Lesezeichen verschwunden. Backupdatei kann nicht verarbeitet werden.

Nordstjernen

So hier ist das Löschprotokoll vom Adw-Cleaner:

Code

# AdwCleaner 7.0.8.0 - Logfile created on Mon Mar 26 20:14:37 2018


# Updated on 2018/08/02 by Malwarebytes 
# Running on Windows 10 Home (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support


***** [ Services ] *****


Deleted: LavasoftTcpService
Deleted: SearchProtectionService
Deleted: chip1click




***** [ Folders ] *****


Deleted: C:\Program Files (x86)\LenovoBrowserGuard
Deleted: C:\Users\June\AppData\Local\LenovoBrowserGuard
Deleted: C:\Users\June\AppData\Local\SweetLabs App Platform
Deleted: C:\ProgramData\lavasoft\web companion
Deleted: C:\Program Files (x86)\lavasoft\web companion
Deleted: C:\Users\All Users\lavasoft\web companion
Deleted: C:\Users\June\AppData\Roaming\lavasoft\web companion
Deleted: C:\ProgramData\7b24ec7cc000461ebe26d116b88142c8
Deleted: C:\Users\All Users\7b24ec7cc000461ebe26d116b88142c8
Deleted: C:\ProgramData\Pokki
Deleted: C:\Users\All Users\Pokki
Deleted: C:\Users\Default\AppData\Local\Pokki
Deleted: C:\Users\Default User\AppData\Local\Pokki
Deleted: C:\Users\Public\Pokki
Deleted: C:\Program Files (x86)\Chip Digital GmbH
Deleted: C:\Users\June\AppData\Local\Downloaded Installations\{DAD82379-C684-4D04-83D5-2B9934A9C362}
Deleted: C:\Windows\\Installer\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}
Deleted: C:\Program Files\ByteFence
Deleted: C:\Users\June\AppData\Roaming\Microsoft\Windows\Start Menu\ByteFence
Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion




***** [ Files ] *****


Deleted: C:\Windows\System32\lavasofttcpservice.dll
Deleted: C:\Windows\SysWOW64\lavasofttcpservice.dll
Deleted: C:\Windows\System32\LavasoftTcpServiceOff.ini
Deleted: C:\Windows\SysNative\LavasoftTcpServiceOff.ini
Deleted: C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini
Deleted: C:\Windows\SysNative\LavasoftTcpService64.dll
Deleted: C:\Users\June\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk




***** [ DLL ] *****


No malicious DLLs cleaned.


***** [ WMI ] *****


No malicious WMI cleaned.


***** [ Shortcuts ] *****


No malicious shortcuts cleaned.


***** [ Tasks ] *****


Deleted: SweetLabs App Platform




***** [ Registry ] *****


Deleted: [Data] - HKCU\Software\Microsoft\Internet Explorer\Main|Start Page [http:\\www.startseite24.net\]
Deleted: [Key] - HKU\S-1-5-21-3237491619-3644478913-1715744795-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_AP
Deleted: [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_AP
Deleted: [Key] - HKU\S-1-5-21-3237491619-3644478913-1715744795-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_Start_Menu
Deleted: [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SweetLabs_Start_Menu
Deleted: [Key] - HKLM\SOFTWARE\Lavasoft\Web Companion
Deleted: [Key] - HKLM\SOFTWARE\Classes\TypeLib\{CB6BF8B6-E12B-42FA-A478-91BCCDE475DC}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{2E5FA7B4-61A2-4662-BBCE-62BBB20FC649}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{5D7F05E3-075A-43AF-8BC7-21E2F7F38845}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{617E26CE-E6E1-4C75-A68A-A001F2B98491}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{79FBDBEA-A722-4ABD-BEC0-B7D463F6BA0E}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{8128586C-DF69-4266-873F-CF4C6F705A7C}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{C1F9CFCE-A7DC-4072-8B31-1DEA57004C86}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{EA4AD895-2A7F-430E-B973-DEE6C4E743A9}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{EBF4B60F-A863-426F-BE6F-5DFE83BC574F}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{9AD5C084-B6E6-456A-8BA2-A559663780E5}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{70C7334A-66D9-46DE-A4E2-6B923C7DB94E}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{5780633B-414C-446F-8EB2-FF1C9A731C99}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{4EECDED2-40FB-4500-85B4-86FB0EBECA68}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{10A7F29D-4B00-40EC-B07D-8616DF8135E6}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{05FF6A00-76A3-4AA1-A9A4-A782152ABE60}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{02966FA9-C01A-47E7-A169-C83AEA1FB0BA}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{0015CAC9-FC30-4CD0-BFAA-7412CC2C4DD9}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{26C7AFDB-3690-449E-B979-B0AF5CC56DD4}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{3A5A5381-DAAF-4C0D-B032-2C66B3EE4A8D}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{472EF1D2-4AAE-470D-AE85-6AF8177916FD}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{8F010D54-C023-457F-AF03-497EACB6D519}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{9A754403-27B1-4ED7-96D7-588F07888EBF}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{CB31FF8F-BF80-4D2B-ADBE-12C6F5347890}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{FCAA532B-E807-4027-940C-BA16B9D50105}
Deleted: [Key] - HKLM\SOFTWARE\Classes\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057}
Deleted: [Value] - HKU\S-1-5-21-3237491619-3644478913-1715744795-1001\Software\Microsoft\Windows\CurrentVersion\Run|Web Companion
Deleted: [Value] - HKU\S-1-5-21-3237491619-3644478913-1715744795-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|Web Companion
Deleted: [Value] - HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Web Companion
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services
Deleted: [Key] - HKCU\Software\Classes\AllFileSystemObjects\shell\pokki
Deleted: [Key] - HKCU\Software\Classes\Directory\shell\pokki
Deleted: [Key] - HKCU\Software\Classes\Drive\shell\pokki
Deleted: [Key] - HKCU\Software\Classes\lnkfile\shell\pokki
Deleted: [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\04A063A0BBEACF54EAEF493C49D9E3F6
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\04A063A0BBEACF54EAEF493C49D9E3F6
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\E49AC3054380EEC4DA29AB71FAE408A9
Deleted: [Key] - HKLM\SOFTWARE\Classes\Installer\Features\E49AC3054380EEC4DA29AB71FAE408A9
Deleted: [Key] - HKLM\SOFTWARE\Classes\Installer\Products\E49AC3054380EEC4DA29AB71FAE408A9
Deleted: [Key] - HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\chip 1-click download service
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders|C:\Program Files (x86)\Chip Digital GmbH\chip1click\
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders|C:\Program Files (x86)\Chip Digital GmbH\
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders|C:\Windows\Installer\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}\
Deleted: [Key] - HKLM\SYSTEM\Setup\FirstBoot\Services\chip1click
Deleted: [Key] - HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com
Deleted: [Key] - HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com
Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION|ByteFence.exe
Deleted: [Key] - HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Reason\ReasonByteFence
Deleted: [Value] - HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store|C:\Program Files\ByteFence\Uninstall.exe
Deleted: [Key] - HKU\S-1-5-21-3237491619-3644478913-1715744795-1001\Software\SweetLabs App Platform
Deleted: [Key] - HKCU\Software\SweetLabs App Platform
Deleted: [Key] - HKLM\SOFTWARE\LenovoBrowserGuard
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LenovoBrowserGuard
Deleted: [Key] - HKLM\SOFTWARE\Classes\AppID\{2CE0F1DC-C504-4B7B-A385-D94A2531DFFB}
Deleted: [Key] - HKLM\SOFTWARE\Classes\AppID\LavasoftTcpService.exe
Deleted: [Key] - HKLM\SOFTWARE\SecurityUtility
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SecurityUtility
Deleted: [Key] - HKU\S-1-5-21-3237491619-3644478913-1715744795-1001\Software\AppDataLow\Software\{3BDFD1D7-7A9B-4D29-80B3-D00E66E62885}
Deleted: [Key] - HKCU\Software\AppDataLow\Software\{3BDFD1D7-7A9B-4D29-80B3-D00E66E62885}
Deleted: [Key] - HKLM\SOFTWARE\VisualDiscovery
Deleted: [Key] - HKU\S-1-5-21-3237491619-3644478913-1715744795-1001\Software\csastats
Deleted: [Key] - HKCU\Software\csastats
Deleted: [Key] - HKLM\SOFTWARE\Websuche
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Websuche




***** [ Firefox (and derivatives) ] *****


No malicious Firefox entries deleted.


***** [ Chromium (and derivatives) ] *****


No malicious Chromium entries deleted.


*************************


::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0






*************************


C:/AdwCleaner/AdwCleaner[S0].txt - [10435 B] - [2018/3/26 19:1:38]
C:/AdwCleaner/AdwCleaner[S1].txt - [10477 B] - [2018/3/26 19:58:8]




########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

Alles anzeigen

Nordstjernen

Das JRT hat offensichtlich nichts gefunden:

Code

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 10 Home x64 
Ran by June (Administrator) on 26.03.2018 at 22:54:59,33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


File System: 0




Registry: 0 


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.03.2018 at 22:59:39,74
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Alles anzeigen

Nordstjernen

Aber: ERFOLG!!!
Dank an alle, die sich Gedanken und mir als blutigem Laien Vorschläge gemacht haben. Dank vor allem an Boersenfeger und Zitronella, der Tip mit dem Bereinigen war der Bringer. Also Bereinigen und schrittweise von 49.0.1 updaten. Dann hatte ich wieder -wie vor dem "Update"- Firefox 57.0 und Überrraschung: alle Lesezeichen (Liste und Symbolleiste) waren wieder da!
Und jetzt bin ich mit 59.0 auf dem aktuellen Stand. Und der Rechner ist weniger verseucht. Perfekt!
Nochmals Dank an die Community!

AngelOfDarkness

Und denk dran niemals etwas von der Seite Softonic laden und meide Downoad-Portale wie z.B.chip.de (zumindest über die angebotenen Download-Manager der jeweiligen Seiten). Lade Software immer nur vom Hersteller.

Zitronella

Schön dass es wieder funktioniert

Am besten findet man die Original Hersteller Seite (ohne irgendwelchen Referer Kram) auf der Seite https://www.heise.de/download/. Dort dann auf die entsprechende Software klicken und dann den original Hersteller - Link aufrufen.
Siehe: http://mozhelp.dynvpn.de/dateien/forum/…ller-finden.gif
Aber selbst dort ist man vor Ad/Malware nicht gefeit, da manche Hersteller diese selbst in ihre Installations Software mit einbauen.

Und Avira würde ich an deiner Stelle auch gleich über Board schmeißen und zwar mit dem eigenen Deinstaller deinstallieren ~~http://avast.com/de-de/uninstall-utility~~ EDIT: sorry meinte natürlich den hier https://www.avira.com/de/support-for…detail/kbid/902

Bei Win10 sollte man NUR den Windows Defender nutzen ggf. mit zusätzlichem Adware Schutz siehe: https://www.heise.de/security/meldu…er-3023579.html
Andere AV bei Win10 senkt die Sicherheit, siehe: http://www.pcgameshardware.de/Virus-Thema-23…vieren-1219444/ http://www.zdnet.de/88287066/ex-fi…ivirensoftware/

Lies dir auch dieses Sicherhteitskonzept durch: https://www.camp-firefox.de/forum/viewtopic.php?t=117674

Boersenfeger

Zitat von Nordstjernen

Und jetzt bin ich mit 59.0 auf dem aktuellen Stand.

Nicht ganz, denn aktuell ist seit gestern Abend Firefox 59.0.2...