Virenbefall - IExplorer öffnet viele Fenster

Josi · 16.12.2013, 10:47

Hilfe!
Irgendein bösartiges Virus hat meinen Rechner zerschossen.
Erste Symptome: der Internet Explorer hat rund 30 Fenster auf einmal geöffnet (alle leer).
Computer neu gestartet, Virenscan im abgesicherten Modus (nichts gefunden), seitdem fährt er nicht mehr normal hoch, sondern immer automatisch in den abgesicherten Modus, auch wenn man "Computer normal starten" wählt

Malewarebytes hat zuerst nichts gefunden (beim dritten Scan 8 Fehler), Norton NPE auch nicht, das eigene Virenprogramm (McAffee) ist inaktiv aus ungeklärten Gründen.

Mit "Computer reparieren" passiert nichts, er meldet, es gäbe kein Problem.
PC auf früheren Zeitpunkt zurückgesetzt, hilft auch nicht.

Was kann man da nur tun?

Betriebssystem ist Windows 7

Hier sind die Logfiles:
FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-12-2013 02
Ran by Jo (administrator) on JO-PC on 16-12-2013 09:14:31
Running from C:\Users\Jo\Downloads\Neuer Ordner (4)
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)

==================== Processes (Whitelisted) =================

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2894640 2012-03-14] (ELAN Microelectronics Corp.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\quickset.exe [5729648 2012-02-07] (Dell Inc.)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SA3\SACpl.exe [1654400 2012-02-21] (Conexant Systems, Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Run: [CAHeadless] - C:\Program Files (x86)\Adobe\Elements 11 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [840784 2012-09-23] (Adobe Systems Incorporated)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_168_Plugin.exe -update plugin [815496 2013-09-22] (Adobe Systems Incorporated)
MountPoints2: E - E:\AutoRun.exe
MountPoints2: {37222be9-2c23-11e2-9ea0-c01885bf04c2} - E:\AutoRun.exe
MountPoints2: {37222bfb-2c23-11e2-9ea0-c01885bf04c2} - E:\AutoRun.exe
MountPoints2: {45f4149a-2dc4-11e2-b4cd-001e101f8ed0} - E:\AutoRun.exe
MountPoints2: {f05a6bfa-2f6b-11e2-8c45-001e101f8ed0} - G:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35768 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\mcafee.com\agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [ROC_roc_ssl_v12] - "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe [3477640 2012-09-23] (Adobe Systems Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
Lsa: [Notification Packages] scecli c:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk -> C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=32A0C01885BF04C1&affID=119657&tt=280813_dt&tsp=4988
SearchScopes: HKCU - {56088F36-6E1A-4F1B-AD54-BC7F1B8402F4} URL = hxxp://www.bing.com/search?q={searchTerms}&r=111
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\mcafee\systemcore\ScriptSn.20121109001455.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\mcafee\SystemCore\ScriptSn.20121109001456.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 217.68.161.141 217.68.161.171
Tcpip\..\Interfaces\{7C4FCED6-3348-4FD6-8308-7F34A883E75A}: [NameServer]193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{E7A70ECF-B651-4A33-80EC-977D3078D1A4}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{FD2796C3-BD5C-4DCF-8824-DD57864E1757}: [NameServer]193.189.244.206 193.189.244.225

FireFox:
========
FF ProfilePath: C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default
FF user.js: detected! => C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\ich@maltegoetz.de
FF Extension: Zotero Word for Windows Integration - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zoteroWinWordIntegration@zotero.org
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
FF Extension: IE Tab - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
FF Extension: DownloadHelper - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: zotero - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zotero@chnm.gmu.edu.xpi
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

S2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-23] (Adobe Systems Incorporated)
S2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [109184 2012-05-18] (Conexant Systems, Inc.)
S2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-08-19] ()
S3 McAWFwk; C:\Program Files\mcafee\msc\McAWFwk.exe [224704 2011-03-08] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 SystemStoreService; C:\Program Files (x86)\SoftwareUpdater\SystemStore.exe [296448 2013-06-03] ()
S2 0321031381771398mcinstcleanup; C:\Windows\TEMP\032103~1.EXE -cleanup -nolog [x]

==================== Drivers (Whitelisted) ====================

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbx64.sys [51016 2011-11-01] (Yamaha Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-16 09:14 - 2013-12-16 09:14 - 00000000 ____D C:\FRST
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 16:28 - 2013-12-15 21:33 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 16:28 - 2013-12-15 21:25 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-12 20:02 - 2013-12-12 20:02 - 00032575 _____ C:\Users\Jo\Downloads\measurement.jar
2013-12-06 13:16 - 2013-12-06 13:17 - 30694824 _____ (Oracle Corporation) C:\Users\Jo\Downloads\jre-7u45-windows-x64.exe
2013-12-03 17:04 - 2013-12-16 09:14 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-03 17:04 - 2013-12-15 21:33 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-11-28 22:06 - 2013-11-28 22:06 - 00000000 ____D C:\Users\Jo\AppData\Local\{C38BF032-CAA7-4652-86A6-32B649DFC0E3}
2013-11-28 21:59 - 2013-11-28 21:59 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-11-21 12:49 - 2013-11-21 13:05 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:46 - 2013-11-21 12:46 - 00003647 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-11-21 12:43 - 2013-12-15 20:48 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-11-21 12:38 - 2013-12-15 23:46 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-11-20 14:42 - 2013-11-20 14:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ___HD C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon
2013-11-20 14:25 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de
2013-11-17 11:17 - 2013-12-13 12:23 - 00000000 ____D C:\Users\Jo\Desktop\GW

==================== One Month Modified Files and Folders =======

2013-12-16 09:14 - 2013-12-16 09:14 - 00000000 ____D C:\FRST
2013-12-16 09:14 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-16 09:08 - 2012-11-08 14:28 - 00000000 ____D C:\Users\Jo
2013-12-16 07:36 - 2010-11-21 07:50 - 00696824 _____ C:\Windows\system32\perfh007.dat
2013-12-16 07:36 - 2010-11-21 07:50 - 00148088 _____ C:\Windows\system32\perfc007.dat
2013-12-16 07:36 - 2009-07-14 06:13 - 01612288 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-15 23:49 - 2010-11-21 08:00 - 00000000 ____D C:\Program Files\Windows Journal
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Cursors
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Services
2013-12-15 23:48 - 2013-09-23 18:38 - 00000000 ____D C:\Users\Jo\Desktop\gmic_gimp_win64
2013-12-15 23:48 - 2013-09-22 19:06 - 00000000 ____D C:\ProgramData\Ashampoo
2013-12-15 23:48 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\com.zipeg
2013-12-15 23:48 - 2013-07-27 17:19 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-15 23:48 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\CEP
2013-12-15 23:48 - 2013-06-03 21:53 - 00000000 ____D C:\Users\Jo\AppData\Local\DownloadGuide
2013-12-15 23:48 - 2013-05-27 18:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\vlc
2013-12-15 23:48 - 2013-04-06 23:59 - 00000000 ____D C:\Users\Jo\Documents\StreamTransport
2013-12-15 23:48 - 2013-04-06 22:05 - 00000000 ____D C:\ProgramData\RapidSolution
2013-12-15 23:48 - 2013-02-09 17:06 - 00000000 ____D C:\Users\Jo\Downloads\Max5_48561
2013-12-15 23:48 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Thunderbird
2013-12-15 23:48 - 2012-12-18 20:17 - 00000000 ____D C:\Windows\pss
2013-12-15 23:48 - 2012-12-18 17:32 - 00000000 ___RD C:\Users\Jo\Dropbox
2013-12-15 23:48 - 2012-11-11 18:17 - 00000000 ____D C:\ProgramData\DatacardService
2013-12-15 23:48 - 2012-11-09 12:16 - 00000000 ____D C:\Users\Jo\.rednotebook
2013-12-15 23:48 - 2012-11-08 21:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\MusicBee
2013-12-15 23:48 - 2012-11-08 14:45 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2013-12-15 23:48 - 2012-11-08 14:43 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:48 - 2012-08-24 16:03 - 00000000 ____D C:\ProgramData\McAfee
2013-12-15 23:48 - 2012-08-24 16:00 - 00000000 ____D C:\Windows\de
2013-12-15 23:48 - 2012-08-24 15:41 - 00000000 ____D C:\ProgramData\WildTangent
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2013-12-15 23:47 - 2013-10-02 14:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 23:47 - 2013-09-22 18:31 - 00000000 ____D C:\Program Files\Luminance HDR
2013-12-15 23:47 - 2013-09-18 15:08 - 00000000 ____D C:\Program Files (x86)\Zotero Standalone
2013-12-15 23:47 - 2013-09-01 21:14 - 00000000 ____D C:\Program Files (x86)\Calibre2
2013-12-15 23:47 - 2013-08-17 16:32 - 00000000 ____D C:\Program Files\CCleaner
2013-12-15 23:47 - 2013-08-17 09:55 - 00000000 ____D C:\Program Files (x86)\Scrivener
2013-12-15 23:47 - 2013-07-27 17:19 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-15 23:47 - 2013-06-03 21:57 - 00000000 ____D C:\Program Files (x86)\SoftwareUpdater
2013-12-15 23:47 - 2013-04-30 21:11 - 00000000 ____D C:\Program Files (x86)\Audacity
2013-12-15 23:47 - 2013-04-30 21:06 - 00000000 ____D C:\Program Files (x86)\MIDI to WAV Converter
2013-12-15 23:47 - 2013-04-06 23:57 - 00000000 ____D C:\Program Files (x86)\StreamTransport
2013-12-15 23:47 - 2013-03-27 23:20 - 00000000 ____D C:\Program Files\GIMP 2
2013-12-15 23:47 - 2013-03-02 02:24 - 00000000 ____D C:\Program Files (x86)\MusikLabor
2013-12-15 23:47 - 2013-02-19 14:13 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-12-15 23:47 - 2013-02-09 19:23 - 00000000 ____D C:\Program Files (x86)\Direct MIDI to MP3 Converter
2013-12-15 23:47 - 2013-02-08 23:01 - 00000000 ____D C:\Program Files (x86)\Tinypic
2013-12-15 23:47 - 2013-01-16 11:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-12-15 23:47 - 2012-12-02 03:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-15 23:47 - 2012-11-20 14:06 - 00000000 ____D C:\Program Files (x86)\EasyGPS
2013-12-15 23:47 - 2012-11-14 20:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-15 23:47 - 2012-11-11 18:18 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-12-15 23:47 - 2012-11-09 12:20 - 00000000 ____D C:\Program Files (x86)\Celtx
2013-12-15 23:47 - 2012-11-09 12:16 - 00000000 ____D C:\Program Files (x86)\RedNotebook
2013-12-15 23:47 - 2012-11-09 11:43 - 00000000 ____D C:\Program Files (x86)\Q10
2013-12-15 23:47 - 2012-11-08 22:02 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter
2013-12-15 23:47 - 2012-11-08 21:45 - 00000000 ____D C:\Program Files (x86)\MusicBee
2013-12-15 23:47 - 2012-08-24 17:02 - 00000000 ____D C:\Program Files\Elantech
2013-12-15 23:47 - 2012-08-24 16:05 - 00000000 ____D C:\Program Files (x86)\Zinio Reader 4
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files\mcafee
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files\Common Files\mcafee
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files (x86)\mcafee.com
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-12-15 23:47 - 2012-08-24 16:01 - 00000000 ____D C:\Program Files\Dell Support Center
2013-12-15 23:47 - 2012-08-24 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-15 23:47 - 2012-08-24 15:51 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-12-15 23:47 - 2012-08-24 15:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-15 23:47 - 2012-08-24 15:45 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-12-15 23:46 - 2013-11-21 12:38 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-12-15 23:46 - 2012-11-08 15:47 - 00000000 ____D C:\Program Files (x86)\Adobe Download Assistant
2013-12-15 23:46 - 2011-02-11 18:12 - 00000000 ____D C:\dell
2013-12-15 23:45 - 2013-10-22 22:21 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-12-15 23:44 - 2013-11-20 14:39 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-12-15 23:44 - 2013-11-20 14:25 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de
2013-12-15 23:44 - 2013-10-20 21:40 - 00000000 ____D C:\Users\Jo\Desktop\MediathekView_3.3.0
2013-12-15 23:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-15 23:32 - 2012-11-08 18:38 - 00000000 ____D C:\Users\Jo\Jo
2013-12-15 23:30 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\Zipeg
2013-12-15 23:30 - 2012-12-18 17:30 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Dropbox
2013-12-15 23:30 - 2012-11-08 14:31 - 00000000 ____D C:\Users\Jo\AppData\Local\VirtualStore
2013-12-15 23:20 - 2012-11-20 16:18 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-15 23:20 - 2012-08-24 15:30 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-15 23:12 - 2012-11-08 14:42 - 00000000 __RHD C:\MSOCache
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 21:33 - 2013-12-15 16:28 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 21:33 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-12-15 21:33 - 2010-11-21 08:00 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-12-15 21:25 - 2013-12-15 16:28 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-15 20:48 - 2013-11-21 12:43 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-12-15 20:48 - 2013-02-19 14:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\FileZilla
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-12-15 02:00 - 2012-11-08 15:46 - 00000000 ____D C:\Users\Jo\AppData\Local\Adobe
2013-12-15 01:14 - 2013-10-20 22:01 - 00000000 ____D C:\Users\Jo\MediathekView
2013-12-13 12:23 - 2013-11-17 11:17 - 00000000 ____D C:\Users\Jo\Desktop\GW
2013-12-12 20:02 - 2013-12-12 20:02 - 00032575 _____ C:\Users\Jo\Downloads\measurement.jar
2013-12-06 13:17 - 2013-12-06 13:16 - 30694824 _____ (Oracle Corporation) C:\Users\Jo\Downloads\jre-7u45-windows-x64.exe
2013-12-03 11:16 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Local\Thunderbird
2013-11-28 22:15 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (2)
2013-11-28 22:06 - 2013-11-28 22:06 - 00000000 ____D C:\Users\Jo\AppData\Local\{C38BF032-CAA7-4652-86A6-32B649DFC0E3}
2013-11-28 21:59 - 2013-11-28 21:59 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-11-21 13:05 - 2013-11-21 12:49 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:46 - 2013-11-21 12:46 - 00003647 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-11-21 12:46 - 2013-03-27 23:39 - 00000000 ____D C:\Users\Jo\.gimp-2.8
2013-11-20 14:45 - 2013-11-20 14:42 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ___HD C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon
2013-11-17 00:50 - 2012-11-08 16:04 - 00000000 ____D C:\Users\Jo\Documents\OneNote-Notizbücher

Some content of TEMP:
====================
C:\Users\Jo\AppData\Local\Temp\uninst1.exe
C:\Users\Jo\AppData\Local\Temp\vcredist_x86.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


safeboot: ==> The system is configured to boot to Safe Mode <===== ATTENTION!


LastRegBack: 2013-12-12 17:36

==================== End Of Log ============================

--- --- ---

--- --- ---

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-12-2013 02
Ran by Jo (administrator) on JO-PC on 16-12-2013 09:14:31
Running from C:\Users\Jo\Downloads\Neuer Ordner (4)
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)

==================== Processes (Whitelisted) =================

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2894640 2012-03-14] (ELAN Microelectronics Corp.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\quickset.exe [5729648 2012-02-07] (Dell Inc.)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SA3\SACpl.exe [1654400 2012-02-21] (Conexant Systems, Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Run: [CAHeadless] - C:\Program Files (x86)\Adobe\Elements 11 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [840784 2012-09-23] (Adobe Systems Incorporated)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_168_Plugin.exe -update plugin [815496 2013-09-22] (Adobe Systems Incorporated)
MountPoints2: E - E:\AutoRun.exe
MountPoints2: {37222be9-2c23-11e2-9ea0-c01885bf04c2} - E:\AutoRun.exe
MountPoints2: {37222bfb-2c23-11e2-9ea0-c01885bf04c2} - E:\AutoRun.exe
MountPoints2: {45f4149a-2dc4-11e2-b4cd-001e101f8ed0} - E:\AutoRun.exe
MountPoints2: {f05a6bfa-2f6b-11e2-8c45-001e101f8ed0} - G:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35768 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\mcafee.com\agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [ROC_roc_ssl_v12] - "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe [3477640 2012-09-23] (Adobe Systems Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
Lsa: [Notification Packages] scecli c:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk -> C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=32A0C01885BF04C1&affID=119657&tt=280813_dt&tsp=4988
SearchScopes: HKCU - {56088F36-6E1A-4F1B-AD54-BC7F1B8402F4} URL = hxxp://www.bing.com/search?q={searchTerms}&r=111
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\mcafee\systemcore\ScriptSn.20121109001455.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\mcafee\SystemCore\ScriptSn.20121109001456.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 217.68.161.141 217.68.161.171
Tcpip\..\Interfaces\{7C4FCED6-3348-4FD6-8308-7F34A883E75A}: [NameServer]193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{E7A70ECF-B651-4A33-80EC-977D3078D1A4}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{FD2796C3-BD5C-4DCF-8824-DD57864E1757}: [NameServer]193.189.244.206 193.189.244.225

FireFox:
========
FF ProfilePath: C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default
FF user.js: detected! => C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\ich@maltegoetz.de
FF Extension: Zotero Word for Windows Integration - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zoteroWinWordIntegration@zotero.org
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
FF Extension: IE Tab - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
FF Extension: DownloadHelper - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: zotero - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zotero@chnm.gmu.edu.xpi
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

S2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-23] (Adobe Systems Incorporated)
S2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [109184 2012-05-18] (Conexant Systems, Inc.)
S2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-08-19] ()
S3 McAWFwk; C:\Program Files\mcafee\msc\McAWFwk.exe [224704 2011-03-08] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 SystemStoreService; C:\Program Files (x86)\SoftwareUpdater\SystemStore.exe [296448 2013-06-03] ()
S2 0321031381771398mcinstcleanup; C:\Windows\TEMP\032103~1.EXE -cleanup -nolog [x]

==================== Drivers (Whitelisted) ====================

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbx64.sys [51016 2011-11-01] (Yamaha Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-16 09:14 - 2013-12-16 09:14 - 00000000 ____D C:\FRST
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 16:28 - 2013-12-15 21:33 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 16:28 - 2013-12-15 21:25 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-12 20:02 - 2013-12-12 20:02 - 00032575 _____ C:\Users\Jo\Downloads\measurement.jar
2013-12-06 13:16 - 2013-12-06 13:17 - 30694824 _____ (Oracle Corporation) C:\Users\Jo\Downloads\jre-7u45-windows-x64.exe
2013-12-03 17:04 - 2013-12-16 09:14 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-03 17:04 - 2013-12-15 21:33 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-11-28 22:06 - 2013-11-28 22:06 - 00000000 ____D C:\Users\Jo\AppData\Local\{C38BF032-CAA7-4652-86A6-32B649DFC0E3}
2013-11-28 21:59 - 2013-11-28 21:59 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-11-21 12:49 - 2013-11-21 13:05 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:46 - 2013-11-21 12:46 - 00003647 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-11-21 12:43 - 2013-12-15 20:48 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-11-21 12:38 - 2013-12-15 23:46 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-11-20 14:42 - 2013-11-20 14:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ___HD C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon
2013-11-20 14:25 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de
2013-11-17 11:17 - 2013-12-13 12:23 - 00000000 ____D C:\Users\Jo\Desktop\GW

==================== One Month Modified Files and Folders =======

2013-12-16 09:14 - 2013-12-16 09:14 - 00000000 ____D C:\FRST
2013-12-16 09:14 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-16 09:08 - 2012-11-08 14:28 - 00000000 ____D C:\Users\Jo
2013-12-16 07:36 - 2010-11-21 07:50 - 00696824 _____ C:\Windows\system32\perfh007.dat
2013-12-16 07:36 - 2010-11-21 07:50 - 00148088 _____ C:\Windows\system32\perfc007.dat
2013-12-16 07:36 - 2009-07-14 06:13 - 01612288 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-15 23:49 - 2010-11-21 08:00 - 00000000 ____D C:\Program Files\Windows Journal
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Cursors
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Services
2013-12-15 23:48 - 2013-09-23 18:38 - 00000000 ____D C:\Users\Jo\Desktop\gmic_gimp_win64
2013-12-15 23:48 - 2013-09-22 19:06 - 00000000 ____D C:\ProgramData\Ashampoo
2013-12-15 23:48 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\com.zipeg
2013-12-15 23:48 - 2013-07-27 17:19 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-15 23:48 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\CEP
2013-12-15 23:48 - 2013-06-03 21:53 - 00000000 ____D C:\Users\Jo\AppData\Local\DownloadGuide
2013-12-15 23:48 - 2013-05-27 18:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\vlc
2013-12-15 23:48 - 2013-04-06 23:59 - 00000000 ____D C:\Users\Jo\Documents\StreamTransport
2013-12-15 23:48 - 2013-04-06 22:05 - 00000000 ____D C:\ProgramData\RapidSolution
2013-12-15 23:48 - 2013-02-09 17:06 - 00000000 ____D C:\Users\Jo\Downloads\Max5_48561
2013-12-15 23:48 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Thunderbird
2013-12-15 23:48 - 2012-12-18 20:17 - 00000000 ____D C:\Windows\pss
2013-12-15 23:48 - 2012-12-18 17:32 - 00000000 ___RD C:\Users\Jo\Dropbox
2013-12-15 23:48 - 2012-11-11 18:17 - 00000000 ____D C:\ProgramData\DatacardService
2013-12-15 23:48 - 2012-11-09 12:16 - 00000000 ____D C:\Users\Jo\.rednotebook
2013-12-15 23:48 - 2012-11-08 21:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\MusicBee
2013-12-15 23:48 - 2012-11-08 14:45 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2013-12-15 23:48 - 2012-11-08 14:43 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:48 - 2012-08-24 16:03 - 00000000 ____D C:\ProgramData\McAfee
2013-12-15 23:48 - 2012-08-24 16:00 - 00000000 ____D C:\Windows\de
2013-12-15 23:48 - 2012-08-24 15:41 - 00000000 ____D C:\ProgramData\WildTangent
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2013-12-15 23:47 - 2013-10-02 14:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 23:47 - 2013-09-22 18:31 - 00000000 ____D C:\Program Files\Luminance HDR
2013-12-15 23:47 - 2013-09-18 15:08 - 00000000 ____D C:\Program Files (x86)\Zotero Standalone
2013-12-15 23:47 - 2013-09-01 21:14 - 00000000 ____D C:\Program Files (x86)\Calibre2
2013-12-15 23:47 - 2013-08-17 16:32 - 00000000 ____D C:\Program Files\CCleaner
2013-12-15 23:47 - 2013-08-17 09:55 - 00000000 ____D C:\Program Files (x86)\Scrivener
2013-12-15 23:47 - 2013-07-27 17:19 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-15 23:47 - 2013-06-03 21:57 - 00000000 ____D C:\Program Files (x86)\SoftwareUpdater
2013-12-15 23:47 - 2013-04-30 21:11 - 00000000 ____D C:\Program Files (x86)\Audacity
2013-12-15 23:47 - 2013-04-30 21:06 - 00000000 ____D C:\Program Files (x86)\MIDI to WAV Converter
2013-12-15 23:47 - 2013-04-06 23:57 - 00000000 ____D C:\Program Files (x86)\StreamTransport
2013-12-15 23:47 - 2013-03-27 23:20 - 00000000 ____D C:\Program Files\GIMP 2
2013-12-15 23:47 - 2013-03-02 02:24 - 00000000 ____D C:\Program Files (x86)\MusikLabor
2013-12-15 23:47 - 2013-02-19 14:13 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-12-15 23:47 - 2013-02-09 19:23 - 00000000 ____D C:\Program Files (x86)\Direct MIDI to MP3 Converter
2013-12-15 23:47 - 2013-02-08 23:01 - 00000000 ____D C:\Program Files (x86)\Tinypic
2013-12-15 23:47 - 2013-01-16 11:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-12-15 23:47 - 2012-12-02 03:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-15 23:47 - 2012-11-20 14:06 - 00000000 ____D C:\Program Files (x86)\EasyGPS
2013-12-15 23:47 - 2012-11-14 20:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-15 23:47 - 2012-11-11 18:18 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-12-15 23:47 - 2012-11-09 12:20 - 00000000 ____D C:\Program Files (x86)\Celtx
2013-12-15 23:47 - 2012-11-09 12:16 - 00000000 ____D C:\Program Files (x86)\RedNotebook
2013-12-15 23:47 - 2012-11-09 11:43 - 00000000 ____D C:\Program Files (x86)\Q10
2013-12-15 23:47 - 2012-11-08 22:02 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter
2013-12-15 23:47 - 2012-11-08 21:45 - 00000000 ____D C:\Program Files (x86)\MusicBee
2013-12-15 23:47 - 2012-08-24 17:02 - 00000000 ____D C:\Program Files\Elantech
2013-12-15 23:47 - 2012-08-24 16:05 - 00000000 ____D C:\Program Files (x86)\Zinio Reader 4
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files\mcafee
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files\Common Files\mcafee
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files (x86)\mcafee.com
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-12-15 23:47 - 2012-08-24 16:01 - 00000000 ____D C:\Program Files\Dell Support Center
2013-12-15 23:47 - 2012-08-24 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-15 23:47 - 2012-08-24 15:51 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-12-15 23:47 - 2012-08-24 15:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-15 23:47 - 2012-08-24 15:45 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-12-15 23:46 - 2013-11-21 12:38 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-12-15 23:46 - 2012-11-08 15:47 - 00000000 ____D C:\Program Files (x86)\Adobe Download Assistant
2013-12-15 23:46 - 2011-02-11 18:12 - 00000000 ____D C:\dell
2013-12-15 23:45 - 2013-10-22 22:21 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-12-15 23:44 - 2013-11-20 14:39 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-12-15 23:44 - 2013-11-20 14:25 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de
2013-12-15 23:44 - 2013-10-20 21:40 - 00000000 ____D C:\Users\Jo\Desktop\MediathekView_3.3.0
2013-12-15 23:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-15 23:32 - 2012-11-08 18:38 - 00000000 ____D C:\Users\Jo\Jo
2013-12-15 23:30 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\Zipeg
2013-12-15 23:30 - 2012-12-18 17:30 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Dropbox
2013-12-15 23:30 - 2012-11-08 14:31 - 00000000 ____D C:\Users\Jo\AppData\Local\VirtualStore
2013-12-15 23:20 - 2012-11-20 16:18 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-15 23:20 - 2012-08-24 15:30 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-15 23:12 - 2012-11-08 14:42 - 00000000 __RHD C:\MSOCache
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 21:33 - 2013-12-15 16:28 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 21:33 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-12-15 21:33 - 2010-11-21 08:00 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-12-15 21:25 - 2013-12-15 16:28 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-15 20:48 - 2013-11-21 12:43 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-12-15 20:48 - 2013-02-19 14:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\FileZilla
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-12-15 02:00 - 2012-11-08 15:46 - 00000000 ____D C:\Users\Jo\AppData\Local\Adobe
2013-12-15 01:14 - 2013-10-20 22:01 - 00000000 ____D C:\Users\Jo\MediathekView
2013-12-13 12:23 - 2013-11-17 11:17 - 00000000 ____D C:\Users\Jo\Desktop\GW
2013-12-12 20:02 - 2013-12-12 20:02 - 00032575 _____ C:\Users\Jo\Downloads\measurement.jar
2013-12-06 13:17 - 2013-12-06 13:16 - 30694824 _____ (Oracle Corporation) C:\Users\Jo\Downloads\jre-7u45-windows-x64.exe
2013-12-03 11:16 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Local\Thunderbird
2013-11-28 22:15 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (2)
2013-11-28 22:06 - 2013-11-28 22:06 - 00000000 ____D C:\Users\Jo\AppData\Local\{C38BF032-CAA7-4652-86A6-32B649DFC0E3}
2013-11-28 21:59 - 2013-11-28 21:59 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-11-21 13:05 - 2013-11-21 12:49 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:46 - 2013-11-21 12:46 - 00003647 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-11-21 12:46 - 2013-03-27 23:39 - 00000000 ____D C:\Users\Jo\.gimp-2.8
2013-11-20 14:45 - 2013-11-20 14:42 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ___HD C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon
2013-11-17 00:50 - 2012-11-08 16:04 - 00000000 ____D C:\Users\Jo\Documents\OneNote-Notizbücher

Some content of TEMP:
====================
C:\Users\Jo\AppData\Local\Temp\uninst1.exe
C:\Users\Jo\AppData\Local\Temp\vcredist_x86.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


safeboot: ==> The system is configured to boot to Safe Mode <===== ATTENTION!


LastRegBack: 2013-12-12 17:36

==================== End Of Log ============================

--- --- ---

--- --- ---

GMER:
GMER Logfile:

Code:

ATTFilter

GMER 2.1.19163 - GMER - Rootkit Detector and Remover
Rootkit scan 2013-12-16 09:28:08
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST1000LM rev.2AR2 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Jo\AppData\Local\Temp\pxldypoc.sys


---- Registry - GMER 2.1 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c01885bf04c2                                                         
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c01885bf04c2 (not active ControlSet)                                     
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3452E92A-952E-66F9-38D0-65DE1388D65E}                     
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3452E92A-952E-66F9-38D0-65DE1388D65E}@ialachfhdkajdklegp  0x6B 0x61 0x69 0x6A ...
Reg  HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3452E92A-952E-66F9-38D0-65DE1388D65E}@habbmanckkgomoba    0x6B 0x61 0x66 0x6B ...

---- EOF - GMER 2.1 ----

--- --- ---

Malewarebytes:

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2013.12.16.04

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Jo :: JO-PC [limitiert]

16.12.2013 09:30:35
MBAM-log-2013-12-16 (09-38-55).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 208173
Laufzeit: 3 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 2
C:\Users\Jo\AppData\Local\DownloadGuide (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt.
C:\Users\Jo\AppData\Local\DownloadGuide\Offers (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt.

Infizierte Dateien: 6
C:\Users\Jo\AppData\Local\DownloadGuide\amazon.ico (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt.
C:\Users\Jo\AppData\Local\DownloadGuide\TubeBoxSetup.exe (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt.
C:\Users\Jo\AppData\Local\DownloadGuide\Offers\addlyrics.exe (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt.
C:\Users\Jo\AppData\Local\DownloadGuide\Offers\foxydeal.exe (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt.
C:\Users\Jo\AppData\Local\DownloadGuide\Offers\onlinecasino.exe (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt.
C:\Users\Jo\AppData\Local\DownloadGuide\Offers\pinphotozoom.exe (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt.

(Ende)

schrauber · 16.12.2013, 11:33

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Josi · 16.12.2013, 22:25

Code:

ATTFilter

ComboFix 13-12-16.01 - Jo 16.12.2013  20:57:56.1.4 - x64 NETWORK
ausgeführt von:: c:\users\Jo\Downloads\Neuer Ordner (4)\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\users\Jo\AppData\Local\assembly\tmp
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_DCService.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-11-16 bis 2013-12-16  ))))))))))))))))))))))))))))))
.
.
2013-12-16 08:14 . 2013-12-16 08:14	--------	d-----w-	C:\FRST
2013-12-15 19:20 . 2013-12-15 19:20	--------	d-----w-	c:\users\Jo\AppData\Local\ElevatedDiagnostics
2013-12-15 15:28 . 2013-12-15 20:33	--------	d-----w-	c:\programdata\Norton
2013-12-15 15:28 . 2013-12-15 20:25	--------	d-----w-	c:\users\Jo\AppData\Local\NPE
2013-11-21 11:43 . 2013-12-15 19:48	--------	d-----w-	c:\users\Jo\AppData\Roaming\inkscape
2013-11-21 11:38 . 2013-12-15 22:46	--------	d-----w-	c:\program files (x86)\Inkscape
2013-11-20 13:42 . 2013-11-20 13:45	--------	d-----w-	c:\users\Jo\AppData\Roaming\Canon
2013-11-20 13:39 . 2013-11-20 13:39	--------	d-----w-	C:\CanoScan
2013-11-20 13:27 . 2013-11-20 13:27	--------	d-----w-	c:\program files (x86)\Canon
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-22 11:22 . 2012-08-24 14:14	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\Jo\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\Jo\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\Jo\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CAHeadless"="c:\program files (x86)\Adobe\Elements 11 Organizer\CAHeadless\ElementsAutoAnalyzer.exe" [2012-09-23 840784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-02-29 56088]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-03-27 291608]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-03-05 343168]
"Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-26 1117528]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-07-27 35768]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe" [2012-09-23 3477640]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 AdobeActiveFileMonitor11.0;Adobe Active File Monitor V11;c:\program files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [x]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 CxUtilSvc;CxUtilSvc;c:\program files\Conexant\SA3\CxUtilSvc.exe;c:\program files\Conexant\SA3\CxUtilSvc.exe [x]
R2 DellDigitalDelivery;Dell Digital Delivery Service;c:\program files (x86)\Dell Digital Delivery\DeliveryService.exe;c:\program files (x86)\Dell Digital Delivery\DeliveryService.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
R2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
R2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
R2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 SystemStoreService;System Store;c:\program files (x86)\SoftwareUpdater\SystemStore.exe  -displayname System Store -servicename SystemStoreService;c:\program files (x86)\SoftwareUpdater\SystemStore.exe  -displayname System Store -servicename SystemStoreService [x]
R2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]
R3 btwampfl;btwampfl Bluetooth filter driver;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys;c:\windows\SYSNATIVE\drivers\cfwids.sys [x]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]
R3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys;c:\windows\SYSNATIVE\drivers\mferkdet.sys [x]
R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys;c:\windows\SYSNATIVE\DRIVERS\rrnetcap.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 YMIDUSBW;Yamaha USB-MIDI Driver (WDM);c:\windows\system32\drivers\ymidusbx64.sys;c:\windows\SYSNATIVE\drivers\ymidusbx64.sys [x]
R4 0091361387223057mcinstcleanup;McAfee Application Installer Cleanup (0091361387223057);c:\users\Jo\AppData\Local\Temp\009136~1.EXE;c:\users\Jo\AppData\Local\Temp\009136~1.EXE [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 amdkmpfd;AMD PCI Root Bus Lower Filter;c:\windows\system32\DRIVERS\amdkmpfd.sys;c:\windows\SYSNATIVE\DRIVERS\amdkmpfd.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys;c:\windows\SYSNATIVE\drivers\mfewfpk.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe;c:\windows\SYSNATIVE\mfevtps.exe [x]
S3 ETD;Dell Touchpad;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys;c:\windows\SYSNATIVE\drivers\mfefirek.sys [x]
S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys;c:\windows\SYSNATIVE\DRIVERS\rrnetcap.sys [x]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys;c:\windows\SYSNATIVE\Drivers\RTSUVSTOR.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-20 15:18]
.
2013-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-20 15:18]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Jo\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Jo\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Jo\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\Jo\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ETDCtrl"="c:\program files\Elantech\ETDCtrl.exe" [2012-03-14 2894640]
"SmartAudio"="c:\program files\CONEXANT\SA3\SACpl.exe" [2012-02-21 1654400]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-19 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-19 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-19 439064]
"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]
"Stage Remote"="c:\program files (x86)\Dell\Stage Remote\StageRemote.exe" [2011-06-28 2022976]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\users\Jo\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
Trusted Zone: metacommunication.com\rs
TCP: DhcpNameServer = 217.68.161.141 217.68.161.171
TCP: Interfaces\{7C4FCED6-3348-4FD6-8308-7F34A883E75A}: NameServer = 193.189.244.206 193.189.244.225
TCP: Interfaces\{E7A70ECF-B651-4A33-80EC-977D3078D1A4}: NameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{FD2796C3-BD5C-4DCF-8824-DD57864E1757}: NameServer = 193.189.244.206 193.189.244.225
FF - ProfilePath - c:\users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\
FF - user.js: extensions.autoDisableScopes - 0 
FF - user.js: extensions.shownSelectionUI - true
FF - user.js: extensions.delta.tlbrSrchUrl - 
FF - user.js: extensions.delta.id - 32a03e95000000000000c01885bf04c1
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15945
FF - user.js: extensions.delta.vrsn - 1.8.24.6
FF - user.js: extensions.delta.vrsni - 1.8.24.6
FF - user.js: extensions.delta.vrsnTs - 1.8.24.620:10
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - de
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=119657&tt=280813_dt&tsp=4988
FF - user.js: extensions.delta_i.babExt - 
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-ROC_roc_ssl_v12 - c:\program files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-922225851-220411306-3927230562-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3452E92A-952E-66F9-38D0-65DE1388D65E}*]
"ialachfhdkajdklegp"=hex:6b,61,69,6a,65,69,6b,63,6d,6c,6c,68,69,6e,64,68,61,6b,
   68,69,61,6b,00,00
"habbmanckkgomoba"=hex:6b,61,66,6b,6d,67,61,65,64,70,62,6b,66,67,6a,63,6a,66,
   69,6b,6b,6e,00,00
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-12-16  21:13:33 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-12-16 20:13
.
Vor Suchlauf: 15 Verzeichnis(se), 532.903.309.312 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 532.069.994.496 Bytes frei
.
- - End Of File - - 0B01DF81F6B7DEF36E2D1E1E674A8D30

Vielen Dank. Ich hoffe das ist ok so.

schrauber · 17.12.2013, 10:48

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Josi · 18.12.2013, 12:04

Sorry, es hat etwas länger gedauert. Hier sind die Logfiles. Noch hat sich nichts getan, Computer startet noch immer nur im abgesicherten Modus.

Code:

ATTFilter

# AdwCleaner v3.015 - Bericht erstellt am 18/12/2013 um 10:32:03
# Updated 10/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Jo - JO-PC
# Gestartet von : C:\Users\Jo\Downloads\Neuer Ordner (4)\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****

Dienst Gefunden : SystemStoreService

***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Babylon.xml
Datei Gefunden : C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\invalidprefs.js
Datei Gefunden : C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\user.js
Datei Gefunden : C:\Windows\System32\Tasks\DSite
Datei Gefunden : C:\Windows\System32\Tasks\Software Updater
Datei Gefunden : C:\Windows\System32\Tasks\Software Updater Ui
Ordner Gefunden C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gefunden C:\Program Files (x86)\SoftwareUpdater
Ordner Gefunden C:\Program Files\DomaIQ Uninstaller
Ordner Gefunden C:\ProgramData\Babylon
Ordner Gefunden C:\ProgramData\DSearchLink
Ordner Gefunden C:\Users\Jo\AppData\Local\Software_Updater
Ordner Gefunden C:\Users\Jo\AppData\Roaming\DSite
Ordner Gefunden C:\Users\Jo\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden C:\Users\Jo\AppData\Roaming\UpdaterEX

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\Delta
Schlüssel Gefunden : HKCU\Software\dsiteproducts
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\performersoft llc
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : [x64] HKCU\Software\Delta
Schlüssel Gefunden : [x64] HKCU\Software\dsiteproducts
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : [x64] HKCU\Software\performersoft llc
Schlüssel Gefunden : [x64] HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\SOFTWARE\5848fd9b769e544
Schlüssel Gefunden : HKLM\Software\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\*\shell\filescout
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gefunden : HKLM\Software\DataMngr
Schlüssel Gefunden : HKLM\Software\Delta
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_diaryone_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_diaryone_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_midi-to-wav-converter_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_midi-to-wav-converter_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_q10_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_q10_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winzip_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winzip_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\VideoPerformerSetup_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\VideoPerformerSetup_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DomaIQ Uninstaller
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EasyGPS_is1
Schlüssel Gefunden : HKLM\Software\SimplyGen
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\DomaIQ

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16450


-\\ Mozilla Firefox v24.0 (de)

[ Datei : C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\prefs.js ]

Zeile gefunden : user_pref("extensions.delta.admin", false);
Zeile gefunden : user_pref("extensions.delta.aflt", "babsst");
Zeile gefunden : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gefunden : user_pref("extensions.delta.autoRvrt", "false");
Zeile gefunden : user_pref("extensions.delta.dfltLng", "de");
Zeile gefunden : user_pref("extensions.delta.excTlbr", false);
Zeile gefunden : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gefunden : user_pref("extensions.delta.id", "32a03e95000000000000c01885bf04c1");
Zeile gefunden : user_pref("extensions.delta.instlDay", "15945");
Zeile gefunden : user_pref("extensions.delta.instlRef", "sst");
Zeile gefunden : user_pref("extensions.delta.newTab", false);
Zeile gefunden : user_pref("extensions.delta.prdct", "delta");
Zeile gefunden : user_pref("extensions.delta.prtnrId", "delta");
Zeile gefunden : user_pref("extensions.delta.rvrt", "false");
Zeile gefunden : user_pref("extensions.delta.smplGrp", "none");
Zeile gefunden : user_pref("extensions.delta.tlbrId", "base");
Zeile gefunden : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gefunden : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gefunden : user_pref("extensions.delta.vrsnTs", "1.8.24.620:10:16");
Zeile gefunden : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gefunden : user_pref("extensions.delta_i.babExt", "");
Zeile gefunden : user_pref("extensions.delta_i.babTrack", "affID=119657&tt=280813_dt&tsp=4988");
Zeile gefunden : user_pref("extensions.delta_i.srcExt", "ss");

*************************

AdwCleaner[R0].txt - [6858 octets] - [18/12/2013 10:32:03]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [6918 octets] ##########

Code:

ATTFilter

# AdwCleaner v3.015 - Bericht erstellt am 18/12/2013 um 10:42:41
# Updated 10/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Jo - JO-PC
# Gestartet von : C:\Users\Jo\Downloads\Neuer Ordner (4)\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : SystemStoreService

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\DSearchLink
Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Program Files\DomaIQ Uninstaller
Ordner Gelöscht : C:\Users\Jo\AppData\Local\Software_Updater
Ordner Gelöscht : C:\Users\Jo\AppData\Roaming\DSite
Ordner Gelöscht : C:\Users\Jo\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Jo\AppData\Roaming\UpdaterEX
Datei Gelöscht : C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\invalidprefs.js
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Babylon.xml
Datei Gelöscht : C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\DSite
Datei Gelöscht : C:\Windows\System32\Tasks\Software Updater Ui
Datei Gelöscht : C:\Windows\System32\Tasks\Software Updater

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\*\shell\filescout
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\VideoPerformerSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\VideoPerformerSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EasyGPS_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\5848fd9b769e544
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_diaryone_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_diaryone_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_midi-to-wav-converter_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_midi-to-wav-converter_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_q10_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_q10_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winzip_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winzip_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\performersoft llc
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\SimplyGen
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DomaIQ Uninstaller
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DomaIQ

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16450


-\\ Mozilla Firefox v24.0 (de)

[ Datei : C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "32a03e95000000000000c01885bf04c1");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15945");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.620:10:16");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=119657&tt=280813_dt&tsp=4988");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");

*************************

AdwCleaner[R0].txt - [7030 octets] - [18/12/2013 10:32:03]
AdwCleaner[S0].txt - [6620 octets] - [18/12/2013 10:42:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6680 octets] ##########

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.16.07

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Jo :: JO-PC [Administrator]

Schutz: Deaktiviert

18.12.2013 10:20:06
mbam-log-2013-12-18 (10-20-06).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 213008
Laufzeit: 3 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Jo on 18.12.2013 at 10:51:21,54
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-922225851-220411306-3927230562-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56088F36-6E1A-4F1B-AD54-BC7F1B8402F4}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{0247CEF4-1F85-47D4-A761-7CE219BC3732}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{102DE340-BE99-4DDE-A9AE-D867ED045BB5}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{1335DF3C-5CE3-482D-A012-CDE61CE758F2}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{1728B04B-9BF4-48C3-9349-DBBD41342020}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{1813D028-8F98-4288-8B6D-BE5EA28363F3}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{20577AE4-A87A-4591-AB41-960B25C22E2F}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{22957882-1D00-429A-9BB1-776C47DDA1C5}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{29FD579A-16FA-4372-93E5-60D16DEE293D}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{2A9D6B04-FFFB-4014-9A9C-F453F2B185BB}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{2BD60F2F-56F6-4936-8745-B0006289ABD4}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{2BED60AD-43E7-4C2C-A274-D428768A5DBE}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{2D354100-0C47-40BA-919C-FEAC0285C843}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{367AD828-8843-4EA3-A847-89F26427A2F3}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{3CECD7BC-F132-4A0A-9803-0480790536E6}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{4C203947-2E97-4517-8E76-C853E0F3E6CF}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{4D8F7AAB-71E0-4DA1-8D6B-F63B1BFC6A92}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{4E602295-DA72-45CA-B106-350423775494}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{5029DE9C-1AF9-4DD1-9C16-E3A618277BB8}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{516266B9-FFD6-4247-8633-1D59F73C2E59}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{519558D9-01B6-484D-B763-8F2884538D8F}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{5E2F3203-6FE2-46A5-BF16-01870D57FB64}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{67AB1EF8-013A-4027-874D-ED79D0A2CD98}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{6996645A-E4D6-44D7-88AB-3CFA3386CCC2}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{6E974C8A-AFF9-47BB-A1CF-E0A3571CF275}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{73A7A155-7F0D-4673-80D7-FDD65D36A4F1}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{74A075ED-BD27-44AB-888B-E409D6E0EAFC}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{7672AEC5-CE01-45EB-B4CC-C1B442E7A08C}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{7721DC8E-27F4-410F-97C9-37EB317BA8BC}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{79778211-D18D-4B91-A92C-2F8EE9756A47}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{7B977D9F-D523-4060-BC56-A80DA37C6871}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{7BA2CE61-E2B7-42B2-85D8-D420F37A7369}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{869DC4AF-941A-4E36-A423-D667DE922535}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{8C10A612-E15E-4B2C-A976-6C7F03F8C024}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{8C3E2B51-756C-4EA7-8A59-6E1037968E19}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{8C4C6ACC-9444-4E20-9520-DDCE466C5C6C}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{8F790313-5EF3-41EA-9A49-30768313E0E7}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{90156DCD-BEC0-4925-AADC-F5BBD139612C}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{95A49A19-467D-4FF9-833D-B704D9EF38FC}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{9821C525-C71B-46B2-BF9A-F7560A5FC1D8}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{A1FC4248-CAF7-41D6-8D2E-110298A07019}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{A663B4B5-C2F1-498C-89C7-9085A24BE249}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{B036757D-BAD8-41EC-8F2E-B3889F3BC144}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{B5529087-99A7-4788-8C51-0E00B5DFF45F}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{B859C87E-63C1-4DD2-B27B-88C8636F0D1C}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{BA09E23E-E300-4B81-8502-60C95C5BC185}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{BA97B283-87D6-4C25-B40B-068D9602618A}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{BC48EB19-5396-4BC7-B340-0E47A55CDA7A}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{BD8F5CC4-97B4-4A60-AF19-C05BDBAA2BD8}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{C221CCC8-AEDA-485B-9C22-75EBF15A8161}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{C38BF032-CAA7-4652-86A6-32B649DFC0E3}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{C5148533-EFD4-4F74-8763-47FFE5B50EF6}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{C86A60F7-E5F9-4765-9539-A4FFFEB8F370}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{CBDD90E1-64E3-4827-BEB7-78710CE82B33}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{D0387005-635A-4602-81D7-31BA110B88B1}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{D2A86F50-C64A-475A-9009-CBAC04C0714C}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{D5CC2EEB-49C7-49FE-B14C-5BC52C6AA26A}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{D8C4CAE2-E316-48D5-B06A-8BAA75B2345F}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{DA0F15A3-FA33-4333-AF02-D3FC3202CE97}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{DF6154B4-7E06-4C55-90AE-0D3258DBE8F7}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{E10F07B2-AD42-4506-BE63-9F7939A5A78E}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{E1567CD5-4B62-4B90-86F3-659E78681EBF}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{E82A7DFC-1A9A-4E1F-8725-4E2BBF295628}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{E97823AF-C875-492E-A262-CC29654C6AD7}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{EB329A93-B5B0-4E36-A8D5-2EA0BC952E11}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{EB876237-7DF2-4132-BC74-C5D3C1B78091}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{ED39D013-2997-4800-ADA0-195737C1804A}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{F143ADF0-0623-42BE-ABBF-D323451137C4}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{F6E092A1-6BD7-4878-9890-1AC7C49D3B98}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{FBF70E76-B807-4C24-9CAD-0D497B21861B}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{FC751CA8-6437-4045-8DF7-9B60CBF310A9}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{FCBC62B9-3073-43FB-A98F-70101F5FA3A4}
Successfully deleted: [Empty Folder] C:\Users\Jo\appdata\local\{FFC14E9D-7669-4005-A2FC-14879300C225}



~~~ FireFox

Emptied folder: C:\Users\Jo\AppData\Roaming\mozilla\firefox\profiles\00w20ajh.default\minidumps [245 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.12.2013 at 10:54:03,09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-12-2013 02
Ran by Jo (administrator) on JO-PC on 18-12-2013 10:58:54
Running from C:\Users\Jo\Downloads\Neuer Ordner (4)
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)

==================== Processes (Whitelisted) =================

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2894640 2012-03-14] (ELAN Microelectronics Corp.)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SA3\SACpl.exe [1654400 2012-02-21] (Conexant Systems, Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [CAHeadless] - C:\Program Files (x86)\Adobe\Elements 11 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [840784 2012-09-23] (Adobe Systems Incorporated)
HKCU\...\RunOnce: [Report] - C:\AdwCleaner\AdwCleaner[S0].txt [6772 2013-12-18] ()
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35768 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe [3477640 2012-09-23] (Adobe Systems Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
Lsa: [Notification Packages] scecli c:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk -> C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20121109001455.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\mcafee\SystemCore\ScriptSn.20121109001456.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 217.68.161.141 217.68.161.171
Tcpip\..\Interfaces\{7C4FCED6-3348-4FD6-8308-7F34A883E75A}: [NameServer]193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{E7A70ECF-B651-4A33-80EC-977D3078D1A4}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{FD2796C3-BD5C-4DCF-8824-DD57864E1757}: [NameServer]193.189.244.206 193.189.244.225

FireFox:
========
FF ProfilePath: C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\ich@maltegoetz.de
FF Extension: Zotero Word for Windows Integration - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zoteroWinWordIntegration@zotero.org
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
FF Extension: IE Tab - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
FF Extension: DownloadHelper - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: zotero - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zotero@chnm.gmu.edu.xpi
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: No Name - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

S2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-23] (Adobe Systems Incorporated)
S2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [109184 2012-05-18] (Conexant Systems, Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S4 0091361387223057mcinstcleanup; C:\Users\Jo\AppData\Local\Temp\009136~1.EXE -cleanup -nolog [x]
S2 McShield; "C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" [x]
S2 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" [x]

==================== Drivers (Whitelisted) ====================

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbx64.sys [51016 2011-11-01] (Yamaha Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-18 10:54 - 2013-12-18 10:54 - 00008571 _____ C:\Users\Jo\Desktop\JRT.txt
2013-12-18 10:51 - 2013-12-18 10:51 - 00000000 ____D C:\Windows\ERUNT
2013-12-18 10:32 - 2013-12-18 10:42 - 00000000 ____D C:\AdwCleaner
2013-12-16 21:13 - 2013-12-16 21:13 - 00021869 _____ C:\ComboFix.txt
2013-12-16 20:56 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-16 20:56 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-16 20:56 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-16 20:56 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-16 20:56 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-16 20:56 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-16 20:56 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-16 20:56 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-16 20:35 - 2013-12-16 21:13 - 00000000 ____D C:\Qoobox
2013-12-16 20:35 - 2013-12-16 21:12 - 00000000 ____D C:\Windows\erdnt
2013-12-16 10:53 - 2013-12-16 10:53 - 00001737 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-12-16 09:14 - 2013-12-18 10:58 - 00000000 ____D C:\FRST
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 16:28 - 2013-12-15 21:33 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 16:28 - 2013-12-15 21:25 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-12 20:02 - 2013-12-12 20:02 - 00032575 _____ C:\Users\Jo\Downloads\measurement.jar
2013-12-06 13:16 - 2013-12-06 13:17 - 30694824 _____ (Oracle Corporation) C:\Users\Jo\Downloads\jre-7u45-windows-x64.exe
2013-12-03 17:04 - 2013-12-18 10:58 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-03 17:04 - 2013-12-15 21:33 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-11-28 21:59 - 2013-12-18 10:37 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-11-21 12:49 - 2013-11-21 13:05 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:43 - 2013-12-15 20:48 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-11-21 12:38 - 2013-12-15 23:46 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-11-20 14:42 - 2013-11-20 14:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ____D C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon
2013-11-20 14:25 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de

==================== One Month Modified Files and Folders =======

2013-12-18 10:58 - 2013-12-16 09:14 - 00000000 ____D C:\FRST
2013-12-18 10:58 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-18 10:54 - 2013-12-18 10:54 - 00008571 _____ C:\Users\Jo\Desktop\JRT.txt
2013-12-18 10:51 - 2013-12-18 10:51 - 00000000 ____D C:\Windows\ERUNT
2013-12-18 10:50 - 2010-11-21 07:50 - 00696824 _____ C:\Windows\system32\perfh007.dat
2013-12-18 10:50 - 2010-11-21 07:50 - 00148088 _____ C:\Windows\system32\perfc007.dat
2013-12-18 10:50 - 2009-07-14 06:13 - 01612288 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-18 10:42 - 2013-12-18 10:32 - 00000000 ____D C:\AdwCleaner
2013-12-18 10:37 - 2013-11-28 21:59 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-12-16 21:18 - 2012-11-14 20:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-16 21:13 - 2013-12-16 21:13 - 00021869 _____ C:\ComboFix.txt
2013-12-16 21:13 - 2013-12-16 20:35 - 00000000 ____D C:\Qoobox
2013-12-16 21:13 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2013-12-16 21:12 - 2013-12-16 20:35 - 00000000 ____D C:\Windows\erdnt
2013-12-16 21:09 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-12-16 21:08 - 2013-08-17 16:47 - 00016908 _____ C:\Windows\PFRO.log
2013-12-16 21:07 - 2009-07-14 03:34 - 74448896 _____ C:\Windows\system32\config\software.bak
2013-12-16 21:07 - 2009-07-14 03:34 - 23855104 _____ C:\Windows\system32\config\system.bak
2013-12-16 21:07 - 2009-07-14 03:34 - 00786432 _____ C:\Windows\system32\config\default.bak
2013-12-16 21:07 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\security.bak
2013-12-16 21:07 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\sam.bak
2013-12-16 14:52 - 2013-08-17 09:55 - 00000000 ____D C:\Program Files (x86)\Scrivener
2013-12-16 10:53 - 2013-12-16 10:53 - 00001737 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-16 09:08 - 2012-11-08 14:28 - 00000000 ____D C:\Users\Jo
2013-12-15 23:49 - 2010-11-21 08:00 - 00000000 ____D C:\Program Files\Windows Journal
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Cursors
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Services
2013-12-15 23:48 - 2013-09-23 18:38 - 00000000 ____D C:\Users\Jo\Desktop\gmic_gimp_win64
2013-12-15 23:48 - 2013-09-22 19:06 - 00000000 ____D C:\ProgramData\Ashampoo
2013-12-15 23:48 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\com.zipeg
2013-12-15 23:48 - 2013-07-27 17:19 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-15 23:48 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\CEP
2013-12-15 23:48 - 2013-05-27 18:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\vlc
2013-12-15 23:48 - 2013-04-06 23:59 - 00000000 ____D C:\Users\Jo\Documents\StreamTransport
2013-12-15 23:48 - 2013-04-06 22:05 - 00000000 ____D C:\ProgramData\RapidSolution
2013-12-15 23:48 - 2013-02-09 17:06 - 00000000 ____D C:\Users\Jo\Downloads\Max5_48561
2013-12-15 23:48 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Thunderbird
2013-12-15 23:48 - 2012-12-18 20:17 - 00000000 ____D C:\Windows\pss
2013-12-15 23:48 - 2012-12-18 17:32 - 00000000 ___RD C:\Users\Jo\Dropbox
2013-12-15 23:48 - 2012-11-11 18:17 - 00000000 ____D C:\ProgramData\DatacardService
2013-12-15 23:48 - 2012-11-09 12:16 - 00000000 ____D C:\Users\Jo\.rednotebook
2013-12-15 23:48 - 2012-11-08 21:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\MusicBee
2013-12-15 23:48 - 2012-11-08 14:45 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2013-12-15 23:48 - 2012-11-08 14:43 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:48 - 2012-08-24 16:00 - 00000000 ____D C:\Windows\de
2013-12-15 23:48 - 2012-08-24 15:41 - 00000000 ____D C:\ProgramData\WildTangent
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2013-12-15 23:47 - 2013-10-02 14:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 23:47 - 2013-09-22 18:31 - 00000000 ____D C:\Program Files\Luminance HDR
2013-12-15 23:47 - 2013-09-18 15:08 - 00000000 ____D C:\Program Files (x86)\Zotero Standalone
2013-12-15 23:47 - 2013-09-01 21:14 - 00000000 ____D C:\Program Files (x86)\Calibre2
2013-12-15 23:47 - 2013-08-17 16:32 - 00000000 ____D C:\Program Files\CCleaner
2013-12-15 23:47 - 2013-07-27 17:19 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-15 23:47 - 2013-04-30 21:11 - 00000000 ____D C:\Program Files (x86)\Audacity
2013-12-15 23:47 - 2013-04-30 21:06 - 00000000 ____D C:\Program Files (x86)\MIDI to WAV Converter
2013-12-15 23:47 - 2013-04-06 23:57 - 00000000 ____D C:\Program Files (x86)\StreamTransport
2013-12-15 23:47 - 2013-03-27 23:20 - 00000000 ____D C:\Program Files\GIMP 2
2013-12-15 23:47 - 2013-03-02 02:24 - 00000000 ____D C:\Program Files (x86)\MusikLabor
2013-12-15 23:47 - 2013-02-19 14:13 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-12-15 23:47 - 2013-02-09 19:23 - 00000000 ____D C:\Program Files (x86)\Direct MIDI to MP3 Converter
2013-12-15 23:47 - 2013-02-08 23:01 - 00000000 ____D C:\Program Files (x86)\Tinypic
2013-12-15 23:47 - 2013-01-16 11:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-12-15 23:47 - 2012-12-02 03:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-15 23:47 - 2012-11-20 14:06 - 00000000 ____D C:\Program Files (x86)\EasyGPS
2013-12-15 23:47 - 2012-11-11 18:18 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-12-15 23:47 - 2012-11-09 12:20 - 00000000 ____D C:\Program Files (x86)\Celtx
2013-12-15 23:47 - 2012-11-09 12:16 - 00000000 ____D C:\Program Files (x86)\RedNotebook
2013-12-15 23:47 - 2012-11-09 11:43 - 00000000 ____D C:\Program Files (x86)\Q10
2013-12-15 23:47 - 2012-11-08 22:02 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter
2013-12-15 23:47 - 2012-11-08 21:45 - 00000000 ____D C:\Program Files (x86)\MusicBee
2013-12-15 23:47 - 2012-08-24 17:02 - 00000000 ____D C:\Program Files\Elantech
2013-12-15 23:47 - 2012-08-24 16:05 - 00000000 ____D C:\Program Files (x86)\Zinio Reader 4
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files\mcafee
2013-12-15 23:47 - 2012-08-24 16:01 - 00000000 ____D C:\Program Files\Dell Support Center
2013-12-15 23:47 - 2012-08-24 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-15 23:47 - 2012-08-24 15:51 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-12-15 23:47 - 2012-08-24 15:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-15 23:47 - 2012-08-24 15:45 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-12-15 23:46 - 2013-11-21 12:38 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-12-15 23:46 - 2012-11-08 15:47 - 00000000 ____D C:\Program Files (x86)\Adobe Download Assistant
2013-12-15 23:46 - 2011-02-11 18:12 - 00000000 ____D C:\dell
2013-12-15 23:45 - 2013-10-22 22:21 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-12-15 23:44 - 2013-11-20 14:39 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-12-15 23:44 - 2013-11-20 14:25 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de
2013-12-15 23:44 - 2013-10-20 21:40 - 00000000 ____D C:\Users\Jo\Desktop\MediathekView_3.3.0
2013-12-15 23:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-15 23:32 - 2012-11-08 18:38 - 00000000 ____D C:\Users\Jo\Jo
2013-12-15 23:30 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\Zipeg
2013-12-15 23:30 - 2012-12-18 17:30 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Dropbox
2013-12-15 23:30 - 2012-11-08 14:31 - 00000000 ____D C:\Users\Jo\AppData\Local\VirtualStore
2013-12-15 23:20 - 2012-11-20 16:18 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-15 23:20 - 2012-08-24 15:30 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-15 23:12 - 2012-11-08 14:42 - 00000000 ___RD C:\MSOCache
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 21:33 - 2013-12-15 16:28 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 21:33 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-12-15 21:33 - 2010-11-21 08:00 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-12-15 21:25 - 2013-12-15 16:28 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-15 20:48 - 2013-11-21 12:43 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-12-15 20:48 - 2013-02-19 14:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\FileZilla
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-12-15 02:00 - 2012-11-08 15:46 - 00000000 ____D C:\Users\Jo\AppData\Local\Adobe
2013-12-15 01:14 - 2013-10-20 22:01 - 00000000 ____D C:\Users\Jo\MediathekView
2013-12-13 12:23 - 2013-11-17 11:17 - 00000000 ____D C:\Users\Jo\Desktop\GW
2013-12-12 20:02 - 2013-12-12 20:02 - 00032575 _____ C:\Users\Jo\Downloads\measurement.jar
2013-12-06 13:17 - 2013-12-06 13:16 - 30694824 _____ (Oracle Corporation) C:\Users\Jo\Downloads\jre-7u45-windows-x64.exe
2013-12-03 11:16 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Local\Thunderbird
2013-11-28 22:15 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (2)
2013-11-21 13:05 - 2013-11-21 12:49 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:46 - 2013-03-27 23:39 - 00000000 ____D C:\Users\Jo\.gimp-2.8
2013-11-20 14:45 - 2013-11-20 14:42 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ____D C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon

Some content of TEMP:
====================
C:\Users\Jo\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


safeboot: ==> The system is configured to boot to Safe Mode <===== ATTENTION!


LastRegBack: 2013-12-12 17:36

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 19.12.2013, 09:59

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Josi · 19.12.2013, 14:35

Hier sind die Logfiles:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=4432f943db7c56418028ac4b77705507
# engine=16325
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-19 01:05:30
# local_time=2013-12-19 02:05:30 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 314181 139088180 0 0
# scanned=367495
# found=1
# cleaned=0
# scan_time=8143
sh=A5EA0EEAD65BE813BAFB50FBD526D5CA2DEA4A95 ft=1 fh=0b64fe4757a35fbd vn="multiple threats" ac=I fn="C:\Users\Jo\Downloads\setup.exe"

SecurityCheck:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.77  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Security Center service is not running! This report may not be accurate! 
McAfee  Anti-Virus und Anti-Spyware   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java 7 Update 9  
 Java version out of Date! 
 Adobe Flash Player 11.8.800.168  
 Adobe Reader 10.1.4 Adobe Reader out of Date!  
 Mozilla Firefox 24.0 Firefox out of Date!  
 Mozilla Thunderbird (17.0.2) 
````````Process Check: objlist.exe by Laurent````````  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-12-2013 05
Ran by Jo (administrator) on JO-PC on 19-12-2013 14:18:06
Running from C:\Users\Jo\Downloads\Neuer Ordner (4)
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)

==================== Processes (Whitelisted) =================

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2894640 2012-03-14] (ELAN Microelectronics Corp.)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SA3\SACpl.exe [1654400 2012-02-21] (Conexant Systems, Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [CAHeadless] - C:\Program Files (x86)\Adobe\Elements 11 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [840784 2012-09-23] (Adobe Systems Incorporated)
HKCU\...\RunOnce: [Report] - C:\AdwCleaner\AdwCleaner[S0].txt [6772 2013-12-18] ()
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35768 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe [3477640 2012-09-23] (Adobe Systems Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [NeroLauncher] - C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe [66872 2012-03-10] ()
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [577024 2012-03-06] (Creative Technology Ltd)
HKLM-x32\...\Run: [AccuWeatherWidget] - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj [2835443 2012-02-01] ()
Lsa: [Notification Packages] scecli c:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jo\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk -> C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20121109001455.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\mcafee\SystemCore\ScriptSn.20121109001456.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{7C4FCED6-3348-4FD6-8308-7F34A883E75A}: [NameServer]193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{E7A70ECF-B651-4A33-80EC-977D3078D1A4}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{FD2796C3-BD5C-4DCF-8824-DD57864E1757}: [NameServer]193.189.244.206 193.189.244.225

FireFox:
========
FF ProfilePath: C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\ich@maltegoetz.de
FF Extension: No Name - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\staged
FF Extension: Zotero Word for Windows Integration - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zoteroWinWordIntegration@zotero.org
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
FF Extension: IE Tab - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
FF Extension: DownloadHelper - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Zotero - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zotero@chnm.gmu.edu.xpi
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

S2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-23] (Adobe Systems Incorporated)
S2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [109184 2012-05-18] (Conexant Systems, Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S4 0091361387223057mcinstcleanup; C:\Users\Jo\AppData\Local\Temp\009136~1.EXE -cleanup -nolog [x]
S2 McShield; "C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" [x]
S2 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" [x]

==================== Drivers (Whitelisted) ====================

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbx64.sys [51016 2011-11-01] (Yamaha Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-19 14:15 - 2013-12-19 14:15 - 00891200 _____ C:\Users\Jo\Desktop\SecurityCheck.exe
2013-12-19 11:45 - 2013-12-19 11:45 - 00000000 ____D C:\Program Files (x86)\ESET
2013-12-19 01:17 - 2013-12-19 01:17 - 00000000 ____D C:\Windows\Downloaded Installations
2013-12-19 01:01 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-12-19 00:46 - 2013-12-19 01:01 - 00013225 _____ C:\Windows\IE11_main.log
2013-12-19 00:46 - 2013-12-19 00:46 - 02077392 _____ (Microsoft Corporation) C:\Users\Jo\Downloads\IE11-Windows6.1.exe
2013-12-19 00:33 - 2013-12-19 00:33 - 00614784 _____ C:\Users\Jo\Downloads\HijackThis - CHIP-Downloader.exe
2013-12-18 10:51 - 2013-12-18 10:51 - 00000000 ____D C:\Windows\ERUNT
2013-12-18 10:32 - 2013-12-18 10:42 - 00000000 ____D C:\AdwCleaner
2013-12-16 21:13 - 2013-12-16 21:13 - 00021869 _____ C:\ComboFix.txt
2013-12-16 20:56 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-16 20:56 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-16 20:56 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-16 20:56 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-16 20:56 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-16 20:56 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-16 20:56 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-16 20:56 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-16 20:35 - 2013-12-16 21:13 - 00000000 ____D C:\Qoobox
2013-12-16 20:35 - 2013-12-16 21:12 - 00000000 ____D C:\Windows\erdnt
2013-12-16 10:53 - 2013-12-16 10:53 - 00001737 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-12-16 09:14 - 2013-12-19 14:18 - 00000000 ____D C:\FRST
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 16:28 - 2013-12-15 21:33 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 16:28 - 2013-12-15 21:25 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-03 17:04 - 2013-12-19 14:18 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-03 17:04 - 2013-12-15 21:33 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-11-28 21:59 - 2013-12-18 23:17 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-11-21 12:49 - 2013-11-21 13:05 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:43 - 2013-12-15 20:48 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-11-21 12:38 - 2013-12-15 23:46 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-11-20 14:42 - 2013-11-20 14:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ____D C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon
2013-11-20 14:25 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de

==================== One Month Modified Files and Folders =======

2013-12-19 14:18 - 2013-12-16 09:14 - 00000000 ____D C:\FRST
2013-12-19 14:18 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-19 14:15 - 2013-12-19 14:15 - 00891200 _____ C:\Users\Jo\Desktop\SecurityCheck.exe
2013-12-19 11:48 - 2010-11-21 07:50 - 00696824 _____ C:\Windows\system32\perfh007.dat
2013-12-19 11:48 - 2010-11-21 07:50 - 00148088 _____ C:\Windows\system32\perfc007.dat
2013-12-19 11:48 - 2009-07-14 06:13 - 01612288 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-19 11:45 - 2013-12-19 11:45 - 00000000 ____D C:\Program Files (x86)\ESET
2013-12-19 01:17 - 2013-12-19 01:17 - 00000000 ____D C:\Windows\Downloaded Installations
2013-12-19 01:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-12-19 01:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-12-19 01:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\zh-HK
2013-12-19 01:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\tr-TR
2013-12-19 01:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-19 01:04 - 2013-08-17 16:47 - 00018172 _____ C:\Windows\PFRO.log
2013-12-19 01:03 - 2012-12-18 20:17 - 00000000 ____D C:\Windows\pss
2013-12-19 01:03 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-19 01:01 - 2013-12-19 00:46 - 00013225 _____ C:\Windows\IE11_main.log
2013-12-19 01:01 - 2012-08-24 15:12 - 01222489 _____ C:\Windows\WindowsUpdate.log
2013-12-19 00:46 - 2013-12-19 00:46 - 02077392 _____ (Microsoft Corporation) C:\Users\Jo\Downloads\IE11-Windows6.1.exe
2013-12-19 00:43 - 2012-11-08 18:38 - 00000000 ____D C:\Users\Jo\Jo
2013-12-19 00:37 - 2013-02-19 14:13 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-12-19 00:37 - 2012-12-18 17:30 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Dropbox
2013-12-19 00:36 - 2013-08-25 15:49 - 00000000 ____D C:\Users\Jo\AppData\Roaming\elsterformular
2013-12-19 00:36 - 2013-08-25 15:48 - 00000000 ____D C:\ProgramData\elsterformular
2013-12-19 00:35 - 2013-04-06 23:57 - 00000000 ____D C:\Program Files (x86)\StreamTransport
2013-12-19 00:33 - 2013-12-19 00:33 - 00614784 _____ C:\Users\Jo\Downloads\HijackThis - CHIP-Downloader.exe
2013-12-18 23:17 - 2013-11-28 21:59 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-12-18 10:51 - 2013-12-18 10:51 - 00000000 ____D C:\Windows\ERUNT
2013-12-18 10:42 - 2013-12-18 10:32 - 00000000 ____D C:\AdwCleaner
2013-12-16 21:18 - 2012-11-14 20:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-16 21:13 - 2013-12-16 21:13 - 00021869 _____ C:\ComboFix.txt
2013-12-16 21:13 - 2013-12-16 20:35 - 00000000 ____D C:\Qoobox
2013-12-16 21:13 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2013-12-16 21:12 - 2013-12-16 20:35 - 00000000 ____D C:\Windows\erdnt
2013-12-16 21:09 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-12-16 21:07 - 2009-07-14 03:34 - 74448896 _____ C:\Windows\system32\config\software.bak
2013-12-16 21:07 - 2009-07-14 03:34 - 23855104 _____ C:\Windows\system32\config\system.bak
2013-12-16 21:07 - 2009-07-14 03:34 - 00786432 _____ C:\Windows\system32\config\default.bak
2013-12-16 21:07 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\security.bak
2013-12-16 21:07 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\sam.bak
2013-12-16 14:52 - 2013-08-17 09:55 - 00000000 ____D C:\Program Files (x86)\Scrivener
2013-12-16 10:53 - 2013-12-16 10:53 - 00001737 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-16 09:08 - 2012-11-08 14:28 - 00000000 ____D C:\Users\Jo
2013-12-15 23:49 - 2010-11-21 08:00 - 00000000 ____D C:\Program Files\Windows Journal
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Cursors
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Services
2013-12-15 23:48 - 2013-09-22 19:06 - 00000000 ____D C:\ProgramData\Ashampoo
2013-12-15 23:48 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\com.zipeg
2013-12-15 23:48 - 2013-07-27 17:19 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-15 23:48 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\CEP
2013-12-15 23:48 - 2013-05-27 18:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\vlc
2013-12-15 23:48 - 2013-04-06 23:59 - 00000000 ____D C:\Users\Jo\Documents\StreamTransport
2013-12-15 23:48 - 2013-04-06 22:05 - 00000000 ____D C:\ProgramData\RapidSolution
2013-12-15 23:48 - 2013-02-09 17:06 - 00000000 ____D C:\Users\Jo\Downloads\Max5_48561
2013-12-15 23:48 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Thunderbird
2013-12-15 23:48 - 2012-12-18 17:32 - 00000000 ___RD C:\Users\Jo\Dropbox
2013-12-15 23:48 - 2012-11-11 18:17 - 00000000 ____D C:\ProgramData\DatacardService
2013-12-15 23:48 - 2012-11-09 12:16 - 00000000 ____D C:\Users\Jo\.rednotebook
2013-12-15 23:48 - 2012-11-08 21:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\MusicBee
2013-12-15 23:48 - 2012-11-08 14:45 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2013-12-15 23:48 - 2012-11-08 14:43 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:48 - 2012-08-24 16:00 - 00000000 ____D C:\Windows\de
2013-12-15 23:48 - 2012-08-24 15:41 - 00000000 ____D C:\ProgramData\WildTangent
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2013-12-15 23:47 - 2013-10-02 14:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 23:47 - 2013-09-18 15:08 - 00000000 ____D C:\Program Files (x86)\Zotero Standalone
2013-12-15 23:47 - 2013-09-01 21:14 - 00000000 ____D C:\Program Files (x86)\Calibre2
2013-12-15 23:47 - 2013-08-17 16:32 - 00000000 ____D C:\Program Files\CCleaner
2013-12-15 23:47 - 2013-07-27 17:19 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-15 23:47 - 2013-04-30 21:11 - 00000000 ____D C:\Program Files (x86)\Audacity
2013-12-15 23:47 - 2013-04-30 21:06 - 00000000 ____D C:\Program Files (x86)\MIDI to WAV Converter
2013-12-15 23:47 - 2013-03-27 23:20 - 00000000 ____D C:\Program Files\GIMP 2
2013-12-15 23:47 - 2013-03-02 02:24 - 00000000 ____D C:\Program Files (x86)\MusikLabor
2013-12-15 23:47 - 2013-02-09 19:23 - 00000000 ____D C:\Program Files (x86)\Direct MIDI to MP3 Converter
2013-12-15 23:47 - 2013-02-08 23:01 - 00000000 ____D C:\Program Files (x86)\Tinypic
2013-12-15 23:47 - 2013-01-16 11:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-12-15 23:47 - 2012-12-02 03:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-15 23:47 - 2012-11-20 14:06 - 00000000 ____D C:\Program Files (x86)\EasyGPS
2013-12-15 23:47 - 2012-11-11 18:18 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-12-15 23:47 - 2012-11-09 12:20 - 00000000 ____D C:\Program Files (x86)\Celtx
2013-12-15 23:47 - 2012-11-09 12:16 - 00000000 ____D C:\Program Files (x86)\RedNotebook
2013-12-15 23:47 - 2012-11-09 11:43 - 00000000 ____D C:\Program Files (x86)\Q10
2013-12-15 23:47 - 2012-11-08 22:02 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter
2013-12-15 23:47 - 2012-11-08 21:45 - 00000000 ____D C:\Program Files (x86)\MusicBee
2013-12-15 23:47 - 2012-08-24 17:02 - 00000000 ____D C:\Program Files\Elantech
2013-12-15 23:47 - 2012-08-24 16:05 - 00000000 ____D C:\Program Files (x86)\Zinio Reader 4
2013-12-15 23:47 - 2012-08-24 16:01 - 00000000 ____D C:\Program Files\Dell Support Center
2013-12-15 23:47 - 2012-08-24 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-15 23:47 - 2012-08-24 15:51 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-12-15 23:47 - 2012-08-24 15:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-15 23:47 - 2012-08-24 15:45 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-12-15 23:46 - 2013-11-21 12:38 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-12-15 23:46 - 2012-11-08 15:47 - 00000000 ____D C:\Program Files (x86)\Adobe Download Assistant
2013-12-15 23:46 - 2011-02-11 18:12 - 00000000 ____D C:\dell
2013-12-15 23:45 - 2013-10-22 22:21 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-12-15 23:44 - 2013-11-20 14:39 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-12-15 23:44 - 2013-11-20 14:25 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de
2013-12-15 23:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-15 23:30 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\Zipeg
2013-12-15 23:30 - 2012-11-08 14:31 - 00000000 ____D C:\Users\Jo\AppData\Local\VirtualStore
2013-12-15 23:20 - 2012-11-20 16:18 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-15 23:20 - 2012-08-24 15:30 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-15 23:12 - 2012-11-08 14:42 - 00000000 ___RD C:\MSOCache
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 21:33 - 2013-12-15 16:28 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 21:33 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-12-15 21:33 - 2010-11-21 08:00 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-12-15 21:25 - 2013-12-15 16:28 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-15 20:48 - 2013-11-21 12:43 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-12-15 20:48 - 2013-02-19 14:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\FileZilla
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-12-15 02:00 - 2012-11-08 15:46 - 00000000 ____D C:\Users\Jo\AppData\Local\Adobe
2013-12-15 01:14 - 2013-10-20 22:01 - 00000000 ____D C:\Users\Jo\MediathekView
2013-12-13 12:23 - 2013-11-17 11:17 - 00000000 ____D C:\Users\Jo\Desktop\GW
2013-12-03 11:16 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Local\Thunderbird
2013-11-28 22:15 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (2)
2013-11-21 13:05 - 2013-11-21 12:49 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:46 - 2013-03-27 23:39 - 00000000 ____D C:\Users\Jo\.gimp-2.8
2013-11-20 14:45 - 2013-11-20 14:42 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ____D C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon

Some content of TEMP:
====================
C:\Users\Jo\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


safeboot: ==> The system is configured to boot to Safe Mode <===== ATTENTION!


LastRegBack: 2013-12-12 17:36

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Getan hat sich leider immer noch nichts. Was mich wundert, dass im SecurityCheck logfile noch immer McAfee steht, ich habe das vorgestern deinstalliert, weil es sich nicht deaktivieren ließ und dauernd hing.
Was mir noch auffiel (ist vielleicht unwichtig, aber naja): in der Systemkonfiguration war "Benutzerdefinierter Systemstart" angeklickt (ich wars nicht). Habe das zu "Normaler Systemstart" geändert, ist nach Neustart auch immer noch drin, fährt aber nach wie vor eigenständig abgesichert hoch (erst rauschen alle Treiber über den Bildschirm, dann kommt das Anmeldefenster)

schrauber · 20.12.2013, 09:32

Downloade dir bitte Windows Repair (All In One) von hier.

Installiere das Programm. Starte es, nachdem die Installation abgeschlossen wurde.
Klicke auf Step 2 und drücke unter Check Disk auf Do It.
Wenn der Vorgang abgeschlossen ist, klicke auf Step 3 und drücke unter System File Check auf Do It.
Nachdem der Vorgang abgeschlossen ist, klicke auf Start Repairs, wähle den Advanced Mode und drücke Start.
Gehe bitte sicher, dass die Kästchen wie unten zu sehen angehakt sind. Bitte hake zusätzlich noch Set Windows Services to Default Startup an.
Hake Restart System when Finished an.
Drücke Start.

Josi · 21.12.2013, 00:33

Das hat leider nichts gebracht. Schritt 3 konnte ich nicht ausführen aufgrund folgender Meldung:
"Es steht eine Systemreparatur an, deren Abschluss einen Neustart erfordert".
Es stand aber nichts aus und ein Neustart hat nichts geändert.

Hier ist noch das Logfile, falls erforderlich:

Code:

ATTFilter

Starting Repairs...
   Start (20.12.2013 23:36:18)

01 - Reset Registry Permissions 01/03
   HKEY_CURRENT_USER & Sub Keys
   Start (20.12.2013 23:36:18)
   Running Repair Under Current User Account
   Done (20.12.2013 23:36:23)

01 - Reset Registry Permissions 02/03
   HKEY_LOCAL_MACHINE & Sub Keys
   Start (20.12.2013 23:36:23)
   Running Repair Under Current User Account
   Done (20.12.2013 23:37:23)

01 - Reset Registry Permissions 03/03
   HKEY_CLASSES_ROOT & Sub Keys
   Start (20.12.2013 23:37:23)
   Running Repair Under Current User Account
   Done (20.12.2013 23:42:09)

02 - Reset File Permissions 01/21
   C:\AdwCleaner & Sub Folders
   Start (20.12.2013 23:42:10)
   Running Repair Under Current User Account
   Done (20.12.2013 23:42:20)

02 - Reset File Permissions 02/21
   C:\Apps & Sub Folders
   Start (20.12.2013 23:42:20)
   Running Repair Under Current User Account
   Done (20.12.2013 23:42:23)

02 - Reset File Permissions 03/21
   C:\CanoScan & Sub Folders
   Start (20.12.2013 23:42:23)
   Running Repair Under Current User Account
   Done (20.12.2013 23:42:25)

02 - Reset File Permissions 04/21
   C:\dell & Sub Folders
   Start (20.12.2013 23:42:25)
   Running Repair Under Current User Account
   Done (20.12.2013 23:42:34)

02 - Reset File Permissions 05/21
   C:\Dokumente und Einstellungen & Sub Folders
   Start (20.12.2013 23:42:34)
   Running Repair Under Current User Account
   Done (20.12.2013 23:50:05)

02 - Reset File Permissions 06/21
   C:\Drivers & Sub Folders
   Start (20.12.2013 23:50:05)
   Running Repair Under Current User Account
   Done (20.12.2013 23:50:18)

02 - Reset File Permissions 07/21
   C:\FRST & Sub Folders
   Start (20.12.2013 23:50:18)
   Running Repair Under Current User Account
   Done (20.12.2013 23:50:20)

02 - Reset File Permissions 08/21
   C:\Intel & Sub Folders
   Start (20.12.2013 23:50:20)
   Running Repair Under Current User Account
   Done (20.12.2013 23:50:23)

02 - Reset File Permissions 09/21
   C:\MAGIX & Sub Folders
   Start (20.12.2013 23:50:23)
   Running Repair Under Current User Account
   Done (20.12.2013 23:50:25)

02 - Reset File Permissions 10/21
   C:\MSOCache & Sub Folders
   Start (20.12.2013 23:50:25)
   Running Repair Under Current User Account
   Done (20.12.2013 23:50:36)

02 - Reset File Permissions 11/21
   C:\Neuer Ordner & Sub Folders
   Start (20.12.2013 23:50:36)
   Running Repair Under Current User Account
   Done (20.12.2013 23:50:38)

02 - Reset File Permissions 12/21
   C:\PerfLogs & Sub Folders
   Start (20.12.2013 23:50:38)
   Running Repair Under Current User Account
   Done (20.12.2013 23:50:41)

02 - Reset File Permissions 13/21
   C:\Program Files & Sub Folders
   Start (20.12.2013 23:50:41)
   Running Repair Under Current User Account
   Done (20.12.2013 23:51:43)

02 - Reset File Permissions 14/21
   C:\Program Files (x86) & Sub Folders
   Start (20.12.2013 23:51:43)
   Running Repair Under Current User Account
   Done (20.12.2013 23:53:39)

02 - Reset File Permissions 15/21
   C:\ProgramData & Sub Folders
   Start (20.12.2013 23:53:39)
   Running Repair Under Current User Account
   Done (20.12.2013 23:56:34)

02 - Reset File Permissions 16/21
   C:\Programme & Sub Folders
   Start (20.12.2013 23:56:34)
   Running Repair Under Current User Account
   Done (20.12.2013 23:57:11)

02 - Reset File Permissions 17/21
   C:\Qoobox & Sub Folders
   Start (20.12.2013 23:57:11)
   Running Repair Under Current User Account
   Done (20.12.2013 23:57:18)

02 - Reset File Permissions 18/21
   C:\RegBackup & Sub Folders
   Start (20.12.2013 23:57:18)
   Running Repair Under Current User Account
   Done (20.12.2013 23:57:22)

02 - Reset File Permissions 19/21
   C:\System Recovery & Sub Folders
   Start (20.12.2013 23:57:22)
   Running Repair Under Current User Account
   Done (20.12.2013 23:57:25)

02 - Reset File Permissions 20/21
   C:\Temp & Sub Folders
   Start (20.12.2013 23:57:25)
   Running Repair Under Current User Account
   Done (20.12.2013 23:57:27)

02 - Reset File Permissions 21/21
   C:\Windows & Sub Folders
   Start (20.12.2013 23:57:27)
   Running Repair Under Current User Account
   Done (21.12.2013 00:00:18)

02 - Reset File Permissions: Cleanup
    & Sub Folders
   Start (21.12.2013 00:00:18)
   Running Repair Under Current User Account
Processing ACL of: <\\?\C:\Documents and Settings>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Application Data>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Desktop>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Documents>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Favorites>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Start Menu>

SetACL finished successfully.
Processing ACL of: <\\?\C:\ProgramData\Templates>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\All Users\Application Data>

SetACL finished with error(s): 
SetACL error message: The call to SetNamedSecurityInfo () failed
Operating system error message: Zugriff verweigert

Processing ACL of: <\\?\C:\Users\All Users\Desktop>

SetACL finished with error(s): 
SetACL error message: The call to SetNamedSecurityInfo () failed
Operating system error message: Zugriff verweigert

Processing ACL of: <\\?\C:\Users\All Users\Documents>

SetACL finished with error(s): 
SetACL error message: The call to SetNamedSecurityInfo () failed
Operating system error message: Zugriff verweigert

Processing ACL of: <\\?\C:\Users\All Users\Favorites>

SetACL finished with error(s): 
SetACL error message: The call to SetNamedSecurityInfo () failed
Operating system error message: Zugriff verweigert

Processing ACL of: <\\?\C:\Users\All Users\Start Menu>

SetACL finished with error(s): 
SetACL error message: The call to SetNamedSecurityInfo () failed
Operating system error message: Zugriff verweigert

Processing ACL of: <\\?\C:\Users\All Users\Templates>

SetACL finished with error(s): 
SetACL error message: The call to SetNamedSecurityInfo () failed
Operating system error message: Zugriff verweigert

Processing ACL of: <\\?\C:\Users\Default User>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Application Data>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Cookies>
Reading the SD from <\\?\C:\Users\Default\Cookies> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Default\Local Settings>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\My Documents>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\NetHood>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\PrintHood>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Recent>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\SendTo>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Start Menu>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Templates>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\AppData\Local\Application Data>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\AppData\Local\History>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\AppData\Local\Temporary Internet Files>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Documents\My Music>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Documents\My Pictures>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Default\Documents\My Videos>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Jo\Application Data>
Reading the SD from <\\?\C:\Users\Jo\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\Cookies>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Jo\Local Settings>
Reading the SD from <\\?\C:\Users\Jo\Local Settings> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\My Documents>
Reading the SD from <\\?\C:\Users\Jo\My Documents> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\NetHood>
Reading the SD from <\\?\C:\Users\Jo\NetHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\PrintHood>
Reading the SD from <\\?\C:\Users\Jo\PrintHood> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\Recent>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Jo\SendTo>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Jo\Start Menu>
Reading the SD from <\\?\C:\Users\Jo\Start Menu> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\Templates>
Reading the SD from <\\?\C:\Users\Jo\Templates> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\AppData\Local\Application Data>
Reading the SD from <\\?\C:\Users\Jo\AppData\Local\Application Data> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\AppData\Local\History>
Reading the SD from <\\?\C:\Users\Jo\AppData\Local\History> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\AppData\Local\Temporary Internet Files>

SetACL finished successfully.
Processing ACL of: <\\?\C:\Users\Jo\Documents\My Music>
Reading the SD from <\\?\C:\Users\Jo\Documents\My Music> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\Documents\My Pictures>
Reading the SD from <\\?\C:\Users\Jo\Documents\My Pictures> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

Processing ACL of: <\\?\C:\Users\Jo\Documents\My Videos>
Reading the SD from <\\?\C:\Users\Jo\Documents\My Videos> failed with: Das System kann die angegebene Datei nicht finden.


SetACL finished with error(s): 
SetACL error message: The call to GetNamedSecurityInfo () failed
Operating system error message: Das System kann die angegebene Datei nicht finden.

   Done (21.12.2013 00:00:23)

04 - Repair WMI
   Start (21.12.2013 00:00:23)
   Running Repair Under Current User Account
   Done (21.12.2013 00:03:53)

05 - Repair Windows Firewall
   Start (21.12.2013 00:03:53)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:04:23)

06 - Repair Internet Explorer
   Start (21.12.2013 00:04:23)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:04:52)

09 - Remove Policies Set By Infections
   Start (21.12.2013 00:04:52)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:04:57)

12 - Repair Winsock & DNS Cache
   Start (21.12.2013 00:04:57)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:05:07)

14 - Repair Proxy Settings
   Start (21.12.2013 00:05:07)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:05:12)

16 - Repair Windows Updates
   Start (21.12.2013 00:05:12)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:05:29)

22.01 - Repair bat Association
   Start (21.12.2013 00:05:29)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:05:34)

22.02 - Repair cmd Association
   Start (21.12.2013 00:05:34)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:05:38)

22.03 - Repair com Association
   Start (21.12.2013 00:05:38)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:05:43)

22.04 - Repair Directory Association
   Start (21.12.2013 00:05:43)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:05:48)

22.05 - Repair Drive Association
   Start (21.12.2013 00:05:48)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:05:52)

22.06 - Repair exe Association
   Start (21.12.2013 00:05:52)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:05:57)

22.07 - Repair Folder Association
   Start (21.12.2013 00:05:57)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:06:01)

22.08 - Repair inf Association
   Start (21.12.2013 00:06:01)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:06:06)

22.09 - Repair lnk (Shortcuts) Association
   Start (21.12.2013 00:06:06)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:06:11)

22.10 - Repair msc Association
   Start (21.12.2013 00:06:11)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:06:15)

22.11 - Repair reg Association
   Start (21.12.2013 00:06:15)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:06:20)

22.12 - Repair scr Association
   Start (21.12.2013 00:06:20)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:06:25)

23 - Repair Windows Safe Mode
   Start (21.12.2013 00:06:25)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:06:29)

24 - Repair Print Spooler
   Start (21.12.2013 00:06:29)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:06:34)

25 - Restore Important Windows Services
   Start (21.12.2013 00:06:34)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:06:43)

26 - Set Windows Services To Default Startup
   Start (21.12.2013 00:06:43)
   Running Repair Under Current User Account
   Running Repair Under Current User Account
   Done (21.12.2013 00:06:59)

   Skipping Repair.
   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
   Current version: 6.1

Cleaning up empty logs...

All Selected Repairs Done.
   Done (21.12.2013 00:07:00)
   Total Repair Time: 00:30:42


...YOU MUST RESTART YOUR SYSTEM...
   Running Repair Under Current User Account

Noch eine Frage: In der Systemkonfiguration steht zwar im ersten Reiter "Allgemein": "Normaler Systemstart", aber unter "Start" ist ein Häkchen für "Abgesicherter Start". Das ist vielleicht ne blöde Frage, aber ich bin mir nicht sicher, ob das so soll, also ob sich das auf jeden Start oder eventuelle Problemstarts bezieht.

Ich hoffe ich muss den Rechner nicht neu aufsetzen, ich habe leider kein Systemabbild gemacht, um die Programme usw. zu retten.

schrauber · 21.12.2013, 16:37

Mach den Haken mal raus.

Josi · 23.12.2013, 21:23

Ha, versucht, ging aber nicht. Wenn man den Haken rausgemacht hat, ist es vorne automatisch auf "abgesichert" gesprungen und umgekehrt. Irgendwas stimmte da nicht.

Habe den Struggle aber jetzt aufgegeben und angefangen, den Rechner neu aufzusetzen.
Denke, selbst wenn irgendwie die Ursache zu finden ist - schon die Tatsache, dass die Systemreparatur und auch die bekannten Virenprogramme absolut nichts finden, deutet auf was ziemlich fieses hin, wer weiß was und wo alles infiziert ist. Ich glaube nicht, dass ich das jemals wieder sauber kriegen würde.

Auf jeden Fall vielen Dank für die Unterstützung. Bin mal wieder schwer begeistert von diesem Board!

schrauber · 24.12.2013, 10:55

Gern Geschehen

21.12.2013, 16:37	#10
schrauber /// the machine /// TB-Ausbilder	Virenbefall - IExplorer öffnet viele Fenster Mach den Haken mal raus. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

24.12.2013, 10:55	#12
schrauber /// the machine /// TB-Ausbilder	Virenbefall - IExplorer öffnet viele Fenster Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Virenbefall - IExplorer öffnet viele Fenster

Log-Analyse und Auswertung: Virenbefall - IExplorer öffnet viele Fenster