Hallo Mathias,

und hier das ZOEK-Log:

Zoek.exe Version 4.0.0.4 Updated 31-08-2013
Tool run by ADMIN on 05.09.2013 at 19:52:22,44.
Microsoft Windows 7 Home Premium  6.1.7601 Service Pack 1 x64
Running in: Normal Mode No Internet Access Detected
Launched: C:\Users\xxxxxxxxx\Desktop\zoek\zoek.exe [Script inserted] 

==== System Restore Info ======================

05.09.2013 19:53:12 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-826733488-1499186410-3467009736-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully
HKEY_USERS\S-1-5-21-826733488-1499186410-3467009736-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-826733488-1499186410-3467009736-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\prefs.js:
user_pref("browser.search.defaultengine", "Ask.com");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wuxxxxx.defaultx\prefs.js:
user_pref("keyword.URL", "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=827316&p=");
user_pref("browser.search.useDBForOrder", "");

Added to C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wuxxxxx.defaultx\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\xxxx\AppData\Roaming\Mozilla\Firefox\Profiles\r6n9rara.default\prefs.js:
user_pref("browser.search.defaultengine", "Ask.com");
user_pref("browser.search.defaultenginename", "YouTube");
user_pref("browser.search.selectedEngine", "YouTube");
user_pref("browser.search.order.1", "Ask.com");
user_pref("extensions.asktb.ff-original-keyword-url", "");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\xxxx\AppData\Roaming\Mozilla\Firefox\Profiles\r6n9rara.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("extensions.asktb.ff-original-keyword-url", "");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\3udiwpab.default\prefs.js:

Added to C:\Users\xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\3udiwpab.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\xke09otc.default-1359736880158\prefs.js:
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\xke09otc.default-1359736880158\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default

user.js not found
---- Lines CT2613550 removed from prefs.js ----


---- Lines CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines yahoo removed from prefs.js ----

user_pref("browser.search.param.yahoo-fr", "chr-greentree_ff&type=827316");

---- Lines yahoo modified from prefs.js ----


---- Lines ask.com removed from prefs.js ----


---- Lines ask.com modified from prefs.js ----


---- Lines asktb removed from prefs.js ----


---- Lines asktb modified from prefs.js ----


---- Lines y2layers removed from prefs.js ----

user_pref("extentions.y2layers.defaultEnableAppsList", "PageRage,PageRageGlobal,Buzzdock,BuzzdockTease,SanitySwitch,PageRage,PageRageGlobal,");
user_pref("extentions.y2layers.installId", "62b11f21-6686-412f-b2df-83ffc3117872");
user_pref("extentions.y2layers.lastDnsTest", 370282);

---- Lines y2layers modified from prefs.js ----


---- Lines yontoo removed from prefs.js ----


---- Lines yontoo modified from prefs.js ----

user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20,wtxpcom@mybrowserbar.com:4.3,{ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.4,{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}:3.7.0.6,{FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.232.0,plugin@yontoo.com:1.20.00,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13");

---- Lines mybrowserbar removed from prefs.js ----


---- Lines mybrowserbar modified from prefs.js ----

user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20,wtxpcom@mybrowserbar.com:4.3,{ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.4,{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}:3.7.0.6,{FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.232.0,plugin@disabled.com:1.20.00,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13");

---- FireFox user.js and prefs.js backups ---- 

prefs__1959_.backup

ProfilePath: C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wuxxxxx.defaultx

---- Lines CT2613550 removed from prefs.js ----


---- Lines CT2613550 modified from prefs.js ----


---- Lines CT2613550 removed from user.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from user.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from user.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from user.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from user.js ----


---- Lines yahoo removed from prefs.js ----

user_pref("browser.search.param.yahoo-fr", "chr-greentree_ff&type=827316&ilc=12");

---- Lines yahoo modified from prefs.js ----


---- Lines yahoo removed from user.js ----


---- Lines ask.com removed from prefs.js ----


---- Lines ask.com modified from prefs.js ----


---- Lines ask.com removed from user.js ----


---- Lines asktb removed from prefs.js ----


---- Lines asktb modified from prefs.js ----


---- Lines asktb removed from user.js ----


---- Lines y2layers removed from prefs.js ----


---- Lines y2layers modified from prefs.js ----


---- Lines y2layers removed from user.js ----

user_pref("extentions.y2layers.installId", "62b11f21-6686-412f-b2df-83ffc3117872");
user_pref("extentions.y2layers.defaultEnableAppsList", "PageRage,PageRageGlobal,Buzzdock,BuzzdockTease,SanitySwitch,PageRage,PageRageGlobal,");

---- Lines yontoo removed from prefs.js ----


---- Lines yontoo modified from prefs.js ----


---- Lines mybrowserbar removed from prefs.js ----


---- Lines mybrowserbar modified from prefs.js ----


---- FireFox user.js and prefs.js backups ---- 

user__1959_.backup
prefs__1959_.backup

ProfilePath: C:\Users\xxxx\AppData\Roaming\Mozilla\Firefox\Profiles\r6n9rara.default

user.js not found
---- Lines CT2613550 removed from prefs.js ----


---- Lines CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines yahoo removed from prefs.js ----


---- Lines yahoo modified from prefs.js ----


---- Lines ask.com removed from prefs.js ----


---- Lines ask.com modified from prefs.js ----


---- Lines asktb removed from prefs.js ----

user_pref("extensions.asktb.ff-original-keyword-url", "");

---- Lines asktb modified from prefs.js ----


---- Lines y2layers removed from prefs.js ----


---- Lines y2layers modified from prefs.js ----


---- Lines yontoo removed from prefs.js ----


---- Lines yontoo modified from prefs.js ----


---- Lines mybrowserbar removed from prefs.js ----


---- Lines mybrowserbar modified from prefs.js ----

user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20,{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.67,pdfforge@mybrowserbar.com:4.3,wtxpcom@mybrowserbar.com:4.3,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.13");

---- FireFox user.js and prefs.js backups ---- 

prefs__1959_.backup

ProfilePath: C:\Users\xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\3udiwpab.default

user.js not found
---- Lines CT2613550 removed from prefs.js ----


---- Lines CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines yahoo removed from prefs.js ----


---- Lines yahoo modified from prefs.js ----


---- Lines ask.com removed from prefs.js ----


---- Lines ask.com modified from prefs.js ----


---- Lines asktb removed from prefs.js ----


---- Lines asktb modified from prefs.js ----


---- Lines y2layers removed from prefs.js ----


---- Lines y2layers modified from prefs.js ----


---- Lines yontoo removed from prefs.js ----


---- Lines yontoo modified from prefs.js ----


---- Lines mybrowserbar removed from prefs.js ----


---- Lines mybrowserbar modified from prefs.js ----


---- FireFox user.js and prefs.js backups ---- 


ProfilePath: C:\Users\xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\xke09otc.default-1359736880158

user.js not found
---- Lines CT2613550 removed from prefs.js ----


---- Lines CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 removed from prefs.js ----


---- Lines C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550 modified from prefs.js ----


---- Lines yahoo removed from prefs.js ----


---- Lines yahoo modified from prefs.js ----


---- Lines ask.com removed from prefs.js ----


---- Lines ask.com modified from prefs.js ----


---- Lines asktb removed from prefs.js ----


---- Lines asktb modified from prefs.js ----


---- Lines y2layers removed from prefs.js ----


---- Lines y2layers modified from prefs.js ----


---- Lines yontoo removed from prefs.js ----


---- Lines yontoo modified from prefs.js ----


---- Lines mybrowserbar removed from prefs.js ----


---- Lines mybrowserbar modified from prefs.js ----


---- FireFox user.js and prefs.js backups ---- 

prefs__1959_.backup

==== Deleting Files \ Folders ======================

"C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo.xml" deleted
"C:\Users\ADMIN.Ace\Favorites\Startfenster.lnk" deleted
"C:\Users\ADMIN.Ace\Favorites\Links\Startfenster.lnk" deleted
"C:\Users\ADMIN.Ace\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Startfenster.lnk" deleted
"C:\Users\ADMIN.Ace\AppData\Roaming\0C0CE" deleted
"C:\Users\ADMIN.Ace\AppData\Roaming\CEB8E" deleted
"C:\Program Files (x86)\Common Files\DVDVideoSoft\bin" deleted
"C:\Program Files (x86)\Amazon" deleted
"C:\found.000" deleted
"C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550" deleted
"C:\Users\xxxx\AppData\Roaming\Mozilla\Firefox\Profiles\r6n9rara.default\jetpack" deleted
"C:\Users\xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\xke09otc.default-1359736880158\jetpack" deleted
"C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\CT2613550" deleted
"C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wuxxxxx.defaultx\extensions\plugin@yontoo.com" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wuxxxxx.defaultx
- Undetermined - C:\Program Files (x86)\McAfee\SiteAdvisor
- Undetermined - C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
- Adobe DLM powered by getPlusR - %ProfilePath%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}

ProfilePath: C:\Users\xxxx\AppData\Roaming\Mozilla\Firefox\Profiles\r6n9rara.default
- DuckDuckGo Plus - %ProfilePath%\extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi
- BetterPrivacy - %ProfilePath%\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi

ProfilePath: C:\Users\xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\3udiwpab.default
- Free YouTube Download Free Studio Menu - %ProfilePath%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

ProfilePath: C:\Users\xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\xke09otc.default-1359736880158
- Free YouTube Download Free Studio Menu - %ProfilePath%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
- YouTube mp3 - %ProfilePath%\extensions\info@youtube-mp3.org.xpi
- DuckDuckGo Plus - %ProfilePath%\extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi
- YouTubeIT - %ProfilePath%\extensions\youtubeit_aechiara@gmail.com.xpi
- BetterPrivacy - %ProfilePath%\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\ADMIN.Ace\AppData\Roaming\Mozilla\Firefox\Profiles\wvfcx3wu.default
D7324EB1EDCB8990F8522DE0311359E9	- C:\Windows\SysWOW64\npDeployJava1.dll -	Java Deployment Toolkit 7.0.250.17
0C8597DBC74AAF5179471BA013E3C6B4	- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll -	Shockwave Flash
15E298B5EC5B89C5994A59863969D9FF	- C:\Windows\SysWOW64\npmproxy.dll -	Microsoft® Windows® Operating System


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\ADMIN.Ace\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\ADMIN.Ace\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\xxxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\xxxxxxxxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\xxxxxxxxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\users\ADMIN.Ace\AppData\Local\Mozilla\Firefox\Profiles\wvfcx3wu.default\Cache emptied successfully
C:\users\xxxx\AppData\Local\Mozilla\Firefox\Profiles\r6n9rara.default\Cache emptied successfully
C:\users\xxxxxxxxx\AppData\Local\Mozilla\Firefox\Profiles\xke09otc.default-1359736880158\Cache emptied successfully

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully
         

DuckDuckGo ist übrigends noch da (nach zoek und nach Neustart)

Ich hab schon überlegt, ob ich einfach mal mein FF-Profil lösche. Ich glaube, FF legt dann einfach ein neues an. Bin mir aber nicht sooo sicher. Was meinst du: ist das zielführend?

Gruß Pechvogel

Servus,

Zitat von Pechvogel44

Ich hab schon überlegt, ob ich einfach mal mein FF-Profil lösche. Ich glaube, FF legt dann einfach ein neues an. Bin mir aber nicht sooo sicher. Was meinst du: ist das zielführend?

Das ist die allerletzte Option, klar, die haben wir immer.

Mit Hilfe von ZOEK konnte ich aber DuckDuckGo ausmachen.


Wir versuchen jetzt nochmal einen Fix mit FRST, dann sollte der Dreck weg sein.


Schließe Firefox, bevor du den Fix durchführst.


Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

start
CMD: taskkill /im firefox.exe /f /t
CMD: del "%appdata%\Mozilla\Firefox\Profiles\r6n9rara.default\extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi" /q /f
CMD: del "%appdata%\Mozilla\Firefox\Profiles\xke09otc.default-1359736880158\extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi" /q /f
end
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Starte deinen Rechner anschließend neu und berichte, ob du immer noch Probleme mit DuckDuckGo hast.