-767043884-2352323595-830612465-1000
Task: {927A22DD-F4F9-40C6-9FEB-88EBC14764A4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)
Task: {A6F7FFC8-90AE-49CB-B01A-9156E495585C} - \WSE_Astromenda No Task File <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\PennyBee.job => C:\Users\medion\AppData\Roaming\PennyBee\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\WSE_Astromenda.job => C:\Users\medion\AppData\Roaming\WSE_AS~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-01-29 22:02 - 2014-01-29 22:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-04-21 20:24 - 2014-04-21 20:24 - 00392704 _____ () C:\Program Files (x86)\Boost\BoostUpdater.exe
2014-08-02 13:33 - 2014-08-02 13:33 - 00930816 _____ () C:\Program Files (x86)\BrowserSafeguard\BrowserSafeguard.exe
2014-09-17 08:54 - 2014-09-17 08:54 - 00054272 _____ () C:\Program Files (x86)\PennyBee\PennyBee.exe
2015-01-10 21:16 - 2015-01-08 20:58 - 00087208 _____ () C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
2015-01-10 21:16 - 2015-01-08 21:51 - 51252392 _____ () C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
2014-08-27 17:50 - 2014-08-27 17:50 - 00023552 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Lrcnta.exe
2013-06-17 11:35 - 2013-06-17 11:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 13:52 - 2013-05-08 13:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00050176 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll
2014-08-27 17:52 - 2014-08-27 17:52 - 00086016 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\srau.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00165888 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 02425344 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00066560 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\spbl.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00158208 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00014336 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\siem.dll
2014-08-27 17:52 - 2014-08-27 17:52 - 00067584 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\sppsm.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00696832 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00014848 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00078848 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00027136 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll
2014-08-27 17:52 - 2014-08-27 17:52 - 00070144 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\srut.dll
2014-08-27 17:52 - 2014-08-27 17:52 - 00029184 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\srsbs.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00065536 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00150016 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\smti.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00073728 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\smsp.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00011776 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\sidc.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00030720 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\smtu.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00038912 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\smta.dll
2014-08-27 17:52 - 2014-08-27 17:52 - 00030720 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\srom.dll
2014-08-27 17:52 - 2014-08-27 17:52 - 00047104 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\srbu.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00024064 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\sgml.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00061952 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll
2014-08-27 17:52 - 2014-08-27 17:52 - 00025088 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\srpdm.dll
2014-08-27 17:50 - 2014-08-27 17:50 - 00043520 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\MACTrackBarLib.dll
2014-08-27 17:43 - 2014-08-27 17:43 - 00026624 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00035328 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll
2014-08-27 17:51 - 2014-08-27 17:51 - 00193024 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\sgmu.dll
2014-05-12 10:21 - 2014-05-12 10:21 - 00061440 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\AxInterop.WMPLib.dll
2014-08-27 17:52 - 2014-08-27 17:52 - 00254976 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\srns.dll
2014-12-29 03:50 - 2014-12-29 03:51 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2015-01-10 21:16 - 2015-01-07 22:22 - 01360552 _____ () C:\Users\medion\AppData\Roaming\Compatibility Verifier\libglesv2.dll
2015-01-10 21:16 - 2015-01-07 22:22 - 00214184 _____ () C:\Users\medion\AppData\Roaming\Compatibility Verifier\libegl.dll
2015-01-10 21:16 - 2015-01-07 22:22 - 00985768 _____ () C:\Users\medion\AppData\Roaming\Compatibility Verifier\ffmpegsumo.dll
2015-01-10 21:16 - 2015-01-07 22:22 - 16827048 _____ () C:\Users\medion\AppData\Roaming\Compatibility Verifier\NPSWF32_15_0_0_189.dll
2014-08-27 17:50 - 2014-08-27 17:50 - 00032768 _____ () C:\Users\medion\AppData\Local\Smartbar\Application\lrcnt.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-767043884-2352323595-830612465-500 - Administrator - Disabled)
Gast (S-1-5-21-767043884-2352323595-830612465-501 - Limited - Disabled)
medion (S-1-5-21-767043884-2352323595-830612465-1000 - Administrator - Enabled) => C:\Users\medion

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/15/2015 06:13:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/15/2015 03:58:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022ecf0
ID des fehlerhaften Prozesses: 0x17d0
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (01/15/2015 03:57:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022ecf0
ID des fehlerhaften Prozesses: 0x1ca0
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (01/15/2015 03:57:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022ecf0
ID des fehlerhaften Prozesses: 0x9c0
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (01/15/2015 03:26:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022ecf0
ID des fehlerhaften Prozesses: 0x2324
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (01/15/2015 03:25:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0xe34
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (01/15/2015 03:25:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022ecf0
ID des fehlerhaften Prozesses: 0x1b24
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (01/15/2015 03:24:53 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022ecf0
ID des fehlerhaften Prozesses: 0x1ff0
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (01/15/2015 03:24:44 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022ecf0
ID des fehlerhaften Prozesses: 0x1bcc
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3

Error: (01/15/2015 03:23:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54af4124
Ausnahmecode: 0x4000001f
Fehleroffset: 0x0022ecf0
ID des fehlerhaften Prozesses: 0x9e0
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3


System errors:
=============
Error: (01/15/2015 06:13:40 AM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005

Error: (01/15/2015 06:12:11 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LPT System Updater Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/15/2015 06:12:11 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LPT System Updater Service erreicht.

Error: (01/15/2015 01:47:07 AM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 46.

Error: (01/15/2015 01:30:24 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (01/14/2015 11:01:51 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x000000f4 (0x0000000000000003, 0xfffffa8005d51b30, 0xfffffa8005d51e10, 0xfffff80002fdf270)C:\Windows\MEMORY.DMP011415-28454-01

Error: (01/14/2015 11:01:44 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎14.‎01.‎2015 um 23:00:04 unerwartet heruntergefahren.

Error: (01/13/2015 11:01:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LPT System Updater Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/13/2015 11:01:48 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LPT System Updater Service erreicht.


Microsoft Office Sessions:
=========================
Error: (01/15/2015 06:13:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/15/2015 03:58:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124compatibilitycheck.exe0.0.0.054af41244000001f0022ecf017d001d0305c70bc6586C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe673efd4e-9c62-11e4-9807-386077708ece

Error: (01/15/2015 03:57:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124compatibilitycheck.exe0.0.0.054af41244000001f0022ecf01ca001d0306f0aaa7f44C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe4f49d380-9c62-11e4-9807-386077708ece

Error: (01/15/2015 03:57:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124compatibilitycheck.exe0.0.0.054af41244000001f0022ecf09c001d0306f04d6b66dC:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe4a233d4d-9c62-11e4-9807-386077708ece

Error: (01/15/2015 03:26:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124compatibilitycheck.exe0.0.0.054af41244000001f0022ecf0232401d0306a96aafd6cC:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exed9b8ee40-9c5d-11e4-9807-386077708ece

Error: (01/15/2015 03:25:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124ntdll.dll6.1.7601.18247521ea8e7c0000374000ce753e3401d0305c94c06fd7C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Windows\SysWOW64\ntdll.dllc9582f9c-9c5d-11e4-9807-386077708ece

Error: (01/15/2015 03:25:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124compatibilitycheck.exe0.0.0.054af41244000001f0022ecf01b2401d0306a777e56e1C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exebaabde1c-9c5d-11e4-9807-386077708ece

Error: (01/15/2015 03:24:53 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124compatibilitycheck.exe0.0.0.054af41244000001f0022ecf01ff001d0306a6c8e5811C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeb024b4c5-9c5d-11e4-9807-386077708ece

Error: (01/15/2015 03:24:44 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124compatibilitycheck.exe0.0.0.054af41244000001f0022ecf01bcc01d0306a6693a5b8C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeaa461654-9c5d-11e4-9807-386077708ece

Error: (01/15/2015 03:23:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054af4124compatibilitycheck.exe0.0.0.054af41244000001f0022ecf09e001d0306a487e1893C:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\medion\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe8da63eb8-9c5d-11e4-9807-386077708ece


CodeIntegrity Errors:
===================================
  Date: 2014-12-29 01:35:44.988
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-29 01:35:44.984
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-29 01:35:32.119
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-29 01:35:32.114
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-29 01:33:09.743
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-29 01:33:09.737
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-29 01:33:07.218
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-29 01:33:07.214
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-29 01:32:57.106
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-29 01:32:57.104
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU B950 @ 2.10GHz
Percentage of memory in use: 59%
Total physical RAM: 4007.13 MB
Available physical RAM: 1618.75 MB
Total Pagefile: 8012.43 MB
Available Pagefile: 5164.61 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:414.66 GB) (Free:372.11 GB) NTFS
Drive d: (Recover) (Fixed) (Total:48 GB) (Free:21.6 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 97BE5B6A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=414.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=50 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

==================== End Of Log ============================

schrauber · 15.01.2015, 07:17

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

BrowserSafeguard with RocketTab (HKLM-x32\...\BrowserSafeguard) (Version: - BrowserSafeguard with RocketTab) <==== ATTENTION

BrowserSafeguard with RocketTab (HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\RocketTab) (Version: - BrowserSafeguard with RocketTab) <==== ATTENTION

istartsurf uninstall

LPT System Updater Service

MyPC Backup

PennyBee

PennyBeeUpdate

SafeFinder Smartbar

Search App by Ask

WSE_Astromenda
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Auurora · 15.01.2015, 07:44

den ersten schritt habe ich gemacht
er zeigt mir eine meldung :

uninstall ist fehlgeschlgen !
vermutlich ungültiger deinstall befehl
ich habe auf "ok" gedrückt und nun scannt er weiter

dieses problem hat sich erledigt

die suche nach den programmen wurde nicht gefunden :

BrowserSafeguard with RocketTab (HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\RocketTab) (Version: - BrowserSafeguard with RocketTab) <==== ATTENTION

MyPC Backup

PennyBeeUpdate

SafeFinder Smartbar

schrauber · 15.01.2015, 08:29

Deinstalliere diese Programme dann bitte normal über Windows

Auurora · 15.01.2015, 09:07

kann ich nun weiter machen mit dem instalieren von Combofix ?

okay da finde ich sie

hab ich gemacht ich folge nun den weiteren anweisungen

wie deaktiviere ich mein kaspersky
malware/spyware

danke ich habe kaspersky deaktiviert

C:\Combofix.txt:

Code:

ATTFilter

ComboFix 15-01-08.01 - medion 15.01.2015   8:51.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4007.2349 [GMT 1:00]
ausgeführt von:: c:\users\medion\Downloads\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\medion\AppData\Local\dsisetup23430102.exe
c:\users\medion\AppData\Local\dsisetup8166182.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-12-15 bis 2015-01-15  ))))))))))))))))))))))))))))))
.
.
2015-01-15 08:02 . 2015-01-15 08:02	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-01-15 06:31 . 2015-01-15 06:31	--------	d-----w-	c:\program files (x86)\VS Revo Group
2015-01-15 05:33 . 2015-01-15 05:53	--------	d-----w-	C:\FRST
2015-01-14 22:14 . 2015-01-14 22:14	75888	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{515C05BE-1D63-4B3C-AE33-F10FD56A2CA0}\offreg.dll
2015-01-14 20:44 . 2014-12-06 04:17	303616	----a-w-	c:\windows\system32\nlasvc.dll
2015-01-14 20:44 . 2014-12-06 03:50	156672	----a-w-	c:\windows\SysWow64\ncsi.dll
2015-01-14 20:44 . 2014-12-06 03:50	52224	----a-w-	c:\windows\SysWow64\nlaapi.dll
2015-01-14 20:43 . 2014-12-11 17:47	52736	----a-w-	c:\windows\system32\TSWbPrxy.exe
2015-01-14 20:43 . 2014-12-19 03:06	210432	----a-w-	c:\windows\system32\profsvc.dll
2015-01-14 20:43 . 2014-12-19 01:46	141312	----a-w-	c:\windows\system32\drivers\mrxdav.sys
2015-01-14 20:43 . 2014-12-12 05:35	5553592	----a-w-	c:\windows\system32\ntoskrnl.exe
2015-01-14 20:43 . 2014-12-12 05:11	3971512	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2015-01-14 20:43 . 2014-12-12 05:11	3916728	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2015-01-14 20:43 . 2014-12-12 05:31	503808	----a-w-	c:\windows\system32\srcore.dll
2015-01-14 20:43 . 2014-12-12 05:31	50176	----a-w-	c:\windows\system32\srclient.dll
2015-01-14 20:43 . 2014-12-12 05:31	296960	----a-w-	c:\windows\system32\rstrui.exe
2015-01-14 20:43 . 2014-12-12 05:07	43008	----a-w-	c:\windows\SysWow64\srclient.dll
2015-01-14 20:39 . 2014-12-02 10:26	11870360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{515C05BE-1D63-4B3C-AE33-F10FD56A2CA0}\mpengine.dll
2015-01-14 20:34 . 2015-01-14 20:34	5013680	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2015-01-13 21:51 . 2015-01-13 21:51	--------	d-----w-	c:\program files (x86)\DriverRestore
2015-01-12 21:55 . 2015-01-12 20:27	98216	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-01-12 20:30 . 2015-01-12 20:30	--------	d-----w-	c:\program files (x86)\Common Files\Java
2015-01-10 20:20 . 2015-01-10 20:20	--------	d-----w-	c:\programdata\Package Cache
2015-01-10 20:16 . 2015-01-15 05:16	--------	d-----w-	c:\users\medion\AppData\Roaming\Compatibility Verifier
2015-01-09 18:46 . 2015-01-09 23:23	--------	d-----w-	c:\users\medion\AppData\Local\7f313c40-9623-4e17-a373-ed41158fe3d8
2015-01-03 16:19 . 2015-01-03 16:20	--------	d-----w-	c:\users\medion\AppData\Local\Chrome
2014-12-29 00:52 . 2014-12-29 00:52	--------	d-sh--w-	c:\users\medion\AppData\Local\EmieBrowserModeList
2014-12-24 04:05 . 2014-12-24 04:05	--------	d-----w-	c:\users\medion\AppData\Roaming\ASP
2014-12-19 16:30 . 2014-12-13 05:09	144384	----a-w-	c:\windows\system32\ieUnatt.exe
2014-12-19 16:30 . 2014-12-13 03:33	115712	----a-w-	c:\windows\SysWow64\ieUnatt.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-01-15 00:30 . 2014-11-16 14:39	113365784	----a-w-	c:\windows\system32\MRT.exe
2015-01-14 20:34 . 2014-08-01 16:33	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-14 20:34 . 2014-08-01 16:33	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-01-06 03:36 . 2010-11-21 03:27	298120	------w-	c:\windows\system32\MpSigStub.exe
2014-11-27 01:43 . 2014-12-12 15:45	389296	----a-w-	c:\windows\system32\iedkcs32.dll
2014-11-22 03:13 . 2014-12-12 15:45	25059840	----a-w-	c:\windows\system32\mshtml.dll
2014-11-22 03:06 . 2014-12-12 15:45	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-11-22 03:06 . 2014-12-12 15:45	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-11-22 02:50 . 2014-12-12 15:45	66560	----a-w-	c:\windows\system32\iesetup.dll
2014-11-22 02:50 . 2014-12-12 15:45	580096	----a-w-	c:\windows\system32\vbscript.dll
2014-11-22 02:49 . 2014-12-12 15:45	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2014-11-22 02:49 . 2014-12-12 15:45	2885120	----a-w-	c:\windows\system32\iertutil.dll
2014-11-22 02:48 . 2014-12-12 15:45	88064	----a-w-	c:\windows\system32\MshtmlDac.dll
2014-11-22 02:41 . 2014-12-12 15:45	54784	----a-w-	c:\windows\system32\jsproxy.dll
2014-11-22 02:40 . 2014-12-12 15:45	34304	----a-w-	c:\windows\system32\iernonce.dll
2014-11-22 02:37 . 2014-12-12 15:45	633856	----a-w-	c:\windows\system32\ieui.dll
2014-11-22 02:35 . 2014-12-12 15:45	114688	----a-w-	c:\windows\system32\ieetwcollector.exe
2014-11-22 02:34 . 2014-12-12 15:45	814080	----a-w-	c:\windows\system32\jscript9diag.dll
2014-11-22 02:34 . 2014-12-12 15:45	6039552	----a-w-	c:\windows\system32\jscript9.dll
2014-11-22 02:26 . 2014-12-12 15:45	968704	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-11-22 02:22 . 2014-12-12 15:45	490496	----a-w-	c:\windows\system32\dxtmsft.dll
2014-11-22 02:20 . 2014-12-12 15:45	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2014-11-22 02:14 . 2014-12-12 15:45	77824	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2014-11-22 02:09 . 2014-12-12 15:45	199680	----a-w-	c:\windows\system32\msrating.dll
2014-11-22 02:08 . 2014-12-12 15:45	92160	----a-w-	c:\windows\system32\mshtmled.dll
2014-11-22 02:07 . 2014-12-12 15:45	501248	----a-w-	c:\windows\SysWow64\vbscript.dll
2014-11-22 02:07 . 2014-12-12 15:45	62464	----a-w-	c:\windows\SysWow64\iesetup.dll
2014-11-22 02:06 . 2014-12-12 15:45	47616	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2014-11-22 02:05 . 2014-12-12 15:45	64000	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2014-11-22 02:05 . 2014-12-12 15:45	316928	----a-w-	c:\windows\system32\dxtrans.dll
2014-11-22 01:54 . 2014-12-12 15:45	620032	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2014-11-22 01:49 . 2014-12-12 15:45	718848	----a-w-	c:\windows\system32\ie4uinit.exe
2014-11-22 01:49 . 2014-12-12 15:45	800768	----a-w-	c:\windows\system32\msfeeds.dll
2014-11-22 01:47 . 2014-12-12 15:45	1359360	----a-w-	c:\windows\system32\mshtmlmedia.dll
2014-11-22 01:46 . 2014-12-12 15:45	2125312	----a-w-	c:\windows\system32\inetcpl.cpl
2014-11-22 01:43 . 2014-12-12 15:45	14412800	----a-w-	c:\windows\system32\ieframe.dll
2014-11-22 01:40 . 2014-12-12 15:45	60416	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-11-22 01:29 . 2014-12-12 15:45	4299264	----a-w-	c:\windows\SysWow64\jscript9.dll
2014-11-22 01:28 . 2014-12-12 15:45	2358272	----a-w-	c:\windows\system32\wininet.dll
2014-11-22 01:22 . 2014-12-12 15:45	2052096	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2014-11-22 01:21 . 2014-12-12 15:45	1155072	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2014-11-22 01:15 . 2014-12-12 15:45	1548288	----a-w-	c:\windows\system32\urlmon.dll
2014-11-22 01:03 . 2014-12-12 15:45	800768	----a-w-	c:\windows\system32\ieapfltr.dll
2014-11-22 01:00 . 2014-12-12 15:45	1888256	----a-w-	c:\windows\SysWow64\wininet.dll
2014-11-11 03:09 . 2014-12-12 15:13	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-11-11 03:08 . 2014-12-08 21:55	241152	----a-w-	c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-12-08 21:55	728064	----a-w-	c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-12-12 15:13	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-11-11 02:44 . 2014-12-08 21:55	186880	----a-w-	c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-12-08 21:55	550912	----a-w-	c:\windows\SysWow64\kerberos.dll
2014-11-11 01:46 . 2014-12-12 15:05	119296	----a-w-	c:\windows\system32\drivers\tdx.sys
2014-11-08 03:16 . 2014-12-12 15:00	2048	----a-w-	c:\windows\system32\tzres.dll
2014-11-08 02:45 . 2014-12-12 15:00	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2014-10-30 02:03 . 2014-12-12 15:00	165888	----a-w-	c:\windows\system32\charmap.exe
2014-10-30 01:45 . 2014-12-12 15:00	155136	----a-w-	c:\windows\SysWow64\charmap.exe
2014-10-25 01:57 . 2014-11-13 12:28	77824	----a-w-	c:\windows\system32\packager.dll
2014-10-25 01:32 . 2014-11-13 12:28	67584	----a-w-	c:\windows\SysWow64\packager.dll
2014-10-18 02:05 . 2014-11-13 12:29	861696	----a-w-	c:\windows\system32\oleaut32.dll
2014-10-18 02:05 . 2014-12-12 16:03	4121600	----a-w-	c:\windows\system32\mf.dll
2014-10-18 01:33 . 2014-11-13 12:29	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2014-10-18 01:33 . 2014-12-12 16:03	3209728	----a-w-	c:\windows\SysWow64\mf.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
2014-08-02 12:30	507904	----a-w-	c:\program files (x86)\SupTab\SupTab.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{8DE6FC60-E023-4AD7-A3B7-591E1460E7F7}]
2014-05-15 23:00	498968	----a-w-	c:\program files (x86)\Boost\Boost.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{fbdff406-2c4c-5d35-8469-34bb67ea3353}]
2014-07-28 20:03	74752	----a-w-	c:\program files\A7F8482B-1D99-4EC9-B887-8B130AB7E131\kzhxnitccw.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-12-11 30872672]
"RocketTab"="c:\users\medion\AppData\Local\Search Extensions\Client.exe" [2015-01-07 2647552]
"RocketTab Update Task"="c:\users\medion\AppData\Local\Search Extensions\uninstall.exe" [2015-01-05 6838272]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BrowserSafeguard"="c:\program files (x86)\BrowserSafeguard\BrowserSafeguard.exe" [2014-08-02 930816]
.
c:\users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BoostUpdater.lnk - c:\program files (x86)\Boost\BoostUpdater.exe [2014-4-21 392704]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 AllDaySavingsService64;AllDaySavingsService64;c:\program files (x86)\A7F8482B-1D99-4EC9-B887-8B130AB7E131\etmajyzoqm64.exe;c:\program files (x86)\A7F8482B-1D99-4EC9-B887-8B130AB7E131\etmajyzoqm64.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 LPTSystemUpdater;LPT System Updater Service;c:\program files (x86)\LPT\srpts.exe;c:\program files (x86)\LPT\srpts.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 Verifies and fixes application compatibility issues;Compatibility Verify;c:\users\medion\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe;c:\users\medion\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [x]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 klflt;klflt;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S1 netfilter64;netfilter64;c:\windows\system32\drivers\netfilter64.sys;c:\windows\SYSNATIVE\drivers\netfilter64.sys [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C60x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C60x64.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2015-01-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-01 20:35]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2014-01-29 171992]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2014-01-29 399832]
"Persistence"="c:\windows\system32\igfxpers.exe" [2014-01-29 442328]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://astromenda.com/?f=1&a=ast_secureddownload_14_40_ff&cd=2XzuyEtN2Y1L1QzuyBzzzytBzy0CyE0FtA0F0FyDtB0EyB0EtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtCyC0A0DtCtAzytGtCtCzyzztGyE0CyBtDtGyBzytB0AtGtCyB0FtCtDyEtBtDtAzy0C0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytD0F0AyEtB0AzztG0AzzyEzztGyEtCyBzztGzy0B0B0BtGtBzz0FyDyE0AtByBtAzy0C0E2Q&cr=649507380&ir=
mDefault_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A&q={searchTerms}
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A&q={searchTerms}
uInternet Settings,ProxyOverride = <-loopback>
uInternet Settings,ProxyServer = http=127.0.0.1:49204;https=127.0.0.1:49204
uSearchAssistant = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAsu8WVxI2L89-f9pmcjSMse-g,,&q={searchTerms}
IE: Zu Anti-Banner hinzufügen - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ie_banner_deny.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694\
FF - prefs.js: browser.search.selectedEngine - Yahoo DE
FF - prefs.js: keyword.URL - hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk761i-Q5n83kmnS56qliR2udbfwiy-nBMJjklmAsu8WVxI2L89-f9pmcjSMse-g,,&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-BrowserSafeguard - c:\program files (x86)\BrowserSafeguard\uninstall.BrowserSafeguard.exe
AddRemove-Google Chrome - c:\program files (x86)\Google\Chrome\Application\39.0.2171.95\Installer\setup.exe
AddRemove-Opera 25.0.1614.63 - c:\program files (x86)\Opera\Launcher.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-01-15  09:06:09
ComboFix-quarantined-files.txt  2015-01-15 08:06
.
Vor Suchlauf: 9 Verzeichnis(se), 400.769.851.392 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 400.302.395.392 Bytes frei
.
- - End Of File - - 3EEECB98F6F62AAD0E19B8225F9B0578
A36C5E4F47E84449FF07ED3517B43A31

schrauber · 15.01.2015, 10:27

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Auurora · 15.01.2015, 12:47

kurze frage ,
soll ich das jetze alles aufeinmal instalieren, oder nach jedem instalierten programm die antwort geben und dan den pc neu starten

also nach jeder antwort am ende des programms komme ich zu ihnen zurück schicke dies und werde dan den pc neu starten
tut mir leid das ich so viel nachfrage aber lieber stell ich blöde fragen als das ich am ende was falsch mache und die ganze mühe umsonst wa

ich nochmal

was genau meinen sie mit "und ein frisches FRST log bitte "

ich glaube ich hab es verstaden
ich werde nun , die schritte befolgen

mbam.txt:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org


Protection, 15.01.2015 11:15:49, SYSTEM, MEDION-PC, Protection, Malware Protection, Starting, 
Protection, 15.01.2015 11:15:49, SYSTEM, MEDION-PC, Protection, Malware Protection, Started, 
Protection, 15.01.2015 11:15:49, SYSTEM, MEDION-PC, Protection, Malicious Website Protection, Starting, 
Protection, 15.01.2015 11:15:53, SYSTEM, MEDION-PC, Protection, Malicious Website Protection, Started, 
Update, 15.01.2015 11:16:42, SYSTEM, MEDION-PC, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, 
Update, 15.01.2015 11:16:43, SYSTEM, MEDION-PC, Manual, Rootkit Database, 2014.11.18.1, 2015.1.14.1, 
Update, 15.01.2015 11:17:56, SYSTEM, MEDION-PC, Manual, Malware Database, 2014.11.20.6, 2015.1.15.5, 
Protection, 15.01.2015 11:17:56, SYSTEM, MEDION-PC, Protection, Refresh, Starting, 
Protection, 15.01.2015 11:17:56, SYSTEM, MEDION-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 15.01.2015 11:17:56, SYSTEM, MEDION-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 15.01.2015 11:18:07, SYSTEM, MEDION-PC, Protection, Refresh, Success, 
Protection, 15.01.2015 11:18:07, SYSTEM, MEDION-PC, Protection, Malicious Website Protection, Starting, 
Protection, 15.01.2015 11:18:08, SYSTEM, MEDION-PC, Protection, Malicious Website Protection, Started, 
Protection, 15.01.2015 12:12:59, SYSTEM, MEDION-PC, Protection, Malware Protection, Starting, 
Protection, 15.01.2015 12:12:59, SYSTEM, MEDION-PC, Protection, Malware Protection, Started, 
Protection, 15.01.2015 12:12:59, SYSTEM, MEDION-PC, Protection, Malicious Website Protection, Starting, 
Protection, 15.01.2015 12:14:29, SYSTEM, MEDION-PC, Protection, Malicious Website Protection, Started, 

(end)

adwcleaner:

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.216 - Bericht erstellt am 11/08/2014 um 14:45:29
# Aktualisiert 17/07/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : medion - MEDION-PC
# Gestartet von : F:\adwcleaner_3.216.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : BackupStack
Dienst Gelöscht : IePluginServices

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\374311380 
Ordner Gelöscht : C:\ProgramData\IePluginServices
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\Program Files (x86)\Boost
Ordner Gelöscht : C:\Program Files (x86)\Browsersafeguard
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\Optimizer Pro
Ordner Gelöscht : C:\Program Files (x86)\SupTab
Ordner Gelöscht : C:\Users\medion\AppData\Local\Browsersafeguard
Ordner Gelöscht : C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
Ordner Gelöscht : C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\3admhrwa.default\Extensions\faststartff@gmail.com
Datei Gelöscht : C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BoostUpdater.lnk
Datei Gelöscht : C:\Users\medion\Desktop\Sync Folder.lnk
Datei Gelöscht : C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\3admhrwa.default\user.js

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
Verknüpfung Desinfiziert : C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [faststartff@gmail.com]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BrowserSafeguard]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8DE6FC60-E023-4AD7-A3B7-591E1460E7F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8DE6FC60-E023-4AD7-A3B7-591E1460E7F7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8DE6FC60-E023-4AD7-A3B7-591E1460E7F7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8DE6FC60-E023-4AD7-A3B7-591E1460E7F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{8DE6FC60-E023-4AD7-A3B7-591E1460E7F7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8DE6FC60-E023-4AD7-A3B7-591E1460E7F7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\BrowserSafeguardInstalled
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\BrowserSafeGuard
Schlüssel Gelöscht : HKLM\Software\SupDp
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrowserSafeGuard
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17207

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v31.0 (x86 de)

[ Datei : C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\3admhrwa.default\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultenginename", "istartsurf");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "istartsurf");
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://www.istartsurf.com/?type=hp&ts=1406982613&from=adks&uid=ST9500325AS_S2W2SB9AXXXXS2W2SB9A");

*************************

AdwCleaner[R0].txt - [8836 octets] - [11/08/2014 14:44:42]
AdwCleaner[S0].txt - [7243 octets] - [11/08/2014 14:45:29]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7303 octets] ##########

--- --- ---
AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v4.107 - Bericht erstellt am 15/01/2015 um 12:25:14
# Aktualisiert 07/01/2015 von Xplode
# Database : 2015-01-13.2 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : medion - MEDION-PC
# Gestartet von : C:\Users\medion\Downloads\AdwCleaner_4.107.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : netfilter64

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverRestore
Ordner Gelöscht : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files (x86)\Boost
Ordner Gelöscht : C:\Program Files (x86)\PC Speed Maximizer
Ordner Gelöscht : C:\Program Files (x86)\DriverRestore
Ordner Gelöscht : C:\Users\medion\AppData\Local\Search Extensions
Ordner Gelöscht : C:\Users\medion\AppData\Roaming\ASP
Ordner Gelöscht : C:\Users\medion\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\medion\AppData\Roaming\DriverTurbo
Ordner Gelöscht : C:\Users\medion\AppData\Roaming\Compatibility Verifier
Datei Gelöscht : C:\Windows\System32\drivers\netfilter64.sys
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694\searchplugins\bingp.xml
Datei Gelöscht : C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\3admhrwa.default\user.js

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\medion\Desktop\Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\Chrome.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BrowserSafeguard]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [RocketTab Update Task]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [RocketTab]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\BRS
Schlüssel Gelöscht : HKCU\Software\eSupport.com
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\RocketTab
Schlüssel Gelöscht : HKCU\Software\RocketTabInstalled
Schlüssel Gelöscht : HKCU\Software\SecuredDownload
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\DriverRestore
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\InstallCore
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\RocketTab
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrowserSafeGuard
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\AllDaySavings 
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v34.0.5 (x86 de)

[0wm08qq1.default-1412425677694\prefs.js] - Zeile gelöscht : user_pref("extensions.astrmndasr.hmpgUrl", "hxxp://astromenda.com/?f=1&a=ast_secureddownload_14_40_ff&cd=2XzuyEtN2Y1L1QzuyBzzzytBzy0CyE0FtA0F0FyDtB0EyB0EtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1Cz[...]
[0wm08qq1.default-1412425677694\prefs.js] - Zeile gelöscht : user_pref("extensions.astrmndasr.newTabUrl", "hxxp://astromenda.com/?f=2&a=ast_secureddownload_14_40_ff&cd=2XzuyEtN2Y1L1QzuyBzzzytBzy0CyE0FtA0F0FyDtB0EyB0EtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1[...]
[0wm08qq1.default-1412425677694\prefs.js] - Zeile gelöscht : user_pref("extensions.astrmndasr.prtnrId", "WSE_Astromenda");
[0wm08qq1.default-1412425677694\prefs.js] - Zeile gelöscht : user_pref("extensions.astrmndasr.srchPrvdr", "Astromenda");
[0wm08qq1.default-1412425677694\prefs.js] - Zeile gelöscht : user_pref("extensions.astrmndasr.tlbrSrchUrl", "hxxp://astromenda.com/?f=3&a=ast_secureddownload_14_40_ff&cd=2XzuyEtN2Y1L1QzuyBzzzytBzy0CyE0FtA0F0FyDtB0EyB0EtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1[...]
[0wm08qq1.default-1412425677694\prefs.js] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlvkBmJ0krEDjr2_038ZH3O_z3Mk[...]
[3admhrwa.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.selectedEngine", "Astromenda");

-\\ Opera v0.0.0.0


*************************

AdwCleaner[R0].txt - [15347 octets] - [11/08/2014 13:44:42]
AdwCleaner[S0].txt - [13689 octets] - [11/08/2014 13:45:29]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [13750 octets] ##########

--- --- ---

sorry das 2te hab ich doppelt geschickt

sorry das 2te habe ich ausversehen doppelt geschickt

junkware removal tool:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by medion on 15.01.2015 at 12:33:04,55
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\Windows\prefetch\DRIVERRESTORE.EXE-460AF909.pf



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\medion\AppData\Roaming\mozilla\firefox\profiles\0wm08qq1.default-1412425677694\prefs.js

user_pref("extensions.astrmndasr.hmpgUrl", "hxxp://astromenda.com/?f=1&a=ast_secureddownload_14_40_ff&cd=2XzuyEtN2Y1L1QzuyBzzzytBzy0CyE0FtA0F0FyDtB0EyB0EtN0D0Tzu0StCtDtDzztN1L
user_pref("extensions.astrmndasr.newTabUrl", "hxxp://astromenda.com/?f=2&a=ast_secureddownload_14_40_ff&cd=2XzuyEtN2Y1L1QzuyBzzzytBzy0CyE0FtA0F0FyDtB0EyB0EtN0D0Tzu0StCtDtDzztN
user_pref("extensions.astrmndasr.srchPrvdr", "Astromenda");
user_pref("extensions.astrmndasr.tlbrSrchUrl", "hxxp://astromenda.com/?f=3&a=ast_secureddownload_14_40_ff&cd=2XzuyEtN2Y1L1QzuyBzzzytBzy0CyE0FtA0F0FyDtB0EyB0EtN0D0Tzu0StCtDtDzz
user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWx88tMoPUZRabVt0cJ2scZWDOpfTWHcXcLR0cM6xoaNOBelApNK1_eyuvYrr_FfUmmCzT5waKhYupNOObZynlv
Emptied folder: C:\Users\medion\AppData\Roaming\mozilla\firefox\profiles\0wm08qq1.default-1412425677694\minidumps [3 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.01.2015 at 12:39:48,49
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und ein frisches FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-01-2015 01
Ran by medion (administrator) on MEDION-PC on 15-01-2015 12:45:16
Running from C:\Users\medion\Downloads
Loaded Profiles: medion (Available profiles: medion)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Thisisu) C:\Users\medion\Downloads\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30872672 2014-12-11] (Skype Technologies S.A.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-767043884-2352323595-830612465-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyServer: [S-1-5-21-767043884-2352323595-830612465-1000] => http=127.0.0.1:49227;https=127.0.0.1:49227
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-767043884-2352323595-830612465-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: AllDaySavings -> {fbdff406-2c4c-5d35-8469-34bb67ea3353} -> C:\Program Files\A7F8482B-1D99-4EC9-B887-8B130AB7E131\kzhxnitccw.dll ()
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Yahoo DE
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Extension: Search App - C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694\Extensions\{1d33817b-02d7-4cfa-a618-2d2fe2f6add4}.xpi [2014-12-29]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-29]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Модуль перевірки посилань - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-08-04]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [Not Found]
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2014-05-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-05-28] (Kaspersky Lab ZAO)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-28] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-05-28] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-05-28] (Kaspersky Lab ZAO)
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x64.sys [75888 2011-09-08] (Atheros Communications, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-15] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-15 12:39 - 2015-01-15 12:39 - 00001763 _____ () C:\Users\medion\Desktop\JRT.txt
2015-01-15 12:32 - 2015-01-15 12:32 - 01707939 _____ (Thisisu) C:\Users\medion\Downloads\JRT.exe
2015-01-15 12:32 - 2015-01-15 12:32 - 00000000 ____D () C:\Windows\ERUNT
2015-01-15 12:19 - 2015-01-15 12:19 - 02191360 _____ () C:\Users\medion\Downloads\AdwCleaner_4.107.exe
2015-01-15 12:17 - 2015-01-15 12:17 - 00001768 _____ () C:\Users\medion\Desktop\mbam.txt
2015-01-15 11:16 - 2015-01-15 12:28 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-15 11:15 - 2015-01-15 11:15 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-15 11:15 - 2015-01-15 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-15 11:15 - 2015-01-15 11:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-15 11:15 - 2015-01-15 11:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-15 11:15 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-15 11:15 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-15 11:15 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-15 11:10 - 2015-01-15 11:13 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\medion\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-15 09:15 - 2015-01-15 09:15 - 00013450 _____ () C:\Users\medion\Desktop\combofix - Verknüpfung.lnk
2015-01-15 09:09 - 2015-01-15 12:26 - 00006128 _____ () C:\Windows\PFRO.log
2015-01-15 09:06 - 2015-01-15 09:06 - 00021853 _____ () C:\ComboFix.txt
2015-01-15 08:49 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-15 08:49 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-15 08:49 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-15 08:41 - 2015-01-15 09:06 - 00000000 ____D () C:\Qoobox
2015-01-15 08:40 - 2015-01-15 09:03 - 00000000 ____D () C:\Windows\erdnt
2015-01-15 08:39 - 2015-01-15 08:39 - 05609736 ____R (Swearware) C:\Users\medion\Downloads\ComboFix.exe
2015-01-15 07:31 - 2015-01-15 07:31 - 00001264 _____ () C:\Users\medion\Desktop\Revo Uninstaller.lnk
2015-01-15 07:31 - 2015-01-15 07:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-15 07:30 - 2015-01-15 07:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\medion\Downloads\revosetup95.exe
2015-01-15 06:45 - 2015-01-15 06:53 - 00029306 _____ () C:\Users\medion\Downloads\Addition.txt
2015-01-15 06:33 - 2015-01-15 12:45 - 00013858 _____ () C:\Users\medion\Downloads\FRST.txt
2015-01-15 06:33 - 2015-01-15 12:45 - 00000000 ____D () C:\FRST
2015-01-15 06:30 - 2015-01-15 06:30 - 02125312 _____ (Farbar) C:\Users\medion\Downloads\FRST64(1).exe
2015-01-15 06:19 - 2015-01-15 06:19 - 02125312 _____ (Farbar) C:\Users\medion\Downloads\FRST64.exe
2015-01-14 23:01 - 2015-01-14 23:01 - 355434482 _____ () C:\Windows\MEMORY.DMP
2015-01-14 23:01 - 2015-01-14 23:01 - 00325744 _____ () C:\Windows\Minidump\011415-28454-01.dmp
2015-01-14 21:44 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 21:44 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 21:44 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 21:43 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 21:43 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 21:43 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 21:43 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 21:43 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 21:43 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 21:43 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 21:43 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 21:43 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 21:43 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 21:34 - 2015-01-14 21:34 - 05013680 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-01-13 23:02 - 2015-01-13 23:02 - 00058016 _____ () C:\Users\medion\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-13 23:01 - 2015-01-15 12:26 - 00000448 _____ () C:\Windows\setupact.log
2015-01-13 23:01 - 2015-01-13 23:01 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-13 23:00 - 2015-01-13 23:01 - 00267816 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-13 06:03 - 2015-01-15 11:49 - 00000112 _____ () C:\ProgramData\1X03Yc.dat
2015-01-12 22:55 - 2015-01-12 21:27 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-01-12 22:55 - 2015-01-12 21:27 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-01-12 22:55 - 2015-01-12 21:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-12 21:20 - 2015-01-12 21:24 - 29727656 _____ (Oracle Corporation) C:\Users\medion\Downloads\jre-8u25-windows-i586(1).exe
2015-01-12 19:46 - 2015-01-12 19:49 - 29727656 _____ (Oracle Corporation) C:\Users\medion\Downloads\jre-8u25-windows-i586.exe
2015-01-10 22:23 - 2015-01-10 22:24 - 00000000 ____D () C:\Users\medion\Desktop\dso bilder
2015-01-10 21:20 - 2015-01-10 21:20 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-10 21:05 - 2015-01-10 21:05 - 00262144 _____ () C:\Windows\system32\config\elam
2015-01-09 19:46 - 2015-01-10 00:23 - 00000000 ____D () C:\Users\medion\AppData\Local\7f313c40-9623-4e17-a373-ed41158fe3d8
2015-01-03 17:23 - 2015-01-15 12:29 - 00001283 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
2015-01-03 17:20 - 2015-01-15 12:29 - 00001258 _____ () C:\Users\medion\Desktop\Chrome.lnk
2015-01-03 17:20 - 2015-01-03 17:20 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome
2015-01-03 17:19 - 2015-01-03 17:20 - 00000000 ____D () C:\Users\medion\AppData\Local\Chrome
2014-12-29 03:50 - 2014-12-29 03:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-29 01:52 - 2014-12-29 01:52 - 00000000 __SHD () C:\Users\medion\AppData\Local\EmieBrowserModeList
2014-12-19 17:50 - 2014-12-19 17:50 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(5).exe
2014-12-19 17:49 - 2014-12-19 17:49 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(4).exe
2014-12-19 17:45 - 2014-12-19 17:45 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(3).exe
2014-12-19 17:42 - 2014-12-19 17:42 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(2).exe
2014-12-19 17:30 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-19 17:30 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-15 12:43 - 2014-08-04 12:26 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-15 12:34 - 2009-07-14 05:45 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-15 12:34 - 2009-07-14 05:45 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-15 12:33 - 2014-08-01 17:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-15 12:31 - 2014-10-04 22:25 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Skype
2015-01-15 12:26 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-15 12:25 - 2014-08-11 13:44 - 00000000 ____D () C:\AdwCleaner
2015-01-15 12:25 - 2014-07-26 22:58 - 01335644 _____ () C:\Windows\WindowsUpdate.log
2015-01-15 12:09 - 2014-08-02 13:35 - 00000000 ____D () C:\Program Files (x86)\A7F8482B-1D99-4EC9-B887-8B130AB7E131
2015-01-15 09:17 - 2014-07-26 23:20 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{68480687-BE92-42A6-8330-8456ED388A7C}
2015-01-15 09:02 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-15 01:36 - 2014-10-29 21:31 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 01:30 - 2014-11-16 15:39 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 23:01 - 2014-08-01 16:31 - 00000000 ____D () C:\Windows\Minidump
2015-01-14 21:35 - 2014-08-01 17:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-14 21:34 - 2014-08-01 17:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-14 21:34 - 2014-08-01 17:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 00:17 - 2014-12-12 16:07 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online
2015-01-13 22:50 - 2014-10-20 13:04 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-01-12 22:55 - 2014-12-08 23:45 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-12 21:52 - 2014-08-01 16:08 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-12 21:52 - 2014-07-26 23:12 - 00001439 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-12 21:52 - 2014-07-26 23:12 - 00001417 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-01-12 21:29 - 2014-08-01 16:01 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-12 21:27 - 2014-12-08 23:49 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-01-12 21:27 - 2014-12-08 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-12 19:46 - 2014-08-01 16:08 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-10 23:51 - 2014-08-02 13:33 - 00000000 ____D () C:\Program Files\005
2015-01-07 12:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-03 17:23 - 2014-10-04 13:59 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-03 16:52 - 2014-10-04 22:24 - 00000000 ____D () C:\ProgramData\Skype
2015-01-03 16:51 - 2014-10-04 22:24 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-30 12:59 - 2014-08-01 16:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-30 12:59 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-30 02:46 - 2014-10-04 21:46 - 00000224 _____ () C:\Users\medion\AppData\Roaming\WB.CFG
2014-12-30 02:34 - 2014-08-04 12:30 - 00002330 _____ () C:\Users\medion\Desktop\Sicherer Zahlungsverkehr.lnk
2014-12-29 01:36 - 2014-08-04 12:29 - 00001124 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-12-24 05:05 - 2014-08-01 15:54 - 00000000 ____D () C:\Program Files (x86)\Drakensang Online
2014-12-19 17:46 - 2014-10-10 20:46 - 00000010 _____ () C:\Users\medion\AppData\Local\DSI.DAT
2014-12-19 17:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

Files to move or delete:
====================
C:\ProgramData\1X03Yc.dat


Some content of TEMP:
====================
C:\Users\medion\AppData\Local\Temp\Quarantine.exe
C:\Users\medion\AppData\Local\Temp\sqlite3.dll
C:\Users\medion\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\medion\AppData\Local\Temp\System.Data.SQLite7f313c40-9623-4e17-a373-ed41158fe3d8.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-27 23:44

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 15.01.2015, 12:48

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Auurora · 15.01.2015, 14:34

ich finde este online scanner
die logfile nicht
ich gebe das in die suche ein und es wird nicht gefunden

der scan hat auch bedrohung gefunden
habe aber auf fertigstellen gedrückt wie in der anweisung

hab es gefunden

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=5cda980d6a84e940b9976030c1c7fcd9
# engine=21977
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-15 01:12:00
# local_time=2015-01-15 02:12:00 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Kaspersky Internet Security'
# compatibility_mode=1292 16777213 100 100 9937 52805542 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 57472 172957370 0 0
# scanned=117925
# found=32
# cleaned=32
# scan_time=3862
sh=5BC816F6746772550442DF5EF61AEBF65462EAE2 ft=1 fh=c71c0011342b22c0 vn="Win32/Verti.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Boost\BoostUpdater.exe.vir"
sh=D3B2A49AE60EA7668091DD160E655C8DC73F9099 ft=1 fh=e1e0cb2e40abb392 vn="MSIL/Adware.iBryte.F Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Browsersafeguard\BrowserSafeguard.exe.vir"
sh=C5597D849D829123DCD7E87494A8AD4F46F6D3EF ft=1 fh=a60c1609e2138fa1 vn="Variante von MSIL/MyPCBackup.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\MyPC Backup\MyPC Backup.exe.vir"
sh=15ED5B6C5946E85E7A5C77F4A7689E4E76CCBAFB ft=1 fh=c71c0011fe889422 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"
sh=8FF07C7F0E7320A1EB53CADD4D30D3154FF33BBA ft=1 fh=f622fe8cae001c0b vn="Win64/Thinknice.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir"
sh=532A232C336AB1E5D65E829DFA191A71B96E2CC6 ft=1 fh=c71c001152b88659 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\HpUI.exe.vir"
sh=12EBF6FC8AD543662053CA101C2D5DA175137EB2 ft=1 fh=c71c00119e5c1a87 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader32.exe.vir"
sh=8F0ABE23DDA3F9DC04497B1A4F455AF8CE9D45B8 ft=1 fh=787e176d56997de7 vn="Win64/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader64.exe.vir"
sh=9E99BBE4E9F6026A66DB442D589FF049D44E43E9 ft=1 fh=c71c001149569c6f vn="Win32/ELEX.AV evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\RSHP.exe.vir"
sh=55B49E6175EC153F5F6D595F7E36CF04D61C70AC ft=1 fh=c71c0011122aac36 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect32.dll.vir"
sh=B1740CE6528491D6914E0015C836A3A8E31A28E9 ft=1 fh=667e6cf17acea18e vn="Win64/Thinknice.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect64.dll.vir"
sh=6148DAB05D76E4FCEF4B394B0F60D9ADB2E2AB1E ft=1 fh=c71c0011346812ac vn="Win32/ELEX.AV evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupIePluginServiceUpdate.exe.vir"
sh=03DBFA1572019E6B0A7745CA443E74CCA8FEEFFD ft=1 fh=c71c0011e74d8dee vn="Win32/Thinknice.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir"
sh=E9BEAFD5EF09360852ECDCC4312188064742E51A ft=1 fh=c71c0011421e8e27 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\uninstall.exe.vir"
sh=E3C659B9CAA4B5CFF2906CA02EB3F178906A2416 ft=1 fh=c71c00117f5fd915 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\WindowsSupportDll32.dll.vir"
sh=8B488C388E304F78CA88312A651D07494469D292 ft=1 fh=8013085d4e45f122 vn="Win64/Thinknice.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\WindowsSupportDll64.dll.vir"
sh=6148DAB05D76E4FCEF4B394B0F60D9ADB2E2AB1E ft=1 fh=c71c0011346812ac vn="Win32/ELEX.AV evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\IePluginServices\PluginService.exe.vir"
sh=77918B0878255FC1383E41084977C8CF7CD463D9 ft=1 fh=c71c00119ea191b0 vn="Variante von Win32/ELEX.BH evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir"
sh=D3B2A49AE60EA7668091DD160E655C8DC73F9099 ft=1 fh=e1e0cb2e40abb392 vn="MSIL/Adware.iBryte.F Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\medion\AppData\Local\Browsersafeguard\BrowserSafeguard.exe.vir"
sh=D63B727FE6CDB5DE49587A514D78F8A96E452D39 ft=1 fh=c71c0011d2ee3860 vn="Variante von MSIL/Adware.iBryte.S Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\medion\AppData\Local\Search Extensions\Client.exe.vir"
sh=D819A2C3CC060163FDC65C019D2A26BB9094E640 ft=1 fh=c71c0011e8dba6f4 vn="Variante von MSIL/Adware.iBryte.N Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\medion\AppData\Local\Search Extensions\uninstall.exe.vir"
sh=E2E7555ACD0F7F6827A0958817774C8E4253DC21 ft=1 fh=117f72a1057668b7 vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=8B67C4946B050285FE89EFE36AB6DC2F7B3E2D2F ft=1 fh=d91722da20002316 vn="Variante von Win64/Riskware.NetFilter.F Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\netfilter64.sys.vir"
sh=7365C9DB25FE3DFB4C4B85A9DD7CE514AD047738 ft=1 fh=85e8d453ed9c73d5 vn="Variante von Win32/AdWare.CouponAmazing.B Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Program Files\A7F8482B-1D99-4EC9-B887-8B130AB7E131\kzhxnitccw.dll"
sh=907DF0456F03AEAA8E44D2D9D3CD4558BA07B2DB ft=1 fh=6012deb93b048baa vn="Variante von Win32/InstallCore.PX evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\medion\Downloads\IDM2-Win-EN.exe"
sh=A727991FFE6D9E0A845D68EE4C51A091AA5E7383 ft=1 fh=53c5b0cf08cfce1e vn="Win32/AdWare.SpeedingUpMyPC.S Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\medion\Downloads\PCSpeedMaximizer_PI(1).exe"
sh=A727991FFE6D9E0A845D68EE4C51A091AA5E7383 ft=1 fh=53c5b0cf08cfce1e vn="Win32/AdWare.SpeedingUpMyPC.S Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\medion\Downloads\PCSpeedMaximizer_PI.exe"
sh=37D5CD8C72D6D422043869FB8CD0A28D7471D564 ft=1 fh=0a10d0719379e23f vn="Variante von Win32/ReImageRepair.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\medion\Downloads\ReimageRepair(1).exe"
sh=37D5CD8C72D6D422043869FB8CD0A28D7471D564 ft=1 fh=0a10d0719379e23f vn="Variante von Win32/ReImageRepair.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\medion\Downloads\ReimageRepair.exe"
sh=3A066FBCFF9EF52B95782F779CD162984385DAFE ft=1 fh=96291aaeeda53eba vn="Variante von Win32/AdWare.iBryte.AR Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\medion\Downloads\Setup(1).exe"
sh=3A066FBCFF9EF52B95782F779CD162984385DAFE ft=1 fh=96291aaeeda53eba vn="Variante von Win32/AdWare.iBryte.AR Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\medion\Downloads\Setup.exe"
sh=A9F6A3299D8E5A8B0F8F18915521C8B3E7C9F864 ft=1 fh=a874d3fc82897e2d vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="D:\TOOLS\Medion MediaPack\medion_mediapack_2_ext.exe"

bei securitycheck:

Code:

ATTFilter

 UNSUPPORTED OPERATING SYSTEM! ABORTED!

schrauber · 15.01.2015, 16:20

Fehlt noch das frische FRST log und die Antwort auf meine Frage

Auurora · 15.01.2015, 16:38

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-01-2015 01
Ran by medion (administrator) on MEDION-PC on 15-01-2015 16:34:08
Running from C:\Users\medion\Downloads
Loaded Profiles: medion (Available profiles: medion)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2launcher.exe
() C:\Users\medion\AppData\Local\Temp\DSOClient\dlcache\drakensangonline.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30872672 2014-12-11] (Skype Technologies S.A.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-767043884-2352323595-830612465-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyServer: [S-1-5-21-767043884-2352323595-830612465-1000] => http=127.0.0.1:49227;https=127.0.0.1:49227
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-767043884-2352323595-830612465-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Yahoo DE
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Extension: Search App - C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694\Extensions\{1d33817b-02d7-4cfa-a618-2d2fe2f6add4}.xpi [2014-12-29]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-29]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Модуль перевірки посилань - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-08-04]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [Not Found]
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2014-05-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-05-28] (Kaspersky Lab ZAO)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-28] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-05-28] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-05-28] (Kaspersky Lab ZAO)
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x64.sys [75888 2011-09-08] (Atheros Communications, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-15] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-15 14:32 - 2015-01-15 14:32 - 00852505 _____ () C:\Users\medion\Downloads\SecurityCheck.exe
2015-01-15 13:01 - 2015-01-15 13:01 - 02347384 _____ (ESET) C:\Users\medion\Downloads\esetsmartinstaller_deu.exe
2015-01-15 12:39 - 2015-01-15 12:39 - 00001763 _____ () C:\Users\medion\Desktop\JRT.txt
2015-01-15 12:32 - 2015-01-15 12:32 - 01707939 _____ (Thisisu) C:\Users\medion\Downloads\JRT.exe
2015-01-15 12:32 - 2015-01-15 12:32 - 00000000 ____D () C:\Windows\ERUNT
2015-01-15 12:19 - 2015-01-15 12:19 - 02191360 _____ () C:\Users\medion\Downloads\AdwCleaner_4.107.exe
2015-01-15 12:17 - 2015-01-15 12:17 - 00001768 _____ () C:\Users\medion\Desktop\mbam.txt
2015-01-15 11:16 - 2015-01-15 15:22 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-15 11:15 - 2015-01-15 11:15 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-15 11:15 - 2015-01-15 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-15 11:15 - 2015-01-15 11:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-15 11:15 - 2015-01-15 11:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-15 11:15 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-15 11:15 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-15 11:15 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-15 11:10 - 2015-01-15 11:13 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\medion\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-15 09:15 - 2015-01-15 09:15 - 00013450 _____ () C:\Users\medion\Desktop\combofix - Verknüpfung.lnk
2015-01-15 09:09 - 2015-01-15 12:26 - 00006128 _____ () C:\Windows\PFRO.log
2015-01-15 09:06 - 2015-01-15 09:06 - 00021853 _____ () C:\ComboFix.txt
2015-01-15 08:49 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-15 08:49 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-15 08:49 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-15 08:41 - 2015-01-15 09:06 - 00000000 ____D () C:\Qoobox
2015-01-15 08:40 - 2015-01-15 09:03 - 00000000 ____D () C:\Windows\erdnt
2015-01-15 08:39 - 2015-01-15 08:39 - 05609736 ____R (Swearware) C:\Users\medion\Downloads\ComboFix.exe
2015-01-15 07:31 - 2015-01-15 07:31 - 00001264 _____ () C:\Users\medion\Desktop\Revo Uninstaller.lnk
2015-01-15 07:31 - 2015-01-15 07:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-15 07:30 - 2015-01-15 07:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\medion\Downloads\revosetup95.exe
2015-01-15 06:45 - 2015-01-15 06:53 - 00029306 _____ () C:\Users\medion\Downloads\Addition.txt
2015-01-15 06:33 - 2015-01-15 16:34 - 00013621 _____ () C:\Users\medion\Downloads\FRST.txt
2015-01-15 06:33 - 2015-01-15 16:34 - 00000000 ____D () C:\FRST
2015-01-15 06:30 - 2015-01-15 06:30 - 02125312 _____ (Farbar) C:\Users\medion\Downloads\FRST64(1).exe
2015-01-15 06:19 - 2015-01-15 06:19 - 02125312 _____ (Farbar) C:\Users\medion\Downloads\FRST64.exe
2015-01-14 23:01 - 2015-01-14 23:01 - 355434482 _____ () C:\Windows\MEMORY.DMP
2015-01-14 23:01 - 2015-01-14 23:01 - 00325744 _____ () C:\Windows\Minidump\011415-28454-01.dmp
2015-01-14 21:44 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 21:44 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 21:44 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 21:43 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 21:43 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 21:43 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 21:43 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 21:43 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 21:43 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 21:43 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 21:43 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 21:43 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 21:43 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 21:34 - 2015-01-14 21:34 - 05013680 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-01-13 23:02 - 2015-01-13 23:02 - 00058016 _____ () C:\Users\medion\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-13 23:01 - 2015-01-15 12:26 - 00000448 _____ () C:\Windows\setupact.log
2015-01-13 23:01 - 2015-01-13 23:01 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-13 23:00 - 2015-01-13 23:01 - 00267816 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-13 06:03 - 2015-01-15 11:49 - 00000112 _____ () C:\ProgramData\1X03Yc.dat
2015-01-12 22:55 - 2015-01-12 21:27 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-01-12 22:55 - 2015-01-12 21:27 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-01-12 22:55 - 2015-01-12 21:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-12 21:20 - 2015-01-12 21:24 - 29727656 _____ (Oracle Corporation) C:\Users\medion\Downloads\jre-8u25-windows-i586(1).exe
2015-01-12 19:46 - 2015-01-12 19:49 - 29727656 _____ (Oracle Corporation) C:\Users\medion\Downloads\jre-8u25-windows-i586.exe
2015-01-10 22:23 - 2015-01-10 22:24 - 00000000 ____D () C:\Users\medion\Desktop\dso bilder
2015-01-10 21:20 - 2015-01-10 21:20 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-10 21:05 - 2015-01-10 21:05 - 00262144 _____ () C:\Windows\system32\config\elam
2015-01-09 19:46 - 2015-01-10 00:23 - 00000000 ____D () C:\Users\medion\AppData\Local\7f313c40-9623-4e17-a373-ed41158fe3d8
2015-01-03 17:23 - 2015-01-15 12:29 - 00001283 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
2015-01-03 17:20 - 2015-01-15 12:29 - 00001258 _____ () C:\Users\medion\Desktop\Chrome.lnk
2015-01-03 17:20 - 2015-01-03 17:20 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome
2015-01-03 17:19 - 2015-01-03 17:20 - 00000000 ____D () C:\Users\medion\AppData\Local\Chrome
2014-12-29 03:50 - 2014-12-29 03:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-29 01:52 - 2014-12-29 01:52 - 00000000 __SHD () C:\Users\medion\AppData\Local\EmieBrowserModeList
2014-12-19 17:50 - 2014-12-19 17:50 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(5).exe
2014-12-19 17:49 - 2014-12-19 17:49 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(4).exe
2014-12-19 17:45 - 2014-12-19 17:45 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(3).exe
2014-12-19 17:42 - 2014-12-19 17:42 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(2).exe
2014-12-19 17:30 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-19 17:30 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-15 16:33 - 2014-08-01 17:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-15 15:46 - 2014-07-26 23:20 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{68480687-BE92-42A6-8330-8456ED388A7C}
2015-01-15 14:48 - 2014-08-04 12:26 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-15 14:04 - 2014-08-02 13:34 - 00000000 ____D () C:\Program Files\A7F8482B-1D99-4EC9-B887-8B130AB7E131
2015-01-15 12:34 - 2009-07-14 05:45 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-15 12:34 - 2009-07-14 05:45 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-15 12:32 - 2014-07-26 22:58 - 01343819 _____ () C:\Windows\WindowsUpdate.log
2015-01-15 12:31 - 2014-10-04 22:25 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Skype
2015-01-15 12:26 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-15 12:25 - 2014-08-11 13:44 - 00000000 ____D () C:\AdwCleaner
2015-01-15 12:09 - 2014-08-02 13:35 - 00000000 ____D () C:\Program Files (x86)\A7F8482B-1D99-4EC9-B887-8B130AB7E131
2015-01-15 09:02 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-15 01:36 - 2014-10-29 21:31 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 01:30 - 2014-11-16 15:39 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 23:01 - 2014-08-01 16:31 - 00000000 ____D () C:\Windows\Minidump
2015-01-14 21:35 - 2014-08-01 17:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-14 21:34 - 2014-08-01 17:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-14 21:34 - 2014-08-01 17:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 00:17 - 2014-12-12 16:07 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online
2015-01-13 22:50 - 2014-10-20 13:04 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-01-12 22:55 - 2014-12-08 23:45 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-12 21:52 - 2014-08-01 16:08 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-12 21:52 - 2014-07-26 23:12 - 00001439 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-12 21:52 - 2014-07-26 23:12 - 00001417 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-01-12 21:29 - 2014-08-01 16:01 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-12 21:27 - 2014-12-08 23:49 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-01-12 21:27 - 2014-12-08 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-12 19:46 - 2014-08-01 16:08 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-10 23:51 - 2014-08-02 13:33 - 00000000 ____D () C:\Program Files\005
2015-01-07 12:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-03 17:23 - 2014-10-04 13:59 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-03 16:52 - 2014-10-04 22:24 - 00000000 ____D () C:\ProgramData\Skype
2015-01-03 16:51 - 2014-10-04 22:24 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-30 12:59 - 2014-08-01 16:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-30 12:59 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-30 02:46 - 2014-10-04 21:46 - 00000224 _____ () C:\Users\medion\AppData\Roaming\WB.CFG
2014-12-30 02:34 - 2014-08-04 12:30 - 00002330 _____ () C:\Users\medion\Desktop\Sicherer Zahlungsverkehr.lnk
2014-12-29 01:36 - 2014-08-04 12:29 - 00001124 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-12-24 05:05 - 2014-08-01 15:54 - 00000000 ____D () C:\Program Files (x86)\Drakensang Online
2014-12-19 17:46 - 2014-10-10 20:46 - 00000010 _____ () C:\Users\medion\AppData\Local\DSI.DAT
2014-12-19 17:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

Files to move or delete:
====================
C:\ProgramData\1X03Yc.dat


Some content of TEMP:
====================
C:\Users\medion\AppData\Local\Temp\Quarantine.exe
C:\Users\medion\AppData\Local\Temp\sqlite3.dll
C:\Users\medion\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\medion\AppData\Local\Temp\System.Data.SQLite7f313c40-9623-4e17-a373-ed41158fe3d8.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-27 23:44

==================== End Of Log ============================

--- --- ---

--- --- ---

ihre frage beantworte ich auch

seiten öffnen nun viel schneller bis jetze ploppt keine werbung auf
mir fällt nix auf was mit meinem problem zusammen hängt
ich denke und hoffe das alles beseitigt wurde

und ich danke vielmals für die schnelle hilfe
das hätt ich nie im leben allein geschafft

schrauber · 15.01.2015, 17:16

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Program Files\A7F8482B-1D99-4EC9-B887-8B130AB7E131
C:\Users\medion\Downloads\IDM2-Win-EN.exe

C:\Users\medion\Downloads\PCSpeedMaximizer_PI(1).exe

C:\Users\medion\Downloads\PCSpeedMaximizer_PI.exe

C:\Users\medion\Downloads\ReimageRepair(1).exe

C:\Users\medion\Downloads\ReimageRepair.exe

C:\Users\medion\Downloads\Setup(1).exe

C:\Users\medion\Downloads\Setup.exe

D:\TOOLS\Medion MediaPack\medion_mediapack_2_ext.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-767043884-2352323595-830612465-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyServer: [S-1-5-21-767043884-2352323595-830612465-1000] => http=127.0.0.1:49227;https=127.0.0.1:49227
C:\ProgramData\1X03Yc.dat
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Frisches FRST Log bitte.

Auurora · 15.01.2015, 18:01

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-01-2015 01
Ran by medion at 2015-01-15 17:35:35 Run:1
Running from C:\Users\medion\Desktop
Loaded Profiles: medion (Available profiles: medion)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Program Files\A7F8482B-1D99-4EC9-B887-8B130AB7E131
C:\Users\medion\Downloads\IDM2-Win-EN.exe

C:\Users\medion\Downloads\PCSpeedMaximizer_PI(1).exe

C:\Users\medion\Downloads\PCSpeedMaximizer_PI.exe

C:\Users\medion\Downloads\ReimageRepair(1).exe

C:\Users\medion\Downloads\ReimageRepair.exe

C:\Users\medion\Downloads\Setup(1).exe

C:\Users\medion\Downloads\Setup.exe

D:\TOOLS\Medion MediaPack\medion_mediapack_2_ext.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-767043884-2352323595-830612465-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyServer: [S-1-5-21-767043884-2352323595-830612465-1000] => http=127.0.0.1:49227;https=127.0.0.1:49227
C:\ProgramData\1X03Yc.dat
Emptytemp:
         
*****************

C:\Program Files\A7F8482B-1D99-4EC9-B887-8B130AB7E131 => Moved successfully.
"C:\Users\medion\Downloads\IDM2-Win-EN.exe" => File/Directory not found.
"C:\Users\medion\Downloads\PCSpeedMaximizer_PI(1).exe" => File/Directory not found.
"C:\Users\medion\Downloads\PCSpeedMaximizer_PI.exe" => File/Directory not found.
"C:\Users\medion\Downloads\ReimageRepair(1).exe" => File/Directory not found.
"C:\Users\medion\Downloads\ReimageRepair.exe" => File/Directory not found.
"C:\Users\medion\Downloads\Setup(1).exe" => File/Directory not found.
"C:\Users\medion\Downloads\Setup.exe" => File/Directory not found.
"D:\TOOLS\Medion MediaPack\medion_mediapack_2_ext.exe" => File/Directory not found.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-767043884-2352323595-830612465-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\S-1-5-21-767043884-2352323595-830612465-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
C:\ProgramData\1X03Yc.dat => Moved successfully.
EmptyTemp: => Removed 359.5 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 17:36:51 ====

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-01-2015 01
Ran by medion (administrator) on MEDION-PC on 15-01-2015 17:56:54
Running from C:\Users\medion\Desktop
Loaded Profiles: medion (Available profiles: medion)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2launcher.exe
() C:\Users\medion\AppData\Local\Temp\DSOClient\dlcache\drakensangonline.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\medion\Desktop\FRST64(1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-767043884-2352323595-830612465-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30872672 2014-12-11] (Skype Technologies S.A.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-767043884-2352323595-830612465-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Yahoo DE
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Extension: Search App - C:\Users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\0wm08qq1.default-1412425677694\Extensions\{1d33817b-02d7-4cfa-a618-2d2fe2f6add4}.xpi [2014-12-29]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-29]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Модуль перевірки посилань - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-08-04]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-08-04]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [Not Found]
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2014-05-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-05-28] (Kaspersky Lab ZAO)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-28] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-05-28] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-05-28] (Kaspersky Lab ZAO)
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x64.sys [75888 2011-09-08] (Atheros Communications, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-15] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-15 17:56 - 2015-01-15 17:57 - 00013465 _____ () C:\Users\medion\Desktop\FRST.txt
2015-01-15 17:23 - 2015-01-15 17:23 - 00000805 _____ () C:\Fixlist.txt
2015-01-15 14:32 - 2015-01-15 14:32 - 00852505 _____ () C:\Users\medion\Downloads\SecurityCheck.exe
2015-01-15 13:01 - 2015-01-15 13:01 - 02347384 _____ (ESET) C:\Users\medion\Downloads\esetsmartinstaller_deu.exe
2015-01-15 12:39 - 2015-01-15 12:39 - 00001763 _____ () C:\Users\medion\Desktop\JRT.txt
2015-01-15 12:32 - 2015-01-15 12:32 - 01707939 _____ (Thisisu) C:\Users\medion\Downloads\JRT.exe
2015-01-15 12:32 - 2015-01-15 12:32 - 00000000 ____D () C:\Windows\ERUNT
2015-01-15 12:19 - 2015-01-15 12:19 - 02191360 _____ () C:\Users\medion\Downloads\AdwCleaner_4.107.exe
2015-01-15 12:17 - 2015-01-15 12:17 - 00001768 _____ () C:\Users\medion\Desktop\mbam.txt
2015-01-15 11:16 - 2015-01-15 17:40 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-15 11:15 - 2015-01-15 11:15 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-15 11:15 - 2015-01-15 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-15 11:15 - 2015-01-15 11:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-15 11:15 - 2015-01-15 11:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-15 11:15 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-15 11:15 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-15 11:15 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-15 11:10 - 2015-01-15 11:13 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\medion\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-15 09:15 - 2015-01-15 09:15 - 00013450 _____ () C:\Users\medion\Desktop\combofix - Verknüpfung.lnk
2015-01-15 09:09 - 2015-01-15 17:38 - 00007186 _____ () C:\Windows\PFRO.log
2015-01-15 09:06 - 2015-01-15 09:06 - 00021853 _____ () C:\ComboFix.txt
2015-01-15 08:49 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-15 08:49 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-15 08:49 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-15 08:49 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-15 08:41 - 2015-01-15 09:06 - 00000000 ____D () C:\Qoobox
2015-01-15 08:40 - 2015-01-15 09:03 - 00000000 ____D () C:\Windows\erdnt
2015-01-15 08:39 - 2015-01-15 08:39 - 05609736 ____R (Swearware) C:\Users\medion\Downloads\ComboFix.exe
2015-01-15 07:31 - 2015-01-15 07:31 - 00001264 _____ () C:\Users\medion\Desktop\Revo Uninstaller.lnk
2015-01-15 07:31 - 2015-01-15 07:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-15 07:30 - 2015-01-15 07:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\medion\Downloads\revosetup95.exe
2015-01-15 06:45 - 2015-01-15 06:53 - 00029306 _____ () C:\Users\medion\Downloads\Addition.txt
2015-01-15 06:33 - 2015-01-15 17:56 - 00000000 ____D () C:\FRST
2015-01-15 06:33 - 2015-01-15 16:35 - 00027911 _____ () C:\Users\medion\Downloads\FRST.txt
2015-01-15 06:30 - 2015-01-15 06:30 - 02125312 _____ (Farbar) C:\Users\medion\Desktop\FRST64(1).exe
2015-01-15 06:19 - 2015-01-15 06:19 - 02125312 _____ (Farbar) C:\Users\medion\Downloads\FRST64.exe
2015-01-14 23:01 - 2015-01-14 23:01 - 355434482 _____ () C:\Windows\MEMORY.DMP
2015-01-14 23:01 - 2015-01-14 23:01 - 00325744 _____ () C:\Windows\Minidump\011415-28454-01.dmp
2015-01-14 21:44 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 21:44 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 21:44 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 21:43 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 21:43 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 21:43 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 21:43 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 21:43 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 21:43 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 21:43 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 21:43 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 21:43 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 21:43 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 21:34 - 2015-01-14 21:34 - 05013680 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-01-13 23:02 - 2015-01-13 23:02 - 00058016 _____ () C:\Users\medion\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-13 23:01 - 2015-01-15 17:38 - 00000504 _____ () C:\Windows\setupact.log
2015-01-13 23:01 - 2015-01-13 23:01 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-13 23:00 - 2015-01-13 23:01 - 00267816 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-12 22:55 - 2015-01-12 21:27 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-01-12 22:55 - 2015-01-12 21:27 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-01-12 22:55 - 2015-01-12 21:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-12 21:20 - 2015-01-12 21:24 - 29727656 _____ (Oracle Corporation) C:\Users\medion\Downloads\jre-8u25-windows-i586(1).exe
2015-01-12 19:46 - 2015-01-12 19:49 - 29727656 _____ (Oracle Corporation) C:\Users\medion\Downloads\jre-8u25-windows-i586.exe
2015-01-10 22:23 - 2015-01-10 22:24 - 00000000 ____D () C:\Users\medion\Desktop\dso bilder
2015-01-10 21:20 - 2015-01-10 21:20 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-10 21:05 - 2015-01-10 21:05 - 00262144 _____ () C:\Windows\system32\config\elam
2015-01-09 19:46 - 2015-01-10 00:23 - 00000000 ____D () C:\Users\medion\AppData\Local\7f313c40-9623-4e17-a373-ed41158fe3d8
2015-01-03 17:23 - 2015-01-15 12:29 - 00001283 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
2015-01-03 17:20 - 2015-01-15 12:29 - 00001258 _____ () C:\Users\medion\Desktop\Chrome.lnk
2015-01-03 17:20 - 2015-01-03 17:20 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome
2015-01-03 17:19 - 2015-01-03 17:20 - 00000000 ____D () C:\Users\medion\AppData\Local\Chrome
2014-12-29 03:50 - 2014-12-29 03:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-29 01:52 - 2014-12-29 01:52 - 00000000 __SHD () C:\Users\medion\AppData\Local\EmieBrowserModeList
2014-12-19 17:50 - 2014-12-19 17:50 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(5).exe
2014-12-19 17:49 - 2014-12-19 17:49 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(4).exe
2014-12-19 17:45 - 2014-12-19 17:45 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(3).exe
2014-12-19 17:42 - 2014-12-19 17:42 - 00775968 _____ (Reimage®) C:\Users\medion\Downloads\ReimageRepair(2).exe
2014-12-19 17:30 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-19 17:30 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-15 17:45 - 2009-07-14 05:45 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-15 17:45 - 2009-07-14 05:45 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-15 17:43 - 2014-07-26 22:58 - 01383046 _____ () C:\Windows\WindowsUpdate.log
2015-01-15 17:40 - 2014-10-04 22:25 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Skype
2015-01-15 17:40 - 2014-08-04 12:26 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-15 17:38 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-15 17:33 - 2014-08-01 17:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-15 17:08 - 2014-09-13 17:36 - 00000866 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-01-15 15:46 - 2014-07-26 23:20 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{68480687-BE92-42A6-8330-8456ED388A7C}
2015-01-15 12:25 - 2014-08-11 13:44 - 00000000 ____D () C:\AdwCleaner
2015-01-15 12:09 - 2014-08-02 13:35 - 00000000 ____D () C:\Program Files (x86)\A7F8482B-1D99-4EC9-B887-8B130AB7E131
2015-01-15 09:02 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-15 01:36 - 2014-10-29 21:31 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 01:30 - 2014-11-16 15:39 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 23:01 - 2014-08-01 16:31 - 00000000 ____D () C:\Windows\Minidump
2015-01-14 21:35 - 2014-08-01 17:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-14 21:34 - 2014-08-01 17:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-14 21:34 - 2014-08-01 17:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 00:17 - 2014-12-12 16:07 - 00000000 ____D () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online
2015-01-13 22:50 - 2014-10-20 13:04 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-01-12 22:55 - 2014-12-08 23:45 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-12 21:52 - 2014-08-01 16:08 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-12 21:52 - 2014-07-26 23:12 - 00001439 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-12 21:52 - 2014-07-26 23:12 - 00001417 _____ () C:\Users\medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-01-12 21:29 - 2014-08-01 16:01 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-12 21:27 - 2014-12-08 23:49 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-01-12 21:27 - 2014-12-08 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-12 19:46 - 2014-08-01 16:08 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-10 23:51 - 2014-08-02 13:33 - 00000000 ____D () C:\Program Files\005
2015-01-07 12:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-03 17:23 - 2014-10-04 13:59 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-03 16:52 - 2014-10-04 22:24 - 00000000 ____D () C:\ProgramData\Skype
2015-01-03 16:51 - 2014-10-04 22:24 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-30 12:59 - 2014-08-01 16:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-30 12:59 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-30 02:46 - 2014-10-04 21:46 - 00000224 _____ () C:\Users\medion\AppData\Roaming\WB.CFG
2014-12-30 02:34 - 2014-08-04 12:30 - 00002330 _____ () C:\Users\medion\Desktop\Sicherer Zahlungsverkehr.lnk
2014-12-29 01:36 - 2014-08-04 12:29 - 00001124 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-12-24 05:05 - 2014-08-01 15:54 - 00000000 ____D () C:\Program Files (x86)\Drakensang Online
2014-12-19 17:46 - 2014-10-10 20:46 - 00000010 _____ () C:\Users\medion\AppData\Local\DSI.DAT
2014-12-19 17:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-27 23:44

==================== End Of Log ============================

--- --- ---

--- --- ---

15.01.2015, 08:29	#6
schrauber /// the machine /// TB-Ausbilder	windows 7: Internetseiten werden nicht geöffnet / Werbefenster ploppen auf Deinstalliere diese Programme dann bitte normal über Windows __________________ --> windows 7: Internetseiten werden nicht geöffnet / Werbefenster ploppen auf

15.01.2015, 16:20	#12
schrauber /// the machine /// TB-Ausbilder	windows 7: Internetseiten werden nicht geöffnet / Werbefenster ploppen auf Fehlt noch das frische FRST log und die Antwort auf meine Frage __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

windows 7: Internetseiten werden nicht geöffnet / Werbefenster ploppen auf

Plagegeister aller Art und deren Bekämpfung: windows 7: Internetseiten werden nicht geöffnet / Werbefenster ploppen auf