|
Google-Search umgeleitet auf protectedsearch.com
Hi,
vielleicht könnte Ihr mir weiterhelfen, habe folgendes Problem mit dem Firefox 10.0.2. Seit heute leitet mich die Google.de - Suche auf die Seite "protectedsearch.com" um? Verstehe die Welt nicht mehr, habe nun manuell eingegriffen und auf google.de die Suche wieder umgestellt. Nach einem Neustart erscheint aber wieder die Seite "protectedsearch.com". Könnte es sich hier um einen Trojaner oder Virus handeln?, auf dem Rechner wurde seit 3 Wochen nichts mehr installiert, könnte wenn lediglich mit den e-Mails eingefolgen sein. Wenn ja wie werde ich den wieder los. Danke für eure Hilfe. Gruß blackmoon00 |
hab dasselbe problem, bei mir will er immer auf eine seite namens "www.abnow.com"
|
Lasst Malwarebytes im aktuellen Stand drüber laufen.
Weiter postet im Spoiler ein Log von hijackthis. mfg |
"protectedsearch" ist einer der etwas hartnäckigeren "Umleitungs"-Trojaner aber durch ein einfaches Prozedere zu entfernen.
Wenn ich mich nicht irre, wirst du einen fragwürdigen Eintrag in "C:\Windows\System32\mctadmin.exe" haben. "mctadmin.exe" ist bekannt in solchen Sachen. Aber wie mein Vorredner schon sagte AUFJEDENFALL Hijackthis Logfile erstellen und davor Malwarebytes durchlaufen lassen Zusätzlich kannst du dir noch OTL ziehen und die Logfile hier posten falls das Problem weiterhin besteht |
Hi,
Malewarebyte als auch alle anderen gängigen Maleware Tools haben nichts gebracht. Werde nun mal die Logfiles auswerten. Vielen Dank für Eure Rückmeldung. Gruß Blackmoon00:T |
Dann wie DerRambo schon sagt, mach mit OTL ein Scan und poste hier die Logfiles:
Die Einstellung biite aus dieser Anleitung übernehmen: [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] Mfg |
Hi,
so jetzt habe ich noch herausgefunden, dass der Firefox nicht abspringt wenn man google.de als Seite hat, sondern lediglich bei der orginal Startseite des Firefox. Die zwei Logdateien findet ihr hier: OTL-txt Datei OTL logfile created on: 09.03.2012 13:52:15 - Run 1
OTL by OldTimer - Version 3.2.36.2 Folder = C:\Users\*******\Downloads 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 15,99 Gb Total Physical Memory | 12,49 Gb Available Physical Memory | 78,08% Memory free 31,98 Gb Paging File | 27,92 Gb Available in Paging File | 87,30% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,76 Gb Total Space | 312,24 Gb Free Space | 67,04% Space Free | Partition Type: NTFS Drive D: | 931,50 Gb Total Space | 480,18 Gb Free Space | 51,55% Space Free | Partition Type: NTFS Drive U: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS Drive V: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS Drive W: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS Drive X: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS Drive Y: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS Drive Z: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS Computer Name: ******* | User Name: ******* | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - File not found PRC - C:\Users\*******\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.) PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.) PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) PRC - C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe (SPAMfighter ApS) PRC - C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe (SPAMfighter ApS) PRC - C:\Program Files (x86)\Fighters\Tray\FightersTray.exe (SPAMfighter ApS) PRC - C:\Program Files (x86)\PRTG Network Monitor\PRTG Server.exe (Paessler AG) PRC - C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe (Paessler AG) PRC - C:\Program Files (x86)\Fighters\FighterSuiteService.exe (SPAMfighter ApS) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (Adobe Systems Inc.) PRC - C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe () PRC - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G Data Software AG) PRC - C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG) PRC - C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G Data Software AG) PRC - C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe (ACD Systems) PRC - C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.) PRC - C:\Windows\SysWOW64\cjpcsc.exe (REINER SCT) PRC - C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe (Gladinet, INC) PRC - C:\Program Files (x86)\G DATA\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG) PRC - C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKService.exe (G Data Software AG) PRC - C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe () PRC - C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (DATA BECKER GmbH & Co KG) PRC - C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe () PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) PRC - C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) PRC - C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe () PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) PRC - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlServi ce.exe () ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files (x86)\Fighters\SPAMfighter\sfse.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9 \System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\Syste m.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll () MOD - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\AcroTray.DEU () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\msc orlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni .dll () MOD - C:\Program Files (x86)\Fighters\SPAMfighter\sfsg.dll () MOD - C:\Windows\assembly\GAC_MSIL\WinClientShellExtensi onContextMenu\1.0.0.27__9fb6a8250b54c137\WinClient ShellExtensionContextMenu.dll () MOD - C:\Windows\assembly\GAC_MSIL\ClientExecuteUtils\1. 0.0.5__0364d91cd0218e60\ClientExecuteUtils.dll () MOD - C:\Windows\SysWOW64\AsIO.dll () MOD - C:\Program Files (x86)\ASUS\EPU-6 Engine\pngio.dll () MOD - C:\Program Files (x86)\ASUS\EPU-6 Engine\AsSpindownTimeout.dll () MOD - C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe () MOD - C:\Program Files (x86)\ASUS\EPU-6 Engine\AsusService.dll () ========== Win32 Services (SafeList) ========== SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software) SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (WDRulesService) -- C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe (Western Digital ) SRV:64bit: - (WDFMEService) -- C:\Program Files\Western Digital\WD SmartWare\WDFME.exe (Western Digital ) SRV:64bit: - (WDDMService) -- C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe (WDC) SRV:64bit: - (OODefragAgent) -- C:\Program Files\OO Software\Defrag\oodag.exe (O&O Software GmbH) SRV:64bit: - (FLEXnet Licensing Service 64) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Macrovision Europe Ltd.) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV:64bit: - (hasplms) -- C:\Windows\SysNative\hasplms.exe (Aladdin Knowledge Systems Ltd.) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (SDWSCService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.) SRV - (SDUpdateService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.) SRV - (SDScannerService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) SRV - (SPAMfighter Update Service) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe (SPAMfighter ApS) SRV - (PRTGCoreService) -- C:\Program Files (x86)\PRTG Network Monitor\PRTG Server.exe (Paessler AG) SRV - (PRTGProbeService) -- C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe (Paessler AG) SRV - (Suite Service) -- C:\Program Files (x86)\Fighters\FighterSuiteService.exe (SPAMfighter ApS) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (BotkindSyncService) -- C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe () SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software) SRV - (AVKProxy) -- C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G Data Software AG) SRV - (GDScan) -- C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G Data Software AG) SRV - (AVKWCtl) -- C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKWCtlX64.exe (G Data Software AG) SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (afcdpsrv) -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis) SRV - (PDFProFiltSrvPP) -- C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.) SRV - (GDFwSvc) -- C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFwSvcx64.exe (G Data Software AG) SRV - (cjpcsc) -- C:\Windows\SysWOW64\cjpcsc.exe (REINER SCT) SRV - (GladFileMonSvc) -- C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe (Gladinet, INC) SRV - (AVKService) -- C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKService.exe (G Data Software AG) SRV - (UsbClientService) -- C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe () SRV - (AcrSch2Svc) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (Acronis) SRV - (DBService) -- C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (DATA BECKER GmbH & Co KG) SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Program Files (x86)\WinPcap\rpcapd.exe (CACE Technologies, Inc.) SRV - (OS Selector) -- C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe () SRV - (NAUpdate) @C:\Program Files (x86) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msco rsvw.exe (Microsoft Corporation) SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG) SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\msco rsvw.exe (Microsoft Corporation) SRV - (IAANTMON) Intel(R) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) SRV - (AsSysCtrlService) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlServi ce.exe () SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®) SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation) SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (WPRO_41_2001) WinPcap Packet Driver (WPRO_41_2001) -- C:\Windows\SysNative\drivers\WPRO_41_2001.sys () DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (HookCentre) -- C:\Windows\SysNative\drivers\HookCentre.sys (G Data Software AG) DRV:64bit: - (GDMnIcpt) -- C:\Windows\SysNative\drivers\MiniIcpt.sys (G Data Software AG) DRV:64bit: - (GDBehave) -- C:\Windows\SysNative\drivers\GDBehave.sys (G Data Software AG) DRV:64bit: - (gdwfpcd) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys (G Data Software AG) DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices) DRV:64bit: - (GDPkIcpt) -- C:\Windows\SysNative\drivers\PktIcpt.sys (G Data Software AG) DRV:64bit: - (afcdp) -- C:\Windows\SysNative\drivers\afcdp.sys (Acronis) DRV:64bit: - (tdrpman273) Acronis Try&Decide and Restore Points filter (build 273) -- C:\Windows\SysNative\drivers\tdrpm273.sys (Acronis) DRV:64bit: - (timounter) -- C:\Windows\SysNative\drivers\timntr.sys (Acronis) DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.s ys (Nokia) DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sy s (Nokia) DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia) DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia) DRV:64bit: - (GRD) -- C:\Windows\SysNative\drivers\GRD.sys (G Data Software) DRV:64bit: - (RsFx0151) -- C:\Windows\SysNative\drivers\RsFx0151.sys (Microsoft Corporation) DRV:64bit: - (GdNetMon) -- C:\Windows\SysNative\drivers\GdNetMon64.sys (G Data Software AG) DRV:64bit: - (cjusb) -- C:\Windows\SysNative\drivers\cjusb.sys (REINER SCT) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (busenum) -- C:\Windows\SysNative\drivers\busenum.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (WDC_SAM) -- C:\Windows\SysNative\drivers\wdcsam64.sys (Western Digital Technologies) DRV:64bit: - (snapman) -- C:\Windows\SysNative\drivers\snapman.sys (Acronis) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation) DRV:64bit: - (NPF) WinPcap Packet Driver (NPF) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.) DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project) DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH) DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.) DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys () DRV:64bit: - (WmXlCore) -- C:\Windows\SysNative\drivers\WmXlCore.sys (Logitech Inc.) DRV:64bit: - (WmVirHid) -- C:\Windows\SysNative\drivers\WmVirHid.sys (Logitech Inc.) DRV:64bit: - (WmHidLo) -- C:\Windows\SysNative\drivers\WmHidLo.sys (Logitech Inc.) DRV:64bit: - (WmFilter) -- C:\Windows\SysNative\drivers\WmFilter.sys (Logitech Inc.) DRV:64bit: - (WmBEnum) -- C:\Windows\SysNative\drivers\WmBEnum.sys (Logitech Inc.) DRV:64bit: - (aksdf) -- C:\Windows\SysNative\drivers\aksdf.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG) DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys () DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (LUsbFilt) -- C:\Windows\SysNative\drivers\LUsbFilt.sys (Logitech, Inc.) DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.) DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (Hardlock) -- C:\Windows\SysNative\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (akshasp) -- C:\Windows\SysNative\drivers\akshasp.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (aksusb) -- C:\Windows\SysNative\drivers\aksusb.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (GigasetGenericUSB_x64) -- C:\Windows\SysNative\drivers\GigasetGenericUSB_x64 .sys (Siemens Home and Office Communication Devices GmbH & Co. KG) DRV:64bit: - (mv64xx) -- C:\Windows\SysNative\drivers\mv64xx.sys (Marvell Semiconductor, Inc.) DRV:64bit: - (aksfridge) -- C:\Windows\SysNative\drivers\aksfridge.sys (Aladdin Knowledge Systems Ltd.) DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia) DRV:64bit: - (GearAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (netr28ux) -- C:\Windows\SysNative\drivers\netr28ux.sys (Ralink Technology Corp.) DRV:64bit: - (teamviewervpn) -- C:\Windows\SysNative\drivers\teamviewervpn.sys (TeamViewer GmbH) DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation) DRV:64bit: - (akshhl) -- C:\Windows\SysNative\drivers\akshhl.sys (Aladdin Knowledge Systems Ltd.) DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - No CLSID value found IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&cti d=CT1700389 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BD BB 36 56 C0 58 CA 01 [binary data] IE - HKCU\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - No CLSID value found IE - HKCU\..\URLSearchHook: {B9E567E4-BF93-4E31-838A-E7D7D01815BF} - C:\Program Files (x86)\SystemSecurityGuardToolbar\IEToolbar.dll () IE - HKCU\..\SearchScopes,DefaultScope = {C628FABF-B4A4-418B-8E41-909D20B6F5C2} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{783280EA-588C-4A2E-927E-7638EB57B7E5}: "URL" = http://search.igeared.com/dispatcher.aspx?i=67&tp=chrome&q={searchTerms} IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={7F1C0A1D-2F44-4B45-B167-8FDA153C56D2}&mid=f509b6e61f8047d18715d1529aeb3fe4-bae92fc3d437010efff81638800a258becda9d37&lang=de&d s=tt014&pr=sa&d=2011-12-18 15:07:37&v=8.0.0.34&sap=dsp&q={searchTerms} IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&cti d=CT1700389 IE - HKCU\..\SearchScopes\{C628FABF-B4A4-418B-8E41-909D20B6F5C2}: "URL" = http://www.google.de/search?q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Protected Search" FF - prefs.js..browser.search.defaultthis.engineName: "Phoca Customized Web Search" FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2149937&SearchSource=3&q={s earchTerms}" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...]:1.12.2.44026 FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8 FF - prefs.js..extensions.enabledItems: [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...]:1.6.2 FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:20.1.0.4 FF - prefs.js..extensions.enabledItems: [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...]:1.0.0.732 FF - prefs.js..extensions.enabledItems: {72CA2996-F580-47DF-98FF-0B853D09CEC8}:4.0.116 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.8.4 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...]otcom:1.0 FF - prefs.js..extensions.enabledItems: [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...]:3.0.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..keyword.URL: "http://search.igeared.com/dispatcher.aspx?i=67&tp=ab&q=" FF - prefs.js..network.proxy.http: "192.168.0.1" FF - prefs.js..network.proxy.type: 1 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_10 2.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@reiner-sct.com/OWOK,version=2.0.0.4: C:\Program Files (x86)\REINER SCT\OWOK\NPAPI-20\nprsct_owok_npapi-2004.dll (REINER Kartengeräte GmbH und Co. KG.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\nppdf.dll (Zeon Corporation) FF - HKCU\Software\MozillaPlugins\@kaspersky.com/Password Manager: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager\npkpmAutofill.dll (Kaspersky Lab) FF - HKCU\Software\MozillaPlugins\@protectdisc.com/NPPDLicenseHelper: C:\Users\*******\AppData\Roaming\ProtectDisc\Licen se Helper v2\NPPDLicenseHelper.dll ( ) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\[email protected]: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012.01.15 21:35:04 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\[email protected]: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_7.0 [2011.11.27 18:03:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\{4F3D26C8-9907-48ff-BC74-B8C572D317BF}: C:\Program Files (x86)\AusweisApp\mozilla\eCardClientExt_FFxx_Win [2012.01.31 06:47:53 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\{4F0963A3-1658-4fde-9585-23A25CC288BF}: C:\Program Files (x86)\AusweisApp\mozilla\eCardClientPIn_FFxx_Win [2012.01.31 06:47:53 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.03 10:34:32 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.15 21:35:10 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Ex tensions\\[email protected]: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_7.0 [2011.11.27 18:03:54 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensi ons\\{72CA2996-F580-47DF-98FF-0B853D09CEC8}: C:\Users\*******\AppData\Roaming\Kaspersky Lab\Kaspersky Password Manager\kpmAutofill [2012.01.08 14:19:23 | 000,000,000 | ---D | M] [2009.10.29 19:11:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*******\AppData\Roaming\mozilla\Extension s [2012.03.09 07:40:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions [2009.10.31 19:18:58 | 000,000,000 | ---D | M] (IE Tab) -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9} [2011.01.17 22:26:45 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12} [2012.01.07 18:34:28 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions\[email protected] om [2009.10.31 18:43:25 | 000,000,000 | ---D | M] (Ovi maps browser plugin) -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions\[email protected] [2012.02.11 18:35:12 | 000,000,000 | ---D | M] (Cooliris) -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions\piclens@coolir is.com [2009.10.29 21:45:54 | 000,002,833 | ---- | M] () -- C:\Users\*******\AppData\Roaming\Mozilla\Firefox\P rofiles\g2hovcik.default\searchplugins\rapidshare-files-search.xml [2012.03.03 10:34:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2012.01.08 08:23:50 | 000,000,000 | ---D | M] (G Data BankGuard) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad} [2011.05.14 10:09:45 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE} [2012.01.15 21:35:04 | 000,000,000 | ---D | M] (Adobe Acrobat - Create PDF) -- C:\PROGRAM FILES (X86)\ADOBE\ACROBAT 10.0\ACROBAT\BROWSER\WCFIREFOXEXTN [2012.01.31 06:47:53 | 000,000,000 | ---D | M] (AusweisApp) -- C:\PROGRAM FILES (X86)\AUSWEISAPP\MOZILLA\ECARDCLIENTPIN_FFXX_WIN () (No name found) -- C:\USERS\*******\APPDATA\ROAMING\MOZILLA\FIREFOX\P ROFILES\G2HOVCIK.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34}.XPI () (No name found) -- C:\USERS\*******\APPDATA\ROAMING\MOZILLA\FIREFOX\P ROFILES\G2HOVCIK.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\*******\APPDATA\ROAMING\MOZILLA\FIREFOX\P ROFILES\G2HOVCIK.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI () (No name found) -- C:\USERS\*******\APPDATA\ROAMING\MOZILLA\FIREFOX\P ROFILES\G2HOVCIK.DEFAULT\EXTENSIONS\FIREBUG@SOFTWA RE.JOEHEWITT.COM.XPI () (No name found) -- C:\USERS\*******\APPDATA\ROAMING\MOZILLA\FIREFOX\P ROFILES\G2HOVCIK.DEFAULT\EXTENSIONS\GUTEGUTSCHEINE @GUTEGUTSCHEINE.COM.XPI [2012.03.03 10:34:32 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.02.20 18:45:56 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2012.03.03 10:34:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.03.03 10:34:29 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.03.03 10:34:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.03.03 10:34:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.01 18:17:39 | 000,001,467 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\ssg_igeared.xml [2012.03.03 10:34:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.03.03 10:34:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.11.13 11:40:21 | 000,000,906 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 acdid.acdsystems.com O1 - Hosts: 192.168.0.13 roihost O2:64bit: - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 10\DLLx64\SnagitBHO64.dll (TechSmith Corporation) O2:64bit: - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G DATA\InternetSecurity\WebFilter\AvkWebIEx64.dll (G Data Software AG) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitBHO.dll (TechSmith Corporation) O2 - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G DATA\InternetSecurity\WebFilter\AvkWebIE.dll (G Data Software AG) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.) O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (SystemSecurityGuardToolbar BHO) - {B9E567E4-BF93-4E31-838A-E7D7D01815BF} - C:\Program Files (x86)\SystemSecurityGuardToolbar\IEToolbar.dll () O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG) O2 - BHO: (AusweisApp 1.7.0.0) - {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} - C:\Program Files (x86)\AusweisApp\siqeCardClient.ols (OpenLimit SignCubes AG) O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3:64bit: - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G DATA\InternetSecurity\WebFilter\AvkWebIEx64.dll (G Data Software AG) O3:64bit: - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 10\DLLx64\SnagitIEAddin64.dll (TechSmith Corporation) O3 - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G DATA\InternetSecurity\WebFilter\AvkWebIE.dll (G Data Software AG) O3 - HKLM\..\Toolbar: (System Security Guard Toolbar) - {2793FB58-DCE3-4A83-97DE-7208CAD0341C} - C:\Program Files (x86)\SystemSecurityGuardToolbar\IEToolbar.dll () O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitIEAddin.dll (TechSmith Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ACPW05DE] C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe (ACD Systems) O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [CommonToolkitTray] C:\Program Files (x86)\Fighters\Tray\FightersTray.exe (SPAMfighter ApS) O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files (x86)\G DATA\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG) O4 - HKLM..\Run: [GDFirewallTray] C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) O4 - HKLM..\Run: [sfagent] C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe (SPAMfighter ApS) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [AusweisApp] C:\Program Files (x86)\AusweisApp\siqBootLoader.exe (OpenLimit SignCubes AG) O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus DirectShow Filters\DivXDecH264.ax] "C:\Windows\system32\rundll32.exe" "C:\Program Files (x86)\DivX\DivX Plus DirectShow Filters\DivXDecH264.ax",DllRegisterServer File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: HideFastUserSwitching = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: EnableLinkedConnections = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\ToolbarsRestrictions present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveAutorun = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: address pick-up: Übernehmen in combit address manager (crm.dbf) - C:\Users\*******\AppData\Local\combit\address pick-up\cmbtar1.htm File not found O8:64bit: - Extra context menu item: An OneNote s&enden - res:///105 File not found O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: address pick-up: Übernehmen in combit address manager (crm.dbf) - C:\Users\*******\AppData\Local\combit\address pick-up\cmbtar1.htm File not found O8 - Extra context menu item: An OneNote s&enden - res:///105 File not found O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - CC:\Program Files (x86)\VMware\VMware Player\x64\vsocklib.dll File not found O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000013 - CC:\Program Files (x86)\VMware\VMware Player\x64\vsocklib.dll File not found O1364bit: - gopher Prefix: missing O15 - HKCU\..Trusted Domains: interfax.net ([secure] https in Trusted sites) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] (Java Plug-in 1.6.0_27) O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] (Java Plug-in 1.6.0_27) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] (Java Plug-in 1.6.0_27) O16 - DPF: {162247AF-26A7-44FC-A93A-69506EA244F3} [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] (HWTest.HWTestControl) O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] (DLM Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfac es\{7906D2AF-4403-4E8F-816F-4E1AC61A4C49}: NameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\hddlife - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\systemsecurityguardtoolbar - No CLSID value found O18 - Protocol\Handler\hddlife {BD758015-47D9-477A-8873-4B688A2BC0E2} - C:\Program Files (x86)\Common Files\BinarySense\hlAPP.dll (BinarySense, Inc.) O18 - Protocol\Handler\systemsecurityguardtoolbar {89EECF8F-484D-4786-909C-83E5285003ED} - C:\Program Files (x86)\SystemSecurityGuardToolbar\IEToolbar.dll () O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.e xe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (c:\windows\syswow64\userinit.exe) - c:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{4dcc5531-6cf9-11e0-9748-001bdc0fd617}\Shell - "" = AutoRun O33 - MountPoints2\{4dcc5531-6cf9-11e0-9748-001bdc0fd617}\Shell\AutoRun\command - "" = M:\unlock.exe autoplay=true O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (OODBS) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.03.09 07:39:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro [2012.03.09 07:39:59 | 000,000,000 | ---D | C] -- C:\Users\*******\AppData\Roaming\Microsoft\Windows \Start Menu\Programs\HiJackThis [2012.03.07 11:17:55 | 000,000,000 | ---D | C] -- C:\Users\*******\Documents\CloudStation [2012.03.06 21:45:38 | 000,000,000 | ---D | C] -- C:\Users\*******\Documents\Snagit [2012.03.05 09:07:27 | 000,000,000 | ---D | C] -- C:\usr [2012.03.04 22:39:10 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT [2012.03.04 09:03:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2012.03.04 09:03:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 [2012.03.04 09:03:09 | 000,017,272 | ---- | C] (Safer Networking Limited) -- C:\Windows\SysNative\sdnclean64.exe [2012.03.04 09:03:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy 2 [2012.02.24 19:23:44 | 000,000,000 | ---D | C] -- C:\Users\*******\Documents\Personalausweis [2012.02.21 10:57:02 | 004,771,184 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxXtreme100.dll [2012.02.21 10:56:58 | 000,104,304 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxUISettingsN100.dll [2012.02.21 10:56:56 | 000,025,968 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxTPSW100.dll [2012.02.21 10:56:54 | 001,334,640 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxTool100.dll [2012.02.21 10:56:50 | 000,063,344 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxPXTree100.dll [2012.02.21 10:56:44 | 000,127,344 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxMail100.dll [2012.02.21 10:56:20 | 000,193,904 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxBasics100.dll [2012.02.19 11:48:59 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll [2012.02.19 11:48:59 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll [2012.02.19 11:48:59 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll [2012.02.19 11:48:59 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll [2012.02.19 11:48:59 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll [2012.02.19 11:48:59 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll [2012.02.19 11:48:58 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll [2012.02.19 11:48:58 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll [2012.02.19 11:48:57 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll [2012.02.19 11:48:57 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll [2012.02.19 11:48:56 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll [2012.02.19 11:48:56 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll [2012.02.19 11:48:56 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll [2012.02.19 11:48:56 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll [2012.02.19 11:48:55 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll [2012.02.19 11:48:55 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll [2012.02.19 11:48:53 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll [2012.02.19 11:48:53 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll [2012.02.19 11:48:53 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll [2012.02.19 11:48:53 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll [2012.02.19 11:48:53 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll [2012.02.19 11:48:53 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll [2012.02.19 11:48:52 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll [2012.02.19 11:48:52 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll [2012.02.18 18:28:19 | 000,000,000 | ---D | C] -- C:\Users\*******\Documents\Stiftung Warentest [2012.02.15 22:51:27 | 000,000,000 | ---D | C] -- C:\Users\*******\Documents\Zertifikaterstellung [2012.02.15 19:57:08 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.02.15 19:57:08 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.02.15 19:57:06 | 002,308,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\js*****9.dll [2012.02.15 19:57:06 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.02.15 19:57:06 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.02.15 19:57:06 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.02.15 19:57:05 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\js*****.dll [2012.02.15 19:57:05 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\js*****.dll [2012.02.15 19:57:05 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.02.15 19:57:04 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.02.15 19:57:03 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.02.15 19:55:56 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll [2012.02.15 19:55:55 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl [2012.02.15 19:55:55 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl [2012.02.15 19:55:33 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll [2012.02.11 18:44:56 | 000,000,000 | ---D | C] -- C:\Users\*******\AppData\Roaming\Malwarebytes [2012.02.11 18:44:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.02.11 18:44:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.02.11 18:44:50 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.02.11 18:44:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.02.11 18:15:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fighters [2010.05.26 20:04:22 | 001,531,392 | ---- | C] (Toshiba Samsung Storage Technology Corporation) -- C:\Users\*******\AppData\Roaming\tsdnwin.dll [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Users\*******\AppData\Roaming\*.tmp files -> C:\Users\*******\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.03.09 14:02:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.03.09 11:02:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.03.09 07:51:13 | 000,989,563 | ---- | M] () -- C:\Users\*******\AppData\Local\census.cache [2012.03.09 07:50:52 | 000,157,636 | ---- | M] () -- C:\Users\*******\AppData\Local\ars.cache [2012.03.09 07:39:59 | 000,002,975 | ---- | M] () -- C:\Users\*******\Desktop\HiJackThis.lnk [2012.03.09 07:38:39 | 000,000,036 | ---- | M] () -- C:\Users\*******\AppData\Local\housecall.guid.cach e [2012.03.09 07:34:46 | 000,017,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.03.09 07:34:46 | 000,017,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.03.09 07:32:27 | 000,574,391 | ---- | M] () -- C:\Windows\SysWow64\sig.bin [2012.03.09 07:32:27 | 000,037,682 | ---- | M] () -- C:\Windows\SysWow64\nmp.map [2012.03.09 07:27:37 | 000,035,344 | ---- | M] () -- C:\Windows\SysNative\drivers\WPRO_41_2001.sys [2012.03.09 07:24:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.03.09 07:24:24 | 4287,975,422 | -HS- | M] () -- C:\hiberfil.sys [2012.03.09 07:24:22 | 000,991,545 | ---- | M] () -- C:\Windows\SysNative\oodbs.lor [2012.03.04 09:03:15 | 000,002,148 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk [2012.03.03 20:45:26 | 000,002,763 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Quicken Jubiläumsversion Zahlungserinnerung.lnk [2012.03.03 20:45:26 | 000,002,759 | ---- | M] () -- C:\Users\Public\Desktop\Quicken DELUXE Jubiläumsversion.lnk [2012.02.27 20:30:21 | 001,957,312 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.02.27 20:30:21 | 000,823,920 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.02.27 20:30:21 | 000,768,370 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.02.27 20:30:21 | 000,198,062 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.02.27 20:30:21 | 000,164,846 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.02.21 10:57:02 | 004,771,184 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxXtreme100.dll [2012.02.21 10:56:58 | 000,104,304 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxUISettingsN100.dll [2012.02.21 10:56:56 | 000,025,968 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxTPSW100.dll [2012.02.21 10:56:54 | 001,334,640 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxTool100.dll [2012.02.21 10:56:50 | 000,063,344 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxPXTree100.dll [2012.02.21 10:56:44 | 000,127,344 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxMail100.dll [2012.02.21 10:56:20 | 000,193,904 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxBasics100.dll [2012.02.20 18:45:55 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll [2012.02.20 18:45:55 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe [2012.02.20 18:45:55 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe [2012.02.20 18:45:55 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe [2012.02.20 16:38:05 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.02.19 11:04:05 | 000,000,221 | ---- | M] () -- C:\Users\*******\Desktop\Call of Duty Modern Warfare 3.url [2012.02.19 11:04:05 | 000,000,221 | ---- | M] () -- C:\Users\*******\Desktop\Call of Duty Modern Warfare 3 - Multiplayer.url [2012.02.19 10:13:10 | 000,001,093 | ---- | M] () -- C:\Users\*******\Desktop\Allway Sync.lnk [2012.02.19 09:56:37 | 001,934,270 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.02.15 23:21:37 | 005,062,344 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.02.15 23:08:07 | 000,015,294 | ---- | M] () -- C:\Users\*******\Documents\TC TrustCenter - Antrag Internet ID Zertifikat.pdf [2012.02.11 18:44:52 | 000,001,084 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Users\*******\AppData\Roaming\*.tmp files -> C:\Users\*******\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.03.09 07:51:13 | 000,989,563 | ---- | C] () -- C:\Users\*******\AppData\Local\census.cache [2012.03.09 07:50:52 | 000,157,636 | ---- | C] () -- C:\Users\*******\AppData\Local\ars.cache [2012.03.09 07:39:59 | 000,002,975 | ---- | C] () -- C:\Users\*******\Desktop\HiJackThis.lnk [2012.03.09 07:38:39 | 000,000,036 | ---- | C] () -- C:\Users\*******\AppData\Local\housecall.guid.cach e [2012.03.09 07:27:37 | 000,035,344 | ---- | C] () -- C:\Windows\SysNative\drivers\WPRO_41_2001.sys [2012.03.04 09:03:15 | 000,002,160 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk [2012.03.04 09:03:15 | 000,002,148 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk [2012.02.19 11:04:05 | 000,000,221 | ---- | C] () -- C:\Users\*******\Desktop\Call of Duty Modern Warfare 3.url [2012.02.19 10:53:57 | 000,000,221 | ---- | C] () -- C:\Users\*******\Desktop\Call of Duty Modern Warfare 3 - Multiplayer.url [2012.02.15 23:08:07 | 000,015,294 | ---- | C] () -- C:\Users\*******\Documents\TC TrustCenter - Antrag Internet ID Zertifikat.pdf [2012.02.11 18:44:52 | 000,001,084 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2012.01.08 14:47:50 | 000,000,018 | ---- | C] () -- C:\Users\*******\AppData\Roaming\sys386ll.dat [2012.01.08 14:47:24 | 000,000,010 | ---- | C] () -- C:\Users\*******\AppData\Roaming\hhxprot5 [2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll [2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll [2011.11.15 19:17:21 | 000,000,396 | ---- | C] () -- C:\Windows\hbcikrnl.ini [2011.11.15 19:17:07 | 000,167,936 | ---- | C] () -- C:\Windows\SysWow64\SerialXP.dll [2011.11.15 19:17:07 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\win32com.dll [2011.11.10 03:36:06 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2011.11.10 03:36:06 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll [2011.09.27 11:16:20 | 000,304,128 | ---- | C] () -- C:\Windows\SysWow64\LxDNT100.dll [2011.09.27 11:14:14 | 000,133,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvmc100.dll [2011.09.27 11:13:58 | 000,069,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvm100.dll [2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.08.13 12:13:10 | 000,034,481 | ---- | C] () -- C:\Windows\MAXLINK.INI [2011.05.14 19:02:21 | 000,574,391 | ---- | C] () -- C:\Windows\SysWow64\sig.bin [2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2010.11.07 15:22:14 | 000,010,593 | ---- | C] () -- C:\Windows\CSTBox.INI [2010.11.07 15:09:25 | 000,007,103 | ---- | C] () -- C:\Windows\mgxoschk.ini [2010.11.07 12:10:41 | 000,000,088 | RHS- | C] () -- C:\ProgramData\797B5B5DFC.sys [2010.11.07 12:10:40 | 000,005,642 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys [2010.10.21 14:18:46 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\dnt27VC8.dll [2010.10.21 14:16:58 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\dntvmc27VC8.dll [2010.10.21 14:16:34 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\dntvm27VC8.dll [2010.10.15 19:54:40 | 000,000,115 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32. bc [2010.09.04 15:26:17 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2010.06.25 18:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll [2010.05.25 18:22:54 | 000,000,031 | ---- | C] () -- C:\Windows\DeskCalc.INI [2010.05.02 14:42:04 | 000,002,266 | ---- | C] () -- C:\Windows\aopr.ini [2010.04.28 19:39:14 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\GkSui20.EXE [2010.03.28 11:47:37 | 000,038,422 | ---- | C] () -- C:\Users\*******\AppData\Roaming\Microsoft Excel 97-2003.ADR [2010.03.18 22:08:07 | 000,000,000 | ---- | C] () -- C:\Windows\wiso.ini ========== LOP Check ========== [2012.03.03 19:37:00 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\.oit [2011.06.23 14:38:58 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\04F6CE9A-BC39-4293-86D6-321922972FA6 [2010.08.28 07:51:08 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\4BF2960A-BC93-41E6-8F65-C86A5668BBEC [2010.08.28 23:07:22 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\5C473C24-DD49-4B32-B115-534D28C4EDF0 [2010.09.22 20:56:48 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\5EE74A0C-5611-4078-9B7F-493466B5C1C7 [2009.10.30 20:34:59 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\ACD Systems [2009.11.30 21:43:15 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Acronis [2011.01.23 13:33:16 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\AD704CE7-76D0-4582-8C2B-92666CB58FB1 [2010.04.28 20:59:49 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\agorum core [2012.01.22 13:19:49 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Artisteer [2011.08.27 09:24:11 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\B3345BE1-B621-421A-865A-4A77D3080FAE [2010.03.06 08:02:33 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\BinarySense [2009.10.29 21:32:55 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Blitware [2010.12.31 12:29:52 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Canon [2011.09.18 09:24:02 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\chc.4875E02D9FB21 EE389F73B8D1702B320485DF8CE.1 [2011.09.17 14:40:36 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\com.adobe.downloa dassistant.AdobeDownloadAssistant [2010.08.26 09:25:40 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Common Toolkit Suite [2009.11.28 23:18:22 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\DassaultSystemes [2009.10.29 20:37:14 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\DataDesign [2010.01.19 12:45:41 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Downloaded Installations [2010.05.30 19:51:37 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\EurekaLog [2012.02.11 18:15:25 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Fighters [2011.05.14 16:34:48 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\FileZilla [2010.08.12 22:11:37 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\gnupg [2011.09.18 09:26:35 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\gtk-2.0 [2010.09.09 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\IrfanView [2010.11.28 10:18:02 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Jumping Bytes [2010.11.28 11:23:28 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Kalypso Media [2010.09.25 15:28:48 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Laplink [2009.10.29 20:48:00 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Leadertech [2012.01.08 17:58:39 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Lexware [2010.11.07 13:21:09 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\MAGIX [2011.08.07 17:13:53 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Nokia [2010.10.21 19:09:54 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Nokia Ovi Suite [2011.08.20 15:58:02 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Nuance [2010.06.03 20:01:25 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Passware [2011.05.27 18:05:52 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\PC Suite [2010.10.15 19:54:39 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\PeerNetworking [2010.11.06 22:48:32 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Pegasys Inc [2012.01.22 14:17:07 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\ProtectDISC [2010.10.02 18:42:06 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Quester [2010.03.14 11:45:06 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\QuickScan [2011.08.20 16:00:38 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\ScanSoft [2011.12.31 10:37:34 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\SignaturUmgebung [2010.09.30 21:46:52 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Spearit [2009.10.31 22:25:40 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Sync App Settings [2011.05.28 17:13:04 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\TeamViewer [2010.08.04 05:52:26 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Thinstall [2010.06.19 21:07:26 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Titanium [2012.01.27 14:24:23 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Total Network Inventory 2 [2009.10.29 19:41:27 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\TrueCrypt [2011.10.16 14:07:48 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\TuneUp Software [2010.03.04 15:53:59 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Ubisoft [2010.01.03 10:19:37 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Unity [2010.04.28 21:05:28 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Zeon [2011.07.26 15:02:04 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 393 bytes -> C:\ProgramData\TEMP:9A870F8B @Alternate Data Stream - 172 bytes -> C:\ProgramData\TEMP:1AAB2E68 @Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:FD9CE1F3 @Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:A303874F @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:9B013599 @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:0B9FB94D @Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:01C66DD9 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:FED912DB @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:2BE9FEFC < End of report > Wäre super wenn ihr mir helfen könnt, habe keine Lust den Rechner platt zu machen :-) Gruß Blackmoon00 |
Ich schaue mir das eben an, aber setze das Log eben in einen Spoiler...
Mfg Edit: Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Zitat:
[Link nur für registrierte und freigeschaltete Mitglieder sichtbar. Jetzt registrieren...] Mfg |
Hi ckjthedogmaster,
vielen Dank für deine schnelle Antwort, habe geradt OLT durchlaufen lassen mit den von dir aufgezeigten Text, nun lasse ich gerade noch TDSSKiller durchlaufen, hoffe damit habe ich mein lässtiges Problem beseitigt. Konntest du eindeutig erkennen, was mich da befallen hat? Was mich verwundert, dass hier meine verschiedenen Viren- und Maleware Programme nicht angeschlagen haben. So nun ist TDSSKiller auch noch durchgelaufen, hat nichts gefunden. Der Test, sobald ich die Standartsuchmaske von Firefox als Startseite aktiviere und diese zur Suche nutze, werde ich auf folgenden Link umgeleitet: h**p://www.protectedsearch.com/websearchresults.aspx?si=34287&chrome=true&q=test Suchbegriff war hier: test Hast du noch eine Idee? Sag mir aber bitte nicht den Rechner platt machen. Danke schonmal für deine Hilfe. Gruß Blackmoon |
Gut, dann klick mal im firefox auf Extras und auf ADDons, findest du da was von
protectedsearch, dann deinstalliere es. Im FirefoxSuchfenster ist ein kleines Symbol, klicke dort drauf und setze Google als deine Suchmaschine fest. Testen... eventuell auch mal neustarten... Achja, du hast die Log in Quote gesetzt, editiere den Beitrag, dann etwas unten auf erweitert. Dann den Text vom Log markieren und in der Symbolleiste das S nehmen... mfg |
Hi,
unter den Addons hatte ich als erstes gesucht und nichts gefunden. Auch im Bereich der installierten Programme bin ich ins leere gelaufen. Ich weiß nicht wo dieser verdammt root dringen hängt. Letztlich kann ich das Problem so umgehen, dass ich die Startseite des Firefox manuell auf z.B. google.de setze, dann kommt das Problem nicht zum tragen. Jedoch habe ich Bedenken, dass irgend jemand bei mir vielleicht doch Daten abgreift bzw. sich protokollieren lässt und später darauf zugreift. Komisch ist, dass ich im Internet noch keinen Fall mit diesem Problem gefunden habe. Jetzt habe ich mir auch schon eine neue Security Software gekauft, wobei ich bisher mit GData eigentlich super zufrienden war - bis auf die Performance :-) Mal sehen ob Trend Micro vielleicht irgend etwas auf meinem Rechner findet. Vielleicht hast du ja doch noch eine Idee. |
joa, entfernen wäre doch ne gute Idee, oder nicht? :T
HAst du unter den Addons/Erweiterungen einen Eintrag mit do not track , DNT+ oder so ähnlich, dann entferne das mal. Gleichnamiges grünes Symbol sollte dann auch irgendwo beim Suchfenster sein, wo du es an und ausschalten kannst. Es ist auf jeden Fall ein Addon... Mfg |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 11:02 Uhr. |
Powered by vBulletin® (Deutsch)
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.