Dann nimm notfall den CCleaner zum Löschen der Temps...

Hola Cosinus,
ok, habe ich gemacht.
Jetzt noch ein Frst log Scan mit angeklickten
Registry / Services / Drivers / Processes / Internet, viele Grüße, und herzlichen Dank bis hierher, Romanos:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-09-2014 01
Ran by Rainer (administrator) on RAINER-PC on 25-09-2014 23:05:39
Running from C:\Users\Rainer\Downloads
Loaded Profile: Rainer (Available profiles: Rainer & Conny & Rainer-User & Marie-Sophie & Felix)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(TOSHIBA) C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\Platform\McUICnt.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7289376 2009-03-30] (Realtek Semiconductor)
HKLM\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [421888 2007-04-16] (TOSHIBA Electronics, Inc.)
HKLM\...\Run: [SVPWUTIL] => C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe [438272 2008-11-21] (TOSHIBA)
HKLM\...\Run: [KeNotify] => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe [1011712 2009-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2009-04-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1451304 2009-03-20] (Synaptics Incorporated)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [96144 2009-03-04] (Toshiba Europe GmbH)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-30] (Realtek Semiconductor Corp.)
HKLM\...\Run: [OrderReminder] => C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe [98304 2006-01-30] (Hewlett-Packard)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.)
HKLM\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.)
HKLM\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.)
HKLM\...\Run: [TAccessibility] => C:\Program Files\TOSHIBA\Accessibility\TAccessibility.exe [110592 2009-04-24] ()
HKLM\...\Run: [TCtryIOHook] => TCtrlIOHook.exe
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3586509278-78834929-860225448-1000\...\Run: [TOSHIBA Online Product Information] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [6158240 2009-03-16] (TOSHIBA)
HKU\S-1-5-21-3586509278-78834929-860225448-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [TOSHIBA Online Product Information] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [6158240 2009-03-16] (TOSHIBA)
HKU\S-1-5-18\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoControlPanel] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe (No File)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Shortcut-Leiste.lnk
ShortcutTarget: Microsoft Office Shortcut-Leiste.lnk -> C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft-Indexerstellung.lnk
ShortcutTarget: Microsoft-Indexerstellung.lnk -> C:\Program Files\Microsoft Office\Office\FINDFAST.EXE (Microsoft Corporation)
Startup: C:\Users\Conny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Rainer-User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {38AEB7B3-42CC-4C33-9290-BEA08B6FE742} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG;
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - F31624B0AF444080B7F139E05E41A758 URL = hxxp://isearch.avg.com/search?cid={72680FDB-E8CB-437D-AEE8-9F9D0761B89D}&mid=34d71d940f5847d1b30bd16a1c122099-aca251ad60a79a90d151588985182fee0518d1c3&lang=de&ds=tt014&pr=sa&d=2011-12-19 22:25:18&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {38AEB7B3-42CC-4C33-9290-BEA08B6FE742} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG;
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {B07F54E6-0806-47DB-B5D8-398F240776F2} file:///E:/viewer/ORDcmViewCD.ocx
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: haufereader - No CLSID Value - 
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default
FF Keyword.URL: hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @protectdisc.com/NPMPDRM -> C:\Program Files\Common Files\mpDRM\NPMPDRM.dll ( )
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WEB.DE MailCheck - C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\Extensions\toolbar@web.de [2014-09-24]
FF Extension: WOT - C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-08-18]
FF Extension: Ghostery - C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\Extensions\firefox@ghostery.com.xpi [2014-08-15]
FF Extension: UITBAutoInstaller - C:\Program Files\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} [2014-09-25]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2011-12-15]
FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2011-12-15]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome: 
=======
CHR CustomProfile: C:\Users\Rainer\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2011-12-15]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 camsvc; C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [20544 2009-04-16] (TOSHIBA)
R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [46448 2009-03-10] (TOSHIBA CORPORATION)
S4 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [242424 2009-02-11] (WildTangent, Inc.)
R2 HomeNetSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
S4 HRService; C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe [71024 2010-10-25] ()
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [145568 2014-04-25] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [472072 2014-06-12] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [655936 2014-07-24] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169800 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [179600 2014-06-20] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
S4 SXDS10; C:\Program Files\Common Files\soft Xpansion\sxds10.exe [234096 2013-10-06] (soft Xpansion)
R2 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [62776 2009-04-01] (TOSHIBA Corporation)
R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [176128 2009-04-24] (TOSHIBA Corporation) [File not signed]
R2 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [73728 2009-03-17] (TOSHIBA Corporation) [File not signed]
R2 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [656752 2009-04-15] (TOSHIBA Corporation)
S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 acedrv10; C:\Windows\system32\drivers\acedrv10.sys [330144 2007-07-27] (Protect Software GmbH)
R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
R2 acehlp10; C:\Windows\system32\drivers\acehlp10.sys [251680 2007-07-27] (Protect Software GmbH)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [62832 2014-06-20] (McAfee, Inc.)
S3 FTD2XX; C:\Windows\System32\Drivers\FTD2XX.sys [29292 2004-10-15] (FTDI Ltd.) [File not signed]
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [60104 2011-01-24] (FTDI Ltd.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [147912 2013-09-23] (McAfee, Inc.)
R0 LPCFilter; C:\Windows\System32\DRIVERS\LPCFilter.sys [25896 2008-05-07] (COMPAL ELECTRONIC INC.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-09-25] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [135968 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [238176 2014-06-20] (McAfee, Inc.)
S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [67816 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [369248 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [576048 2014-06-20] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [349192 2014-07-24] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [81296 2014-07-24] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [217224 2014-06-20] (McAfee, Inc.)
R3 PGEffect; C:\Windows\System32\DRIVERS\pgeffect.sys [22272 2009-03-18] (TOSHIBA Corporation)
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [154272 2008-11-11] (Realtek Semiconductor Corp.)
R1 RtlProt; C:\Windows\System32\DRIVERS\rtlprot.sys [25896 2007-04-23] (Windows (R) Codename Longhorn DDK provider)
S3 SAFAUSB; C:\Windows\System32\Drivers\VocTrace.sys [16035 2003-12-19] (Windows (R) 2000 DDK provider)
R2 TVALZFL; C:\Windows\System32\DRIVERS\TVALZFL.sys [12920 2009-03-21] (TOSHIBA Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S4 avgtp; \??\C:\Windows\system32\drivers\avgtpx86.sys [X]
S3 catchme; \??\C:\Users\Rainer\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-25 22:12 - 2014-09-25 22:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-09-25 21:35 - 2014-09-25 21:35 - 00000809 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\Program Files\CCleaner
2014-09-25 21:33 - 2014-09-25 21:33 - 04901352 _____ (Piriform Ltd) C:\Users\Rainer\Downloads\ccsetup417.exe
2014-09-25 15:38 - 2014-09-25 15:39 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-24 23:09 - 2014-09-09 08:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 22:56 - 2014-09-24 22:56 - 00448512 _____ (OldTimer Tools) C:\Users\Rainer\Downloads\TFC.exe
2014-09-24 21:32 - 2014-09-24 22:15 - 00000021 _____ () C:\Users\Rainer\Downloads\Fixlist.txt
2014-09-24 09:21 - 2014-09-24 09:21 - 00001880 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ___RD () C:\Program Files\Skype
2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-09-18 07:42 - 2014-09-18 07:42 - 00068225 _____ () C:\Users\Rainer\Downloads\ESET20140918.txt
2014-09-17 16:56 - 2014-09-17 16:56 - 00006428 _____ () C:\Users\Rainer-User\Downloads\Antimalware txt.txt
2014-09-16 22:16 - 2014-09-16 22:17 - 02347384 _____ (ESET) C:\Users\Rainer-User\Downloads\esetsmartinstaller_deu.exe
2014-09-12 19:41 - 2014-09-12 19:41 - 00007191 _____ () C:\Users\Rainer-User\Downloads\Malwarebytes Anti-Malware 2014 09 10.txt
2014-09-12 18:27 - 2014-09-12 18:27 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-09-12 18:26 - 2014-09-12 18:26 - 00002112 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2014-09-12 18:26 - 2014-09-12 18:26 - 00001037 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\OpenCandy
2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Program Files\WEB.DE MailCheck
2014-09-11 17:08 - 2013-03-02 23:24 - 00000744 _____ () C:\Users\Felix\Desktop\Tapps DE.lnk
2014-09-11 14:53 - 2014-08-19 03:46 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-11 14:53 - 2014-08-19 03:46 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-11 14:53 - 2014-08-19 03:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-11 14:53 - 2014-08-19 03:44 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-09-11 14:53 - 2014-08-19 03:41 - 06003200 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-11 14:53 - 2014-08-19 03:41 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2014-09-11 14:53 - 2014-08-19 03:41 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-11 14:53 - 2014-08-19 03:41 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-11 14:53 - 2014-08-19 03:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-11 14:53 - 2014-08-19 03:40 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-11 14:53 - 2014-08-19 03:40 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-09-11 14:53 - 2014-08-19 03:40 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-11 14:53 - 2014-08-19 03:39 - 11082752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-11 14:53 - 2014-08-19 03:39 - 02005504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-11 14:53 - 2014-08-19 03:39 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-11 14:53 - 2014-08-19 03:39 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-09-11 14:53 - 2014-08-19 03:39 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-11 14:53 - 2014-08-19 03:39 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-09-11 14:53 - 2014-08-19 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-11 14:53 - 2014-08-19 03:39 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-11 14:53 - 2014-08-19 03:38 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2014-09-11 14:53 - 2014-08-19 02:10 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-09-11 14:53 - 2014-08-19 00:33 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-11 14:53 - 2014-08-19 00:33 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-11 14:53 - 2014-08-19 00:31 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-11 14:53 - 2014-08-19 00:30 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-29 08:43 - 2014-08-23 03:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-29 08:43 - 2014-08-23 01:26 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-25 23:05 - 2014-08-17 22:03 - 00000000 ____D () C:\Users\Rainer\Downloads\FRST-OlderVersion
2014-09-25 23:05 - 2014-08-10 22:03 - 00022798 _____ () C:\Users\Rainer\Downloads\FRST.txt
2014-09-25 23:05 - 2014-04-29 00:09 - 01100800 _____ (Farbar) C:\Users\Rainer\Downloads\FRST.exe
2014-09-25 23:05 - 2013-11-11 00:10 - 00000000 ____D () C:\FRST
2014-09-25 22:43 - 2009-06-09 09:00 - 00000000 ____D () C:\Windows\Panther
2014-09-25 22:38 - 2012-04-04 21:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-25 22:34 - 2011-09-26 23:43 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-25 22:12 - 2014-09-25 22:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-09-25 22:12 - 2013-02-20 08:55 - 00001756 _____ () C:\Users\Public\Desktop\McAfee Internet Security.lnk
2014-09-25 21:40 - 2014-04-28 22:25 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-25 21:35 - 2014-09-25 21:35 - 00000809 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-09-25 21:35 - 2014-09-25 21:35 - 00000000 ____D () C:\Program Files\CCleaner
2014-09-25 21:33 - 2014-09-25 21:33 - 04901352 _____ (Piriform Ltd) C:\Users\Rainer\Downloads\ccsetup417.exe
2014-09-25 21:26 - 2008-02-24 09:46 - 01181881 ____N () C:\Windows\WindowsUpdate.log
2014-09-25 21:23 - 2014-06-22 14:29 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8e15a8ab2474.job
2014-09-25 21:23 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-25 21:23 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-25 21:23 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-25 18:32 - 2006-11-02 15:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-25 18:09 - 2011-12-02 22:18 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-09-25 18:06 - 2014-05-07 23:06 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-25 15:39 - 2014-09-25 15:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-25 15:25 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2014-09-24 23:10 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-24 22:56 - 2014-09-24 22:56 - 00448512 _____ (OldTimer Tools) C:\Users\Rainer\Downloads\TFC.exe
2014-09-24 22:40 - 2010-11-14 21:59 - 00000000 ____D () C:\Users\Rainer-User\AppData\Roaming\Skype
2014-09-24 22:15 - 2014-09-24 21:32 - 00000021 _____ () C:\Users\Rainer\Downloads\Fixlist.txt
2014-09-24 15:50 - 2011-11-26 10:09 - 00000000 ____D () C:\Users\Felix\AppData\Roaming\Skype
2014-09-24 09:21 - 2014-09-24 09:21 - 00001880 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ___RD () C:\Program Files\Skype
2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-24 09:21 - 2014-09-24 09:21 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-09-24 09:21 - 2010-11-17 08:51 - 00000000 ____D () C:\Users\Conny\AppData\Roaming\Skype
2014-09-24 09:20 - 2010-11-14 21:59 - 00000000 ____D () C:\ProgramData\Skype
2014-09-18 07:42 - 2014-09-18 07:42 - 00068225 _____ () C:\Users\Rainer\Downloads\ESET20140918.txt
2014-09-17 18:04 - 2014-07-17 21:26 - 00000000 ____D () C:\Program Files\Opera
2014-09-17 16:56 - 2014-09-17 16:56 - 00006428 _____ () C:\Users\Rainer-User\Downloads\Antimalware txt.txt
2014-09-16 22:17 - 2014-09-16 22:16 - 02347384 _____ (ESET) C:\Users\Rainer-User\Downloads\esetsmartinstaller_deu.exe
2014-09-16 22:14 - 2011-06-23 12:41 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-15 09:06 - 2011-12-09 23:58 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-12 19:41 - 2014-09-12 19:41 - 00007191 _____ () C:\Users\Rainer-User\Downloads\Malwarebytes Anti-Malware 2014 09 10.txt
2014-09-12 18:28 - 2011-11-28 00:47 - 00000000 ____D () C:\Program Files\TuneUp Utilities 2012
2014-09-12 18:28 - 2011-11-28 00:45 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-09-12 18:27 - 2014-09-12 18:27 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-09-12 18:27 - 2011-09-13 22:46 - 00000000 ____D () C:\Users\Rainer-User\AppData\Roaming\DVDVideoSoft
2014-09-12 18:27 - 2011-02-25 21:28 - 00000000 ____D () C:\Users\Rainer-User\Documents\DVDVideoSoft
2014-09-12 18:27 - 2010-10-18 19:04 - 00000000 ____D () C:\Program Files\DVDVideoSoft
2014-09-12 18:26 - 2014-09-12 18:26 - 00002112 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2014-09-12 18:26 - 2014-09-12 18:26 - 00001037 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\OpenCandy
2014-09-12 18:26 - 2014-09-12 18:26 - 00000000 ____D () C:\Program Files\WEB.DE MailCheck
2014-09-12 18:26 - 2011-09-13 22:47 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\DVDVideoSoft
2014-09-12 18:26 - 2010-10-18 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-09-12 18:26 - 2010-10-18 19:04 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2014-09-11 17:25 - 2008-01-21 09:16 - 01626604 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-11 15:48 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-11 15:09 - 2013-08-07 12:11 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-11 14:55 - 2006-11-02 12:24 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-09-11 14:34 - 2012-04-04 21:24 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-11 14:34 - 2011-06-01 22:29 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-09 08:24 - 2014-09-24 23:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-06 21:30 - 2011-12-15 01:57 - 00000000 ____D () C:\Program Files\Common Files\Mcafee
2014-08-31 13:55 - 2013-12-03 16:10 - 00001781 _____ () C:\Users\Rainer\Desktop\FOTOParadies.lnk
2014-08-31 13:55 - 2013-12-03 16:10 - 00000000 ____D () C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FOTOParadies
2014-08-31 13:55 - 2012-09-11 21:19 - 00000000 ____D () C:\Program Files\FOTOParadies
2014-08-29 09:02 - 2006-11-02 14:47 - 00322424 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-26 17:23 - 2011-11-20 21:35 - 00000020 ____H () C:\ProgramData\PKP_DLdu.DAT
2014-08-26 17:22 - 2011-11-20 21:37 - 00000020 ____H () C:\ProgramData\PKP_DLdw.DAT

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-25 21:29

==================== End Of Log ============================
         

--- --- ---

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Hallo Cosinus,
manchmal bleibt es nach einer Tasteneingabe einfach stehen und braucht dann so 40-50 sec.,
um dann weiter zu machen.
Malwarebytes gibt folgendes Ergebnis:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 05.10.2014
Suchlauf-Zeit: 23:20:51
Logdatei: Anti-Malware-Textdatei 2014 10 05.txt
Administrator: Nein

Version: 2.00.2.1012
Malware Datenbank: v2014.10.05.08
Rootkit Datenbank: v2014.09.19.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Rainer-User

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 362262
Verstrichene Zeit: 21 Min, 50 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 2
PUP.Optional.DealKeeper.A, HKLM\SOFTWARE\Deal Keeper, , [f42861b086f676c09e0afe1d6a99d32d], 
PUP.Optional.BrowserGuard.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\kfepagcelbegkpkcjgfeecmlnmkedjin, , [bc6043cedd9f82b498091af2c93a8080], 

Registrierungswerte: 1
PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1381094394899&tguid=66920-6787-1381094394899-AF07B6AD22DF51CE02B3D1B428BA0F24&q=%s, , [72aad43d1e5e58de72ea29f904ffe61a]

Registrierungsdaten: 1
PUP.Optional.SafeFinder.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}),,[08148e836f0d2b0b84fdb157a461de22]

Ordner: 4
PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy, , [e7355fb27408ba7c3a01e8fa6c969070], 
PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\177586C2EEA542989844699BACEE36C5, , [e7355fb27408ba7c3a01e8fa6c969070], 
PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\8255D8B8BE3D4D2C91C3FF151064C5B9, , [e7355fb27408ba7c3a01e8fa6c969070], 
PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\A34781A3E41146DFADBA6A7B704BF5CD, , [e7355fb27408ba7c3a01e8fa6c969070], 

Dateien: 10
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\searchplugins\SafeFinder Search.xml, , [6cb079980379c86e4af72fe6de2536ca], 
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\searchplugins\SafeFinder Search.xml, , [93892ee3fe7ef3430d3439dc62a1bb45], 
PUP.Optional.HomeTab.A, c:\Windows\System32\Tasks\browser updater, , [100cff120676a690e233170a9e65eb15], 
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), ,[8f8da76a87f564d2a2a156f0a16416ea]
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), ,[35e74bc67c00c472d371e3639075e61a]
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[d448908189f38bab75d079cdbd48966a]
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), ,[d74550c13f3de4521e256fd70afba35d]
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), ,[05176aa76616f0461331af971ce950b0]
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[ed2f9081a7d526102c19db6ba36256aa]
PUP.Optional.SafeFinder.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[ba6231e0304cd85ee164c086c0454db3]

Physische Sektoren: 0
(No malicious items detected)


(end)
         

Dieses Ergebnis hat er eigentlich jedesmal, dieses CANDY, und dieses DEALKEEPER...
Muß ich mir hier Sorgen machen?
Viele Grüße und vielen Dank.

Das sind Adware-Überbleibsel und diese musst du mit MBAM auch mal entfernen!

Hallo Cosinus,
ja, täte ich gerne, aber:
Wenn ich das mit MBAM alles in Quarantäne verschiebe, verlangt er, den Rechner runterzufahren. Und nach dem Hochlaufen ist das alles wieder da, und ich kann es nochmal machen. Es verschwindet nicht nachhaltig...
Grüße
Romanos

Dann verrat mir mal warum dein MBAM Log nichts davon zeigt, dass die Funde entfernt werden
Ich glaub hier einfach, du bedienst MBAM falsch

.... hmja, wie soll ich das machen, ich frage ja Dich, ...
heute Abend habe ich MWB nochmal laufen lassen, folgendes Ergebnis:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 18.08.2014
Suchlauf-Zeit: 21:39:23
Logdatei: Malwarebytes Anti-Malware 2014 08 18.txt
Administrator: Nein

Version: 2.00.2.1012
Malware Datenbank: v2014.08.18.09
Rootkit Datenbank: v2014.08.16.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Rainer-User

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 350521
Verstrichene Zeit: 13 Min, 40 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 1
PUP.Optional.DealKeeper.A, HKLM\SOFTWARE\Deal Keeper, Löschen bei Neustart, [32df33959edd64d270b78364bc4645bb], 

Registrierungswerte: 1
PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1381094394899&tguid=66920-6787-1381094394899-AF07B6AD22DF51CE02B3D1B428BA0F24&q=%s, Löschen bei Neustart, [fa17e9df5526290d1bc8ac41956d9070]

Registrierungsdaten: 1
PUP.Optional.SafeFinder.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}),Löschen bei Neustart,[c34e3a8e0d6e74c2346412b826deb34d]

Ordner: 0
(No malicious items detected)

Dateien: 12
PUP.Optional.SmartBar, C:\Windows\Installer\16f349.msi, Löschen bei Neustart, [29e8c3050d6eb284b78fd8569769e020], 
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\searchplugins\SafeFinder Search.xml, Löschen bei Neustart, [6da4c008eb90d660ebc9e3fdbd45f60a], 
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\searchplugins\SafeFinder Search.xml, Löschen bei Neustart, [db36fbcd9fdcfe3872423fa12fd3f709], 
PUP.Optional.HomeTab.A, c:\Windows\System32\Tasks\browser updater, Löschen bei Neustart, [57ba7b4d700b270f1f7df4f825dd3fc1], 
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), Entfernung fehlgeschlagen,[2be606c28eedea4cb2db27de34d1b34d]
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), Entfernung fehlgeschlagen,[63aee9dfe29980b6018d52b380856799]
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), Entfernung fehlgeschlagen,[947d1dabd4a7082eccc38e77b055ab55]
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), Entfernung fehlgeschlagen,[5eb380486e0d2c0ad7b60afbde278f71]
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), Entfernung fehlgeschlagen,[ec258741463542f43c523fc6d92c0af6]
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), Entfernung fehlgeschlagen,[0b06d7f17506fb3b5f3048bd4eb7a65a]
PUP.Optional.SafeFinder.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), Entfernung fehlgeschlagen,[918014b48bf09a9c652a759029dc4bb5]
PUP.Optional.QuickStart.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");), Entfernung fehlgeschlagen,[c24f5276adcebc7aa9eaac5961a4629e]

Physische Sektoren: 0
(No malicious items detected)


(end)
         

In dem Fenster von MWB ist also diese Liste, und in der Spalte 'Aktion' steht für jede der gelisteten Zeilen: 'Quarantäne'. Nun kann ich meiner Meinung nach entweder rechts den Button 'Aktionen anwenden' drücken oder auch links 'Alles in Quarantäne stellen'.
Ich wählte bis jetzt immer den rechten Button 'Aktionen anwenden'.

Also, heute Abend wähle ich dann mal den linken Button und schicke Dir anschl. das Ergebnis, ok?
Ah, ok, im Verlaufsfenster kann ich auch noch die Quarantäne anschauen und dort alles löschen.
Das mache ich also auch noch...
Nun ist dort auch alles leer.
Bitte entschuldige, ich habe den Eindruck, daß meine fortlaufenden Fragen sehr nervend für Dich sind.
Viele Grüße
Romanos

Hallo Cosinus,
so, und dann den Rechner runter- und wieder hochgefahren, ...
MWB nochmal laufen lassen, Ergebnis:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 09.10.2014
Suchlauf-Zeit: 23:15:12
Logdatei: 
Administrator: Nein

Version: 2.00.2.1012
Malware Datenbank: v2014.10.09.11
Rootkit Datenbank: v2014.10.08.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Rainer-User

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 361154
Verstrichene Zeit: 14 Min, 13 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 2
PUP.Optional.DealKeeper.A, HKLM\SOFTWARE\Deal Keeper, , [4b6423eff983a59108148b96c63ddd23], 
PUP.Optional.BrowserGuard.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\kfepagcelbegkpkcjgfeecmlnmkedjin, , [19964ec4abd144f28b930f0321e221df], 

Registrierungswerte: 1
PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1381094394899&tguid=66920-6787-1381094394899-AF07B6AD22DF51CE02B3D1B428BA0F24&q=%s, , [2c8321f19ddf6bcb1caf31f6ab5817e9]

Registrierungsdaten: 1
PUP.Optional.SafeFinder.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q={searchTerms}),,[0ba4e230314b1422155e8c825fa619e7]

Ordner: 4
PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy, , [8c23e13198e4ea4c47790ed77e8413ed], 
PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\177586C2EEA542989844699BACEE36C5, , [8c23e13198e4ea4c47790ed77e8413ed], 
PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\8255D8B8BE3D4D2C91C3FF151064C5B9, , [8c23e13198e4ea4c47790ed77e8413ed], 
PUP.Optional.OpenCandy, C:\Users\Rainer\AppData\Roaming\OpenCandy\A34781A3E41146DFADBA6A7B704BF5CD, , [8c23e13198e4ea4c47790ed77e8413ed], 

Dateien: 10
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\searchplugins\SafeFinder Search.xml, , [8926cc461369ec4a02b58199f90a06fa], 
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\searchplugins\SafeFinder Search.xml, , [6b44db37304c6dc92394e43645bec23e], 
PUP.Optional.HomeTab.A, c:\Windows\System32\Tasks\browser updater, , [119e040e49331521f492180e2cd7f10f], 
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), ,[a8078e849ddf7fb7a3d30943fb0a17e9]
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), ,[96193cd61e5e2f07671036161de814ec]
PUP.Optional.SafeFinder.A, C:\Users\Conny\AppData\Roaming\Mozilla\Firefox\Profiles\x34256cx.default-1399701211823\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[8c2364aeadcf10267008113bbc49758b]
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhEp2_hNugXObfirxBr1d1ge_nnAo8Ty_j-HcUT5JZxni7GS4_nN1zieGv6JVnk7VIeMgR0q-P9z7IVfnnt0Og,,");), ,[2f806da51b6174c2fc7a212b9c6907f9]
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLhcoVNGd0ftxUi4j2AO7hJN0DRWRoBFUjrMFw8_5xjaFphdr5FJozVxiSsrQeLB0bIa91kp5kNR7umA_W843vg,,");), ,[c1ee35dd9be1a393adcaf95314f1fe02]
PUP.Optional.SafeFinder.A, C:\Users\Marie-Sophie\AppData\Roaming\Mozilla\Firefox\Profiles\ax6adzos.default-1384291140671\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[dcd3b85a74083ff77bfd1438a95c817f]
PUP.Optional.SafeFinder.A, C:\Users\Rainer\AppData\Roaming\Mozilla\Firefox\Profiles\yztin5xb.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5HmPjeCV0pmwGMicem0sDkT3n6j6GlftxrCkuyklvKSWb5FcKUYupm-ZugD6xHMCLh1ErzCH6bsspH0TER-eLoz95qulOLHQhlmFnlqRsQDAFB43kHYrJaFSm5_FOEmeo7pYh-ktp4WSsF8CxMJUbQ,,&q=");), ,[d5dac64ca9d3a78fea8e222a2cd98f71]

Physische Sektoren: 0
(No malicious items detected)


(end)
         

Also gleich wie vorher, ... was mache ich falsch?
Viele Grüße
Romanos

adwCleaner und JRT neu runterladen auf den Desktop. Nacheinander erneut ausführen.