Windows-Explorer funktioniert nicht mehr

Josefine_Jo · 20.12.2014, 13:48

Hallo zusammen - ich hoffe sehr, dass ich hier richtig bin. Ansonsten wechsle ich auch gerne und sofort Board und Threat. Sobald ich auf meiner externen Festplatt den Ordner "Hörbücher" anklicke, kommt die Fehlermeldung "Windows-Explorer funktioniert nicht mehr" und alle Ordner der Festplatt werden automatisch geschlossen. Hat jemand eine Idee, woran das liegen könnte?

schrauber · 20.12.2014, 14:41

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Josefine_Jo · 22.12.2014, 16:33

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-12-2014 01
Ran by  (administrator) on -PC on 22-12-2014 16:28:34
Running from C:\Users\\Downloads
Loaded Profile: (Available profiles: )
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo) C:\Windows\System32\ibmpmsvc.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
() C:\Windows\System32\PSIService.exe
(Rocket Division Software) C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
(Search Protect) C:\Program Files\SearchProtect\Main\bin\CltMngSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Dropbox, Inc.) C:\Users\\AppData\Roaming\Dropbox\bin\Dropbox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [124720 2014-10-09] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-27] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~1\SearchProtect\SearchProtect\bin\VC32Loader.dll => C:\Program Files\SearchProtect\SearchProtect\bin\VC32Loader.dll [188224 2014-11-10] (Search Protect)
Startup: C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Suche
SearchScopes: HKLM -> DefaultScope value is missing.
SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> {88CAA9A2-B68E-49FB-962C-536CE4F2F887} URL = hxxp://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=041513&q={searchTerms}&src=IE-SearchBox
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://sslvpn.landtag-bw.de/dana-cached/sc/JuniperSetupClient.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
ShellExecuteHooks:  - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=3 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=9 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF user.js: detected! => C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\user.js
FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\webde-suche.xml
FF Extension: Adblock Plus - C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]
FF Extension: Recorder Toolbar - C:\Program Files\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2014-12-02]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-02]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-11-28]
FF HKLM\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files\AmiExt\flashEnhancer\ff

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV=
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV="
CHR DefaultSearchKeyword: Default -> trovi.search
CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS
CHR DefaultSuggestURL: Default -> hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}
CHR Profile: D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-13]
CHR Extension: (Google Docs) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-13]
CHR Extension: (Google Drive) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-13]
CHR Extension: (YouTube) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-13]
CHR Extension: (Google Cast) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-09-13]
CHR Extension: (Google-Suche) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-13]
CHR Extension: (Google Tabellen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-13]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2014-09-13]
CHR Extension: (Google Wallet) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-13]
CHR Extension: (Google Mail) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-13]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-11-28]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [162096 2014-10-09] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 CltMngSvc; C:\Program Files\SearchProtect\Main\bin\CltMngSvc.exe [3056960 2014-11-10] (Search Protect)
R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-10-27] (Freemake) [File not signed]
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [226624 2011-01-27] ()
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [1858360 2014-07-14] (AVG)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [35640 2014-07-14] (AVG)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-14] (Avira Operations GmbH & Co. KG)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [16128 2014-04-11] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [67968 2014-04-11] (Silicon Laboratories)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2011-11-27] () [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-14] (Avira GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2013-12-16] (TuneUp Software)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579712 2009-12-01] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [543744 2009-12-01] (eMPIA Technology, Inc.)
U3 aczcqsny; C:\Windows\system32\Drivers\aczcqsny.sys [0 ] (Microsoft Corporation)
S3 catchme; \??\C:\Users\XX\AppData\Local\Temp\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 SPPD; \??\C:\Windows\system32\drivers\SPPD.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-22 16:19 - 2014-12-22 16:21 - 00033386 _____ () C:\Users\XX\Downloads\Addition.txt
2014-12-22 16:15 - 2014-12-22 16:28 - 00018709 _____ () C:\Users\XX\Downloads\FRST.txt
2014-12-22 16:15 - 2014-12-22 16:28 - 00000000 ___DC () C:\FRST
2014-12-22 16:14 - 2014-12-22 16:14 - 01114112 _____ (Farbar) C:\Users\XX\Downloads\FRST.exe
2014-12-18 16:27 - 2014-12-18 16:27 - 00408376 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-18 10:44 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-15 20:21 - 2014-12-15 20:21 - 00001174 _____ () C:\Users\XX\Desktop\Mandatos 4.5.0.lnk
2014-12-15 20:14 - 2014-12-15 20:15 - 04059136 _____ () C:\Users\XX\Downloads\03_Mandatos_Setup_4_5_0_20141208(1).msi
2014-12-15 19:46 - 2014-12-15 19:47 - 04059136 _____ () C:\Users\XX\Downloads\03_Mandatos_Setup_4_5_0_20141208.msi
2014-12-11 11:45 - 2014-12-11 11:45 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-11 09:27 - 2014-12-11 09:27 - 07027178 _____ () C:\Users\XX\Downloads\wordpress-4.0.1-de_DE(1).zip
2014-12-11 09:21 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-10 16:49 - 2014-12-10 16:50 - 07027178 _____ () C:\Users\XX\Downloads\wordpress-4.0.1-de_DE.zip
2014-12-10 09:20 - 2014-12-04 05:38 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-10 09:20 - 2014-12-04 05:34 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-10 09:20 - 2014-12-02 00:28 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-10 09:20 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 09:20 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 09:20 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 09:20 - 2014-11-22 03:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 09:20 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 09:20 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 09:20 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 09:20 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 09:20 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 09:20 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 09:20 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 09:20 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 09:20 - 2014-11-22 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 09:20 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 09:20 - 2014-11-22 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 09:20 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 09:20 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 09:20 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 09:20 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 09:20 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 09:20 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 09:20 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 09:20 - 2014-11-22 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 09:20 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 09:20 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 09:20 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 09:20 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 09:20 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 09:20 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 09:20 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 09:20 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 09:19 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 09:19 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 09:19 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 09:19 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-08 20:41 - 2014-12-08 20:41 - 00047442 _____ () C:\Users\XX\Downloads\Termine Gremieninfo HD.ics
2014-12-02 16:09 - 2014-12-02 18:44 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-12-02 14:18 - 2014-12-02 14:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-28 14:22 - 2014-07-14 11:26 - 00025400 _____ (AVG) C:\Windows\system32\authuitu.dll
2014-11-28 14:19 - 2014-11-28 14:19 - 00000000 ____D () C:\Users\XX\AppData\Local\AVG
2014-11-28 14:19 - 2014-07-14 11:26 - 00035640 _____ (AVG) C:\Windows\system32\uxtuneup.dll
2014-11-28 14:14 - 2014-11-28 14:14 - 00002175 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk
2014-11-28 14:14 - 2014-11-28 14:14 - 00002151 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2014.lnk
2014-11-28 14:14 - 2014-07-14 11:26 - 00036152 _____ (AVG) C:\Windows\system32\TURegOpt.exe
2014-11-28 14:13 - 2014-11-28 14:13 - 00002163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2014.lnk
2014-11-28 14:13 - 2014-11-28 14:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2014

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-22 16:19 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-22 16:19 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-22 15:52 - 2012-09-22 20:06 - 00000000 ____D () C:\Users\XX\AppData\Roaming\Dropbox
2014-12-22 15:31 - 2011-11-27 10:12 - 01400998 _____ () C:\Windows\WindowsUpdate.log
2014-12-22 15:27 - 2014-11-10 11:12 - 00006509 _____ () C:\Windows\setupact.log
2014-12-20 13:00 - 2013-12-29 19:19 - 00000444 __RSH () C:\ProgramData\ntuser.pol
2014-12-19 15:51 - 2014-03-16 17:19 - 00000000 ____D () C:\Users\XX\AppData\Roaming\Winamp
2014-12-18 16:27 - 2014-11-14 17:03 - 00226192 _____ () C:\Windows\PFRO.log
2014-12-18 13:50 - 2011-11-27 10:23 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-18 11:26 - 2014-11-04 17:40 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-12-18 11:26 - 2014-01-09 22:25 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-12-17 18:20 - 2013-08-04 22:29 - 00000000 ____D () C:\Users\XX\AppData\Roaming\Spotify
2014-12-16 09:48 - 2012-09-22 20:29 - 00000970 _____ () C:\Users\XX\Desktop\Dropbox.lnk
2014-12-16 09:48 - 2012-09-22 20:28 - 00000000 ____D () C:\Users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-15 20:21 - 2012-01-16 19:51 - 00000000 ____D () C:\Users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Somacos
2014-12-11 11:48 - 2013-07-03 07:46 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-12-11 11:45 - 2014-05-07 06:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat
2014-12-11 09:26 - 2011-11-27 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-11 09:15 - 2013-07-30 06:47 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-11 09:07 - 2011-11-27 10:57 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-10 17:05 - 2013-07-03 07:46 - 00000000 ____D () C:\Users\XX\AppData\Roaming\FileZilla
2014-12-10 17:04 - 2013-07-03 07:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-12-10 16:20 - 2014-01-22 21:24 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-03 00:28 - 2012-05-08 17:56 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-24 12:22 - 2014-09-10 14:26 - 00109280 _____ () C:\Users\XX\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-23 23:47 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF

Files to move or delete:
====================
C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job
C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job
C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job
C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job


Some content of TEMP:
====================
C:\Users\XX\AppData\Local\temp\avgnt.exe
C:\Users\XX\AppData\Local\temp\avgnt.exe
C:\Users\XX\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpamj6_f.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-09-01 14:11

==================== End Of Log ============================

--- --- ---

--- --- ---

FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 22-12-2014 01
Ran by XX at 2014-12-22 16:21:14
Running from C:\Users\XX\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.43 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon MP3-Downloader 1.0.17 (HKLM\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Apple Application Support (HKLM\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)
ArcSoft ShowBiz (HKLM\...\{9D41D2EF-2D33-4CFD-8A3E-C7E6FCC3303B}) (Version:  - ArcSoft)
Ashampoo Burning Studio 14 v.14.0.5 (HKLM\...\{91B33C97-7BCF-CDFE-4321-58EBF3E8641C}_is1) (Version: 14.0.5 - Ashampoo GmbH & Co. KG)
Audacity 1.3.13 (Unicode) (HKLM\...\Audacity 1.3 Beta (Unicode)_is1) (Version:  - Audacity Team)
AudibleManager (HKLM\...\AudibleManager) (Version: 2004245216.48.56.22154610 - Audible, Inc.)
AVG PC TuneUp 2014 (de-DE) (Version: 14.0.1001.519 - AVG) Hidden
AVG PC TuneUp 2014 (HKLM\...\AVG PC TuneUp) (Version: 14.0.1001.519 - AVG)
AVG PC TuneUp 2014 (Version: 14.0.1001.519 - AVG) Hidden
Avira (HKLM\...\{dc9a688a-12cb-4a22-b449-23d849d01dc7}) (Version: 1.1.24.28609 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.24.28609 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
CCleaner (HKLM\...\CCleaner) (Version: 3.23 - Piriform)
ChromecastApp (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\{079ede36-133d-44b0-8053-c7c1fa8d2e0d}_is1) (Version: 1.5.316.0 - Google Inc.)
Deutsch - Custom (HKLM\...\{665DF8DD-C829-4DAB-A39C-9A0EF073F9F0}) (Version: 1.0.3.40 - Company)
Dropbox (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
FileZilla Client 3.9.0.6 (HKLM\...\FileZilla Client) (Version: 3.9.0.6 - Tim Kosse)
Filzip 3.06 (HKLM\...\Filzip 3.0.6.93_is1) (Version: 3.0.6 - Philipp Engel)
FormatFactory 3.1.1 (HKLM\...\FormatFactory) (Version: 3.1.1 - Free Time)
Freemake Video Converter Version 4.1.5 (HKLM\...\Freemake Video Converter_is1) (Version: 4.1.5 - Ellora Assets Corporation)
GIMP 2.8.4 (HKLM\...\GIMP-2_is1) (Version: 2.8.4 - The GIMP Team)
Google Chrome (HKLM\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Intel(R) TV Wizard (HKLM\...\TVWiz) (Version:  - Intel Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
Java 7 Update 65 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
KODAK Create@Home Software (für dm) (HKLM\...\{D42D2755-D8D7-43D4-8537-A21424CA15CD}) (Version: 7.6.1392 - Eastman Kodak Company)
Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5802.24 - PC-Doctor, Inc.)
LINE (HKLM\...\LINE) (Version: 3.7.0.34 - LINE Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Keyboard Layout Creator 1.4 (HKLM\...\{99E66BC9-E4B6-485F-ABFC-31EFCE36DFDF}) (Version: 1.4.6000 - Microsoft Corp.)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MotoHelper 2.0.45 Driver 5.0.0 (HKLM\...\MotoHelper) (Version: 2.0.45 - Motorola)
MotoHelper MergeModules (Version: 1.2.0 - Motorola) Hidden
Motorola Mobile Drivers Installation 5.0.0 (Version: 5.0.0 - Motorola Inc.) Hidden
Mozilla Firefox 34.0 (x86 de) (HKLM\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.1 - Mozilla)
Mozilla Thunderbird 31.3.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.3.0 (x86 de)) (Version: 31.3.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PDF24 Creator 5.2.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)
QuickTime (HKLM\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Search Protect (HKLM\...\SearchProtect) (Version: 2.18.20.210 - Search Protect) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Somacos Mandatos (HKLM\...\{083263A0-7C2C-4A0F-BB1B-C9328D15BBED}) (Version: 4.5.0 - SOMACOS GmbH & Co. KG)
SparkleShare (HKLM\...\{184950D5-67F6-4D06-9717-7E2F1607A7B0}) (Version: 1.0.0 - SparkleShare)
Spotify (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)
StreamTransport version: 1.0.2.2171 (HKLM\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
ThinkPad Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.43 - )
TreeSize Free V2.7 (HKLM\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)
USB Video/Audio Device Driver (HKLM\...\{3717C4F2-7412-4793-9BB8-D73D2817B3D6}) (Version: 1.00.0000 - Ihr Firmenname)
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Winamp (HKLM\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports  (03/19/2014 6.7.0.0) (HKLM\...\B97004A400E30DCF940971EFA7A0C13C6B0A4B66) (Version: 03/19/2014 6.7.0.0 - Silicon Laboratories)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

18-12-2014 15:54:17 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2014-01-22 14:41 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0885E870-83C3-4F12-A0BF-6FD45A2498FE} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-03-31] (PC-Doctor, Inc.)
Task: {2CB84D8E-D9D2-4359-956F-E473D828B94F} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-03-31] (PC-Doctor, Inc.)
Task: {36F211C8-7321-42D7-BDE1-810C22345365} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3209394106-3398393384-4106522146-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2011-11-08] (RealNetworks, Inc.)
Task: {5E8008A4-49B8-4B23-BE92-48CE97603B44} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-09-24] (Piriform Ltd)
Task: {7E5019A1-DAF8-41C0-9831-422BDDC64E04} - System32\Tasks\{F0566F61-5A90-4EF4-86D7-D7AC4D7A72BB} => Firefox.exe Skype für den Desktop herunterladen
Task: {832F7DE9-2342-469D-A014-337F65028019} - System32\Tasks\MT66 Software Update => C:\Program Files\Common Files\MT66 Software Update\UpdateClient.exe
Task: {882FA565-A9E1-444D-B23C-AF7AC99A4BE2} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3209394106-3398393384-4106522146-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2011-11-08] (RealNetworks, Inc.)
Task: {8AAE035D-A9CC-4B5C-9C50-B5189C6F81A6} - System32\Tasks\{A7244EDB-6CB7-4E28-89AA-8F7014BCA92A} => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe <==== ATTENTION
Task: {C09B71F7-C2F9-48CE-9E68-B4FC69B855FA} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {DA061B9D-4A6A-4956-BF03-CFF37A0A0C77} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-03-31] (PC-Doctor, Inc.)
Task: {F8674A3D-F331-4058-9BBF-68AAD48844F0} - System32\Tasks\{125248E9-6072-42A7-987B-521BBFA6112B} => pcalua.exe -a "C:\Program Files\Juniper Networks\Secure Application Manager\dsSamUI.exe" -d "C:\Program Files\Juniper Networks\Secure Application Manager" -c /Diagnostics

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AVG_REG_1213b.job => C:\ProgramData\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe
Task: C:\Windows\Tasks\AVG_SYS_TASK_DELETE.job => C:\ProgramData\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cff1b7fd95e51d.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0001f186f260e.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfcf34e5858b92.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfedc6350b29ae.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1d000b2c209d060.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Launch 8613.job => C:\Program Files\Audible\Bin\Manager.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\SidebarExecute.job => C:\Program Files\Windows Sidebar\sidebar.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files\AVG\AVG PC TuneUp\OneClick.exe
Task: C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job => c:\program files\mozilla firefox\firefox.exe
Task: C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job => c:\program files\mozilla firefox\firefox.exe
Task: C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job => c:\program files\mozilla firefox\firefox.exe
Task: C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job => c:\program files\mozilla firefox\firefox.exe

==================== Loaded Modules (whitelisted) =============

2011-01-27 22:13 - 2011-01-27 22:13 - 00226624 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
2007-06-05 13:20 - 2007-06-05 13:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe
2014-07-14 11:26 - 2014-07-14 11:26 - 00585528 _____ () C:\Program Files\AVG\AVG PC TuneUp\avgreplibx.dll
2014-07-14 11:26 - 2014-07-14 11:26 - 00357176 _____ () C:\Program Files\AVG\AVG PC TuneUp\tuavgx.dll
2011-01-27 22:13 - 2011-01-27 22:13 - 00673088 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
2014-12-02 14:18 - 2014-12-02 14:18 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-12-02 16:09 - 2014-12-02 16:09 - 03339376 _____ () C:\Program Files\Mozilla Thunderbird\mozjs.dll
2014-12-02 16:09 - 2014-12-02 16:09 - 00158832 _____ () C:\Program Files\Mozilla Thunderbird\NSLDAP32V60.dll
2014-12-02 16:09 - 2014-12-02 16:09 - 00023152 _____ () C:\Program Files\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\XX\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2014-12-22 15:52 - 2014-12-22 15:52 - 00043008 _____ () c:\users\XX\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpamj6_f.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\XX\AppData\Roaming\Dropbox\bin\libEGL.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\XX\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\XX\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2014-10-16 10:15 - 2014-10-16 10:15 - 00035328 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00091648 _____ () C:\Program Files\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00892416 _____ () C:\Program Files\FileZilla FTP Client\libstdc++-6.dll

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupfolder: C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SparkleShare.lnk => C:\Windows\pss\SparkleShare.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: avgnt => "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
MSCONFIG\startupreg: Avira Systray => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
MSCONFIG\startupreg: OfficeSyncProcess => "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\XX\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-3209394106-3398393384-4106522146-500 - Administrator - Disabled)
XX (S-1-5-21-3209394106-3398393384-4106522146-1001 - Limited - Enabled) => C:\Users\XX
Gast (S-1-5-21-3209394106-3398393384-4106522146-501 - Limited - Disabled)
XX (S-1-5-21-3209394106-3398393384-4106522146-1000 - Administrator - Enabled) => C:\Users\XX

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/22/2014 04:08:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x2e4
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (12/22/2014 04:08:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xb5c
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (12/22/2014 04:08:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x4bc
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (12/22/2014 04:06:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x2ec
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (12/20/2014 02:05:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x734
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (12/20/2014 01:42:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xfc0
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (12/20/2014 01:42:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xe04
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (12/20/2014 01:41:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x5e4
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (12/20/2014 01:41:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x674
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (12/19/2014 04:58:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x155c
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3


System errors:
=============
Error: (12/20/2014 07:10:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.

Error: (12/19/2014 05:12:16 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (12/18/2014 11:43:29 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (12/18/2014 10:50:46 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎18.‎12.‎2014 um 10:48:39 unerwartet heruntergefahren.

Error: (12/18/2014 10:32:21 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.

Error: (12/17/2014 04:17:13 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.

Error: (12/17/2014 10:47:30 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.

Error: (12/17/2014 02:56:02 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.

Error: (12/17/2014 02:53:58 AM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (12/16/2014 02:23:09 PM) (Source: ACPI) (EventID: 13) (User: )
Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.


Microsoft Office Sessions:
=========================
Error: (12/22/2014 04:08:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f2e401d01df929588a8fC:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dll6c43145f-89ec-11e4-bab5-0016d3cc412f

Error: (12/22/2014 04:08:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812fb5c01d01df9214dbebbC:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dll63002f97-89ec-11e4-bab5-0016d3cc412f

Error: (12/22/2014 04:08:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f4bc01d01df8ebf6a8baC:\Windows\Explorer.EXEC:\Windows\system32\KERNELBASE.dll5caf08ab-89ec-11e4-bab5-0016d3cc412f

Error: (12/22/2014 04:06:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f2ec01d01df448979973C:\Windows\Explorer.EXEC:\Windows\system32\KERNELBASE.dll24f56119-89ec-11e4-bab5-0016d3cc412f

Error: (12/20/2014 02:05:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f73401d01c5266c93233C:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dlld1b8458d-8848-11e4-b61b-0016d3cc412f

Error: (12/20/2014 01:42:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812ffc001d01c5260687e2fC:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dlla2a3a489-8845-11e4-b61b-0016d3cc412f

Error: (12/20/2014 01:42:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812fe0401d01c5256582f0aC:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dll9b274730-8845-11e4-b61b-0016d3cc412f

Error: (12/20/2014 01:41:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f5e401d01c524a001354C:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dll91b226bd-8845-11e4-b61b-0016d3cc412f

Error: (12/20/2014 01:41:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f67401d01c4cf8628e00C:\Windows\Explorer.EXEC:\Windows\system32\KERNELBASE.dll851539af-8845-11e4-b61b-0016d3cc412f

Error: (12/19/2014 04:58:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f155c01d01ba40b98fd42C:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dlld3a9024f-8797-11e4-8d45-0016d3cc412f


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU L7300 @ 1.40GHz
Percentage of memory in use: 68%
Total physical RAM: 2006.3 MB
Available physical RAM: 634.27 MB
Total Pagefile: 4012.59 MB
Available Pagefile: 2298.15 MB
Total Virtual: 2047.88 MB
Available Virtual: 1893.87 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:58.5 GB) (Free:6.34 GB) NTFS
Drive d: (Volume) (Fixed) (Total:53.19 GB) (Free:4.27 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 97979797)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=58.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=53.2 GB) - (Type=07 NTFS)

==================== End Of Log ============================

--- --- ---

Josefine_Jo · 22.12.2014, 16:36

Ist das richtig so?

schrauber · 23.12.2014, 12:09

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Search Protect
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Josefine_Jo · 29.12.2014, 09:11

Hallo Schrauber,

vielen Dank für Deine Hilfe. Hier nun das Logfile:

Code:

ATTFilter

ComboFix 14-12-25.01 - XX 29.12.2014   8:54.1.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.2006.754 [GMT 1:00]
ausgeführt von:: c:\users\XX\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Wajam
c:\program files\Wajam\Logos\amazon.ico
c:\program files\Wajam\Logos\argos.ico
c:\program files\Wajam\Logos\ask.ico
c:\program files\Wajam\Logos\bestbuy.ico
c:\program files\Wajam\Logos\ebay.ico
c:\program files\Wajam\Logos\etsy.ico
c:\program files\Wajam\Logos\facebook.ico
c:\program files\Wajam\Logos\favicon.ico
c:\program files\Wajam\Logos\google.ico
c:\program files\Wajam\Logos\homedepot.ico
c:\program files\Wajam\Logos\ikea.ico
c:\program files\Wajam\Logos\imdb.ico
c:\program files\Wajam\Logos\lowes.ico
c:\program files\Wajam\Logos\mercado.ico
c:\program files\Wajam\Logos\mysearchweb.ico
c:\program files\Wajam\Logos\myshopping.ico
c:\program files\Wajam\Logos\searchresult.ico
c:\program files\Wajam\Logos\sears.ico
c:\program files\Wajam\Logos\setting.ico
c:\program files\Wajam\Logos\settings.ico
c:\program files\Wajam\Logos\shopping.ico
c:\program files\Wajam\Logos\target.ico
c:\program files\Wajam\Logos\tesco.ico
c:\program files\Wajam\Logos\tripadvisor.ico
c:\program files\Wajam\Logos\twitter.ico
c:\program files\Wajam\Logos\wajam.ico
c:\program files\Wajam\Logos\walmart.ico
c:\program files\Wajam\Logos\wiki.ico
c:\program files\Wajam\Logos\yahoo.ico
c:\program files\Wajam\Logos\zalando.ico
c:\program files\Wajam\uninstall.exe
c:\program files\Wajam\Wajam Internet Enhancer\2845734c09907de22309ed6090c7c5b9
c:\program files\Wajam\Wajam Internet Enhancer\a12534f1688fe7d400f8d5ec8c062411
c:\program files\Wajam\Wajam Internet Enhancer\b3f4b05e3ab3a5e65883524e710a4e42
c:\program files\Wajam\Wajam Internet Enhancer\b8d1e876cfa4fcb16a595bf14b388061
c:\program files\Wajam\Wajam Internet Enhancer\d90d57d5aa65ebd01388d5922e5b1360
c:\program files\Wajam\Wajam Internet Enhancer\eb4aa542ea0da53cf3fa4900611dbcc2
c:\program files\Wajam\Wajam Internet Enhancer\FiddlerCore.dll
c:\program files\Wajam\Wajam Internet Enhancer\HtmlAgilityPack.dll
c:\program files\Wajam\Wajam Internet Enhancer\makecert.exe
c:\program files\Wajam\Wajam Internet Enhancer\Newtonsoft.Json.dll
c:\program files\Wajam\Wajam Internet Enhancer\WajamHttpServer.exe
c:\program files\Wajam\Wajam Internet Enhancer\WajamInternetEnhancer.exe
c:\program files\Wajam\Wajam Internet Enhancer\WajamInternetEnhancerService.exe
c:\program files\Wajam\Wajam Internet Enhancer\wie
c:\program files\Wajam\Wajam Internet Enhancer\WJManifest
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\Ask.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\Google.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\IMDb.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\Shopping.com.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\TripAdvisor.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\Wikipedia.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\Yahoo!.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Amazon.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Argos.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Ebay.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Etsy.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\HomeDepot.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Ikea.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Lowe's.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Mercadolivre.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\MyShopping.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Sears.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Target.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Tesco.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Walmart.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Zalando.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Settings.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\SignIn with Facebook.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\SignIn with Twitter.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Uninstall Wajam\uninstall.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Wajam Website.lnk
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-11-28 bis 2014-12-29  ))))))))))))))))))))))))))))))
.
.
2014-12-29 08:04 . 2014-12-29 08:04	--------	d-----w-	c:\users\Public\AppData\Local\temp
2014-12-29 08:04 . 2014-12-29 08:04	--------	d-----w-	c:\users\Xx\AppData\Local\temp
2014-12-29 08:04 . 2014-12-29 08:04	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-12-29 07:46 . 2014-12-29 07:46	--------	dc----w-	C:\OETemp
2014-12-22 15:15 . 2014-12-22 15:32	--------	dc----w-	C:\FRST
2014-12-18 09:44 . 2014-12-13 03:33	115712	----a-w-	c:\windows\system32\ieUnatt.exe
2014-12-15 19:21 . 2014-12-15 19:21	--------	d-----w-	d:\mail - lokale ordner\Local\Apps
2014-12-11 10:45 . 2014-12-11 10:45	--------	d-----w-	c:\windows\system32\appraiser
2014-12-11 08:21 . 2014-10-18 01:33	3209728	----a-w-	c:\windows\system32\mf.dll
2014-12-10 08:19 . 2014-11-08 02:45	2048	----a-w-	c:\windows\system32\tzres.dll
2014-12-10 08:19 . 2014-10-03 01:45	248832	----a-w-	c:\windows\system32\WSManMigrationPlugin.dll
2014-12-10 08:19 . 2014-10-03 01:45	1177088	----a-w-	c:\windows\system32\WsmSvc.dll
2014-12-10 08:19 . 2014-10-03 01:45	214016	----a-w-	c:\windows\system32\WsmWmiPl.dll
2014-12-10 08:19 . 2014-10-03 01:45	145920	----a-w-	c:\windows\system32\WsmAuto.dll
2014-12-10 08:19 . 2014-10-03 01:44	198656	----a-w-	c:\windows\system32\WSManHTTPConfig.exe
2014-12-10 08:19 . 2014-10-30 01:45	155136	----a-w-	c:\windows\system32\charmap.exe
2014-12-03 06:31 . 2014-12-03 06:31	227048	----a-w-	c:\program files\Internet Explorer\Plugins\nppdf32.dll
2014-12-02 15:09 . 2014-12-02 17:44	--------	d-----w-	c:\program files\Mozilla Thunderbird
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-11-19 03:31 . 2014-11-19 03:31	1217192	----a-w-	c:\windows\system32\FM20.DLL
2014-11-11 02:44 . 2014-11-19 10:11	186880	----a-w-	c:\windows\system32\pku2u.dll
2014-11-11 02:44 . 2014-11-19 10:11	550912	----a-w-	c:\windows\system32\kerberos.dll
2014-10-25 01:32 . 2014-11-12 12:52	67584	----a-w-	c:\windows\system32\packager.dll
2014-10-18 01:33 . 2014-11-12 12:53	571904	----a-w-	c:\windows\system32\oleaut32.dll
2014-10-14 01:56 . 2014-11-12 12:52	136632	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2014-10-14 01:50 . 2014-11-12 12:52	523776	----a-w-	c:\windows\system32\termsrv.dll
2014-10-14 01:50 . 2014-11-12 12:53	2363904	----a-w-	c:\windows\system32\msi.dll
2014-10-14 01:50 . 2014-11-12 12:52	1059840	----a-w-	c:\windows\system32\lsasrv.dll
2014-10-14 01:47 . 2014-11-12 12:52	146432	----a-w-	c:\windows\system32\msaudite.dll
2014-10-14 01:46 . 2014-11-12 12:52	681984	----a-w-	c:\windows\system32\adtschema.dll
2014-10-10 00:45 . 2014-11-12 12:53	2379264	----a-w-	c:\windows\system32\win32k.sys
2014-10-03 01:44 . 2014-11-12 12:53	442880	----a-w-	c:\windows\system32\AUDIOKSE.dll
2014-10-03 01:44 . 2014-11-12 12:53	275968	----a-w-	c:\windows\system32\EncDump.dll
2014-10-03 01:44 . 2014-11-12 12:53	475136	----a-w-	c:\windows\system32\audiosrv.dll
2014-10-03 01:44 . 2014-11-12 12:53	374784	----a-w-	c:\windows\system32\AudioEng.dll
2014-10-03 01:44 . 2014-11-12 12:53	195584	----a-w-	c:\windows\system32\AudioSes.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04	131480	----a-w-	c:\users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04	131480	----a-w-	c:\users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04	131480	----a-w-	c:\users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpUninstallCleanUp"="REG delete HKEY_LOCAL_MACHINE\Software\SearchProtect" [X]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-05-27 280576]
.
c:\users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\XX\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-12-9 39207112]
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0sdnclean.exe
.
[HKLM\~\startupfolder\C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SparkleShare.lnk]
path=c:\users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SparkleShare.lnk
backup=c:\windows\pss\SparkleShare.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2014-11-20 18:13	1021128	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2012-11-05 14:27	89184	----a-w-	c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Download Assistant]
2012-09-20 14:02	1425208	----a-w-	c:\windows\System32\LogiLDA.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]
2014-10-14 20:01	720064	----a-w-	c:\program files\Microsoft Office\Office14\MSOSYNC.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2014-10-16 10:10	1514040	----a-w-	c:\users\XX\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2014-07-11 00:39	256896	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
"Google Update"="d:\mail - lokale ordner\Local\Google\Update\GoogleUpdate.exe" /c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"IgfxTray"=c:\windows\system32\igfxtray.exe
"Persistence"=c:\windows\system32\igfxpers.exe
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" -osboot
"PDFPrint"=c:\program files\PDF24\pdf24.exe
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"ArcSoft Connection Service"=c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 Freemake Improver;Freemake Improver;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2014-10-27 108032]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-29 6016]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-11-22 102912]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2010-12-03 20352]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 8320]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2010-04-01 23424]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [2010-01-25 9472]
R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [2014-04-11 16128]
R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2014-04-11 67968]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2013-10-30 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-11-27 721904]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
S2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [2011-01-27 226624]
S2 TuneUp.UtilitiesSvc;AVG PC TuneUp Service;c:\program files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [2014-07-14 1858360]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [2013-12-16 12320]
S4 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - avipbb
*Deregistered* - ssmdrv
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-09-13 09:11	1096520	----a-w-	c:\program files\Google\Chrome\Application\37.0.2062.120\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-17 20:20]
.
2014-01-11 c:\windows\Tasks\AVG_REG_1213b.job
- c:\programdata\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe [2014-01-11 18:06]
.
2014-01-11 c:\windows\Tasks\AVG_SYS_TASK_DELETE.job
- c:\programdata\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe [2014-01-11 18:06]
.
2014-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-09-13 09:10]
.
2014-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cff1b7fd95e51d.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-09-13 09:10]
.
2014-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore1d0001f186f260e.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-09-13 09:10]
.
2014-10-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfcf34e5858b92.job
- d:\mail - lokale ordner\Local\Google\Update\GoogleUpdate.exe [2014-09-13 09:14]
.
2014-11-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfedc6350b29ae.job
- d:\mail - lokale ordner\Local\Google\Update\GoogleUpdate.exe [2014-09-13 09:14]
.
2014-11-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1d000b2c209d060.job
- d:\mail - lokale ordner\Local\Google\Update\GoogleUpdate.exe [2014-09-13 09:14]
.
2013-09-29 c:\windows\Tasks\Launch 8613.job
- c:\program files\Audible\Bin\Manager.exe [2014-11-04 11:19]
.
2013-08-25 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 22:04]
.
2014-01-09 c:\windows\Tasks\SidebarExecute.job
- c:\program files\Windows Sidebar\sidebar.exe [2011-11-27 12:17]
.
2013-09-01 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 22:04]
.
2014-01-12 c:\windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job
- c:\program files\AVG\AVG PC TuneUp\OneClick.exe [2014-07-14 10:23]
.
2014-08-24 c:\windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job
- c:\program files\mozilla firefox\firefox.exe [2014-12-02 13:18]
.
2014-08-24 c:\windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job
- c:\program files\mozilla firefox\firefox.exe [2014-12-02 13:18]
.
2014-08-24 c:\windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job
- c:\program files\mozilla firefox\firefox.exe [2014-12-02 13:18]
.
2014-08-24 c:\windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job
- c:\program files\mozilla firefox\firefox.exe [2014-12-02 13:18]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV=
mStart Page = hxxp://www.google.com
IE: An OneNote s&enden - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.5.1
FF - ProfilePath - c:\users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir Desktop\avgnt.exe
MSConfigStartUp-Avira Systray - c:\program files\Avira\My Avira\Avira.OE.Systray.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-12-29  09:08:54
ComboFix-quarantined-files.txt  2014-12-29 08:08
.
Vor Suchlauf: 6.860.255.232 Bytes frei
Nach Suchlauf: 6.719.721.472 Bytes frei
.
- - End Of File - - 3C96F6C52ECFACD147DC1D54AEFE708D
A36C5E4F47E84449FF07ED3517B43A31

schrauber · 29.12.2014, 20:06

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Josefine_Jo · 31.12.2014, 00:02

HTML-Code:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 30.12.2014
Suchlauf-Zeit: 14:42:58
Logdatei: male.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2014.12.30.05
Rootkit Datenbank: v2014.12.29.02
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: XX

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 368868
Verstrichene Zeit: 35 Min, 56 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v4.106 - Bericht erstellt am 30/12/2014 um 15:59:47
# Aktualisiert 21/12/2014 von Xplode
# Database : 2014-12-28.1 [Live]
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : xx - xx-PC
# Gestartet von : C:\Users\xx\Downloads\AdwCleaner_4.106.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Updater
Ordner Gelöscht : C:\ProgramData\Websteroids
Ordner Gelöscht : C:\ProgramData\SimaRtComppare
Ordner Gelöscht : C:\ProgramData\wEbbsaaver
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
Ordner Gelöscht : C:\Program Files\AmiExt
Ordner Gelöscht : C:\Program Files\Uniblue
Ordner Gelöscht : C:\Program Files\Uninstaller
Ordner Gelöscht : C:\Users\xx\AppData\Roaming\Uniblue
Ordner Gelöscht : C:\Users\xx\AppData\Roaming\RHEng
Datei Gelöscht : C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\user.js

***** [ Tasks ] *****

Task Gelöscht : DSite
Task Gelöscht : Lyrics-Pal Update
Task Gelöscht : QtraxPlayer

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\VBMZ

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v34.0 (x86 de)

[rwyk3m6g.default\prefs.js] - Zeile gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");

-\\ Google Chrome v37.0.2062.120

[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=
[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=
[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=
[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=
[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=
[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=

*************************

AdwCleaner[R0].txt - [4623 octets] - [30/12/2014 15:40:05]
AdwCleaner[S0].txt - [4467 octets] - [30/12/2014 15:59:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4527 octets] ##########

--- --- ---

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Professional x86
Ran by xx on 30.12.2014 at 16:12:48,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
Successfully deleted: [File] "C:\Users\xx\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"
Successfully deleted: [File] "C:\Windows\wininit.ini"



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\pcdr"
Successfully deleted: [Folder] "C:\Users\xx\AppData\Roaming\pcdr"



~~~ FireFox

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\ext@flash-enhancer.com
Emptied folder: C:\Users\xx\AppData\Roaming\mozilla\firefox\profiles\rwyk3m6g.default\minidumps [214 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.12.2014 at 16:17:29,85
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-12-2014
Ran by xx (administrator) on xx-PC on 30-12-2014 16:38:07
Running from C:\Users\xx\Downloads
Loaded Profile: xx (Available profiles: xx & xx)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo) C:\Windows\System32\ibmpmsvc.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
() C:\Windows\System32\PSIService.exe
(Rocket Division Software) C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dropbox, Inc.) C:\Users\xx\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avcenter.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(Farbar) C:\Users\xx\Downloads\FRST(1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-27] (Microsoft Corporation)
Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\xx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> {88CAA9A2-B68E-49FB-962C-536CE4F2F887} URL = hxxp://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=041513&q={searchTerms}&src=IE-SearchBox
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://sslvpn.landtag-bw.de/dana-cached/sc/JuniperSetupClient.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=3 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=9 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\webde-suche.xml
FF Extension: Adblock Plus - C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]
FF Extension: Recorder Toolbar - C:\Program Files\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2014-12-02]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-02]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-11-28]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV=
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV="
CHR DefaultSearchKeyword: Default -> trovi.search
CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS
CHR DefaultSuggestURL: Default -> hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}
CHR Profile: D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-13]
CHR Extension: (Google Docs) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-13]
CHR Extension: (Google Drive) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-13]
CHR Extension: (YouTube) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-13]
CHR Extension: (Google Cast) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-09-13]
CHR Extension: (Google-Suche) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-13]
CHR Extension: (Google Tabellen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-13]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2014-09-13]
CHR Extension: (Google Wallet) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-13]
CHR Extension: (Google Mail) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-13]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-11-28]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-10-27] (Freemake) [File not signed]
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [226624 2011-01-27] ()
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [1858360 2014-07-14] (AVG)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [35640 2014-07-14] (AVG)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-11-24] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-12-30] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [16128 2014-04-11] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [67968 2014-04-11] (Silicon Laboratories)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2011-11-27] () [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-11-24] (Avira GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2013-12-16] (TuneUp Software)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579712 2009-12-01] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [543744 2009-12-01] (eMPIA Technology, Inc.)
U3 aom82ysh; C:\Windows\system32\Drivers\aom82ysh.sys [0 ] (Microsoft Corporation)
S3 catchme; \??\C:\Users\xx\AppData\Local\Temp\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-30 16:37 - 2014-12-30 16:37 - 01114624 _____ (Farbar) C:\Users\xx\Downloads\FRST(1).exe
2014-12-30 16:17 - 2014-12-30 16:17 - 00001256 _____ () C:\Users\xx\Desktop\JRT.txt
2014-12-30 16:10 - 2014-12-30 16:11 - 01707939 _____ (Thisisu) C:\Users\xx\Downloads\JRT.exe
2014-12-30 15:39 - 2014-12-30 15:39 - 02173952 _____ () C:\Users\xx\Downloads\AdwCleaner_4.106.exe
2014-12-30 14:42 - 2014-12-30 16:06 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-30 14:41 - 2014-12-30 14:41 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ___DC () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-30 14:41 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-30 14:41 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-30 14:41 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-30 14:40 - 2014-12-30 14:40 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xx\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-29 09:38 - 2014-12-29 09:36 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-12-29 09:36 - 2014-12-29 09:36 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Avira
2014-12-29 09:34 - 2014-12-29 09:34 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-12-29 09:33 - 2014-11-24 10:23 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-12-29 09:33 - 2014-11-24 10:23 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-12-29 09:33 - 2014-11-24 10:23 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-12-29 09:33 - 2014-11-24 10:23 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-12-29 09:29 - 2014-12-29 09:32 - 154051656 _____ () C:\Users\xx\Downloads\avira_free_antivirus_de.exe
2014-12-29 09:19 - 2014-12-29 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-29 09:18 - 2014-12-29 09:18 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av_5747036816__ws.exe
2014-12-29 09:16 - 2014-12-29 09:22 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-29 09:16 - 2014-12-29 09:16 - 00000041 _____ () C:\Windows\Filzip.ini
2014-12-29 09:13 - 2014-12-29 09:33 - 00000000 ____D () C:\ProgramData\Avira
2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws.exe
2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws(1).exe
2014-12-29 09:13 - 2014-12-29 09:13 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-29 09:08 - 2014-12-29 09:08 - 00021410 ____C () C:\ComboFix.txt
2014-12-29 08:48 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-29 08:48 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-29 08:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-29 08:35 - 2014-12-29 09:08 - 00000000 ___DC () C:\Qoobox
2014-12-29 08:34 - 2014-12-29 08:34 - 05603624 ____R (Swearware) C:\Users\xx\Desktop\ComboFix.exe
2014-12-29 08:30 - 2014-12-29 08:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\xx\Downloads\revosetup95.exe
2014-12-22 16:19 - 2014-12-22 16:21 - 00033386 _____ () C:\Users\xx\Downloads\Addition.txt
2014-12-22 16:15 - 2014-12-30 16:38 - 00018020 _____ () C:\Users\xx\Downloads\FRST.txt
2014-12-22 16:15 - 2014-12-30 16:38 - 00000000 ___DC () C:\FRST
2014-12-22 16:14 - 2014-12-22 16:14 - 01114112 _____ (Farbar) C:\Users\xx\Downloads\FRST.exe
2014-12-18 16:27 - 2014-12-18 16:27 - 00408376 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-18 10:44 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-15 20:21 - 2014-12-15 20:21 - 00001174 _____ () C:\Users\xx\Desktop\Mandatos 4.5.0.lnk
2014-12-15 20:14 - 2014-12-15 20:15 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208(1).msi
2014-12-15 19:46 - 2014-12-15 19:47 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208.msi
2014-12-11 11:45 - 2014-12-11 11:45 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-11 09:27 - 2014-12-11 09:27 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE(1).zip
2014-12-11 09:21 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-10 16:49 - 2014-12-10 16:50 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE.zip
2014-12-10 09:20 - 2014-12-04 05:38 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-10 09:20 - 2014-12-04 05:34 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-10 09:20 - 2014-12-02 00:28 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-10 09:20 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 09:20 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 09:20 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 09:20 - 2014-11-22 03:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 09:20 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 09:20 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 09:20 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 09:20 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 09:20 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 09:20 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 09:20 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 09:20 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 09:20 - 2014-11-22 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 09:20 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 09:20 - 2014-11-22 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 09:20 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 09:20 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 09:20 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 09:20 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 09:20 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 09:20 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 09:20 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 09:20 - 2014-11-22 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 09:20 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 09:20 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 09:20 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 09:20 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 09:20 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 09:20 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 09:20 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 09:20 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 09:19 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 09:19 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 09:19 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 09:19 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-08 20:41 - 2014-12-08 20:41 - 00047442 _____ () C:\Users\xx\Downloads\Termine Gremieninfo HD.ics
2014-12-02 16:09 - 2014-12-02 18:44 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-12-02 14:18 - 2014-12-02 14:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-30 16:14 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-30 16:14 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-30 16:12 - 2014-01-22 21:41 - 00000000 ____D () C:\Windows\ERUNT
2014-12-30 16:07 - 2012-09-22 20:06 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Dropbox
2014-12-30 16:04 - 2014-11-14 17:03 - 00387242 _____ () C:\Windows\PFRO.log
2014-12-30 16:04 - 2014-11-10 11:12 - 00006957 _____ () C:\Windows\setupact.log
2014-12-30 16:04 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-12-30 16:03 - 2011-11-27 10:12 - 01532528 _____ () C:\Windows\WindowsUpdate.log
2014-12-30 16:00 - 2013-12-29 19:37 - 00000000 ___DC () C:\AdwCleaner
2014-12-30 14:41 - 2013-12-30 22:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-29 09:33 - 2014-02-19 17:55 - 00000000 ____D () C:\Program Files\Avira
2014-12-29 09:21 - 2013-12-29 19:19 - 00000444 __RSH () C:\ProgramData\ntuser.pol
2014-12-29 09:04 - 2009-07-14 03:04 - 00000215 ____C () C:\Windows\system.ini
2014-12-29 08:35 - 2014-01-22 14:13 - 00000000 ____D () C:\Windows\erdnt
2014-12-29 08:31 - 2014-07-31 12:55 - 00001226 _____ () C:\Users\xx\Desktop\Revo Uninstaller.lnk
2014-12-29 08:31 - 2014-07-31 12:55 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-12-27 13:56 - 2014-01-09 22:27 - 00000000 ____D () C:\ProgramData\AVG
2014-12-27 13:49 - 2011-11-27 10:23 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-23 11:54 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-19 15:51 - 2014-03-16 17:19 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Winamp
2014-12-18 11:26 - 2014-11-04 17:40 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-12-18 11:26 - 2014-01-09 22:25 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-12-17 18:20 - 2013-08-04 22:29 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Spotify
2014-12-16 09:48 - 2012-09-22 20:29 - 00000970 _____ () C:\Users\xx\Desktop\Dropbox.lnk
2014-12-16 09:48 - 2012-09-22 20:28 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-15 20:21 - 2012-01-16 19:51 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Somacos
2014-12-11 11:48 - 2013-07-03 07:46 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-12-11 11:45 - 2014-05-07 06:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat
2014-12-11 09:26 - 2011-11-27 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-11 09:15 - 2013-07-30 06:47 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-11 09:07 - 2011-11-27 10:57 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-10 17:05 - 2013-07-03 07:46 - 00000000 ____D () C:\Users\xx\AppData\Roaming\FileZilla
2014-12-10 17:04 - 2013-07-03 07:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-12-10 16:20 - 2014-01-22 21:24 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-03 00:28 - 2012-05-08 17:56 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

Files to move or delete:
====================
C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job
C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job
C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job
C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job


Some content of TEMP:
====================
C:\Users\xx\AppData\Local\temp\avgnt.exe
C:\Users\xx\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpjsidp6.dll
C:\Users\xx\AppData\Local\temp\Quarantine.exe
C:\Users\xx\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-09-01 14:11

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Leider schließt sich der Windows-Explorer immer noch wenn ich bestimmte Ordner öffnen möchte. Ich hoffe, es gibt noch mehr Schritte zu tun.

Lieben Dank
Jo

schrauber · 31.12.2014, 16:18

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> {88CAA9A2-B68E-49FB-962C-536CE4F2F887} URL = hxxp://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=041513&q={searchTerms}&src=IE-SearchBox
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV=
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV="
CHR DefaultSearchKeyword: Default -> trovi.search
CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS
CHR DefaultSuggestURL: Default -> hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}
C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job
C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job
C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job
C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job
Task: {8AAE035D-A9CC-4B5C-9C50-B5189C6F81A6} - System32\Tasks\{A7244EDB-6CB7-4E28-89AA-8F7014BCA92A} => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe <==== ATTENTION
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Lade Dir bitte Windows Repair - All in one von tweaking.com hier herunter und installiere es.
Deaktiviere bitte (wenn möglich) Dein Antivirusprogramm.
Bedenke, dass die einzelnen Reparaturen einige Zeit benötigen. Starte keine anderen Anwendungen in dieser Zeit.
Starte das Programm und führe die Punkte 1-5 durch. (Siehe Bildanleitung)
Achte darauf, dass bei Dir die Häkchen so gesetzt sind wie unter Punkt 4.
Setze auch ein Häkchen bei "Restart/Shutdown System" und klicke "Restart System" an bevor Du Punkt 5 durchführst.

Josefine_Jo · 08.01.2015, 10:57

Hallo Schrauber,

ein schönes Neues Jahr - ich war unterwegs und hoffe, dass ich mein Laptop nun bald wieder zum Laufen bringe. Lieben Dank für Deine Hilfe.

Hier das neue Fixlog

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 07-01-2015
Ran by xx at 2015-01-08 10:38:39 Run:1
Running from C:\Users\xx\Desktop
Loaded Profile: xx (Available profiles: xx & xx)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> {88CAA9A2-B68E-49FB-962C-536CE4F2F887} URL = hxxp://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=041513&q={searchTerms}&src=IE-SearchBox
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV=
CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV="
CHR DefaultSearchKeyword: Default -> trovi.search
CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS
CHR DefaultSuggestURL: Default -> hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}
C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job
C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job
C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job
C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job
Task: {8AAE035D-A9CC-4B5C-9C50-B5189C6F81A6} - System32\Tasks\{A7244EDB-6CB7-4E28-89AA-8F7014BCA92A} => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe <==== ATTENTION
Emptytemp:
         
*****************

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{88CAA9A2-B68E-49FB-962C-536CE4F2F887}" => Key deleted successfully.
HKCR\CLSID\{88CAA9A2-B68E-49FB-962C-536CE4F2F887} => Key not found. 
Chrome HomePage deleted successfully.
Chrome StartupUrls deleted successfully.
Chrome DefaultSearchKeyword deleted successfully.
CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS => Error: No automatic fix found for this entry.
Chrome DefaultSuggestURL deleted successfully.
C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job => Moved successfully.
C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job => Moved successfully.
C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job => Moved successfully.
C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8AAE035D-A9CC-4B5C-9C50-B5189C6F81A6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8AAE035D-A9CC-4B5C-9C50-B5189C6F81A6}" => Key deleted successfully.
C:\Windows\System32\Tasks\{A7244EDB-6CB7-4E28-89AA-8F7014BCA92A} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A7244EDB-6CB7-4E28-89AA-8F7014BCA92A}" => Key deleted successfully.
EmptyTemp: => Removed 203.2 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 10:46:24 ====

schrauber · 08.01.2015, 11:32

Windows Repair gemacht? danach dann bitte ein frisches FRST Log und berichten, wie der Rechner läuft

Josefine_Jo · 08.01.2015, 13:25

Repair durchgeführt. Aber leider stürtzt der Explorer immer noch ab, wenn ich Ordner öffne. Hier das neue FRST Log

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-01-2015
Ran by xx (administrator) on xx-PC on 08-01-2015 13:18:33
Running from C:\Users\xx\Desktop
Loaded Profile: xx (Available profiles: xx & xx)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo) C:\Windows\System32\ibmpmsvc.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
() C:\Windows\System32\PSIService.exe
(Rocket Division Software) C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-27] (Microsoft Corporation)
IFEO\dropbox.exe: [Debugger] "C:\Program Files\AVG\AVG PC TuneUp\TUAutoReactivator32.exe"
Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\xx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://sslvpn.landtag-bw.de/dana-cached/sc/JuniperSetupClient.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=3 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=9 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\webde-suche.xml
FF Extension: Adblock Plus - C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]
FF Extension: Recorder Toolbar - C:\Program Files\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2014-12-02]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-02]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-11-28]

Chrome: 
=======
CHR DefaultSearchURL: Default -> hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=
CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS
CHR Profile: D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-13]
CHR Extension: (Google Docs) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-13]
CHR Extension: (Google Drive) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-13]
CHR Extension: (YouTube) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-13]
CHR Extension: (Google Cast) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-09-13]
CHR Extension: (Google-Suche) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-13]
CHR Extension: (Google Tabellen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-13]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2014-09-13]
CHR Extension: (Google Wallet) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-13]
CHR Extension: (Google Mail) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-13]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-11-28]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-10-27] (Freemake) [File not signed]
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [226624 2011-01-27] ()
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [1858360 2014-07-14] (AVG)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [35640 2014-07-14] (AVG)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 1394ohci; C:\Windows\system32\drivers\1394ohci.sys [164864 2010-11-20] (Microsoft Corporation) [File not signed]
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-11-24] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-01-08] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [16128 2014-04-11] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [67968 2014-04-11] (Silicon Laboratories)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2011-11-27] () [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-11-24] (Avira GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2013-12-16] (TuneUp Software)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579712 2009-12-01] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [543744 2009-12-01] (eMPIA Technology, Inc.)
U3 as80ik1i; C:\Windows\system32\Drivers\as80ik1i.sys [0 ] (Microsoft Corporation)
S3 catchme; \??\C:\Users\xx\AppData\Local\Temp\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-08 13:16 - 2015-01-08 13:16 - 00000000 ____D () C:\ProgramData\PCDr
2015-01-08 12:36 - 2015-01-08 12:36 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-xx-PC-Microsoft-Windows-7-Professional-(32-bit).dat
2015-01-08 12:35 - 2015-01-08 12:35 - 00000000 ___DC () C:\RegBackup
2015-01-08 11:51 - 2015-01-08 11:51 - 00003416 ____N () C:\bootsqm.dat
2015-01-08 11:00 - 2015-01-08 11:00 - 00002121 _____ () C:\Users\xx\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2015-01-08 10:59 - 2015-01-08 10:59 - 00000000 ___DC () C:\Program Files\Tweaking.com
2015-01-08 10:59 - 2015-01-08 10:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-01-08 10:58 - 2015-01-08 10:59 - 09817304 _____ () C:\Users\xx\Downloads\tweaking.com_windows_repair_aio_setup.exe
2015-01-08 10:37 - 2015-01-08 10:37 - 00000000 ____D () C:\Users\xx\Desktop\FRST-OlderVersion
2014-12-30 16:37 - 2014-12-30 16:37 - 01114624 _____ (Farbar) C:\Users\xx\Downloads\FRST(1).exe
2014-12-30 16:17 - 2014-12-30 16:17 - 00001256 _____ () C:\Users\xx\Desktop\JRT.txt
2014-12-30 16:10 - 2014-12-30 16:11 - 01707939 _____ (Thisisu) C:\Users\xx\Downloads\JRT.exe
2014-12-30 15:39 - 2014-12-30 15:39 - 02173952 _____ () C:\Users\xx\Downloads\AdwCleaner_4.106.exe
2014-12-30 14:42 - 2015-01-08 13:15 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-30 14:41 - 2014-12-30 14:41 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ___DC () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-30 14:41 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-30 14:41 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-30 14:41 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-30 14:40 - 2014-12-30 14:40 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xx\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-29 09:38 - 2014-12-29 09:36 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-12-29 09:36 - 2014-12-29 09:36 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Avira
2014-12-29 09:34 - 2014-12-29 09:34 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-12-29 09:33 - 2014-11-24 10:23 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-12-29 09:33 - 2014-11-24 10:23 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-12-29 09:33 - 2014-11-24 10:23 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-12-29 09:33 - 2014-11-24 10:23 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-12-29 09:29 - 2014-12-29 09:32 - 154051656 _____ () C:\Users\xx\Downloads\avira_free_antivirus_de.exe
2014-12-29 09:19 - 2014-12-29 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-29 09:18 - 2014-12-29 09:18 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av_5747036816__ws.exe
2014-12-29 09:16 - 2014-12-30 17:20 - 00000041 _____ () C:\Windows\Filzip.ini
2014-12-29 09:16 - 2014-12-29 09:22 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-29 09:13 - 2014-12-29 09:33 - 00000000 ____D () C:\ProgramData\Avira
2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws.exe
2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws(1).exe
2014-12-29 09:13 - 2014-12-29 09:13 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-29 09:08 - 2014-12-29 09:08 - 00021410 ____C () C:\ComboFix.txt
2014-12-29 08:48 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-29 08:48 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-29 08:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-29 08:35 - 2014-12-29 09:08 - 00000000 ___DC () C:\Qoobox
2014-12-29 08:34 - 2014-12-29 08:34 - 05603624 ____R (Swearware) C:\Users\xx\Desktop\ComboFix.exe
2014-12-29 08:30 - 2014-12-29 08:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\xx\Downloads\revosetup95.exe
2014-12-22 16:19 - 2014-12-22 16:21 - 00033386 _____ () C:\Users\xx\Downloads\Addition.txt
2014-12-22 16:15 - 2015-01-08 13:21 - 00017084 _____ () C:\Users\xx\Desktop\FRST.txt
2014-12-22 16:15 - 2015-01-08 13:18 - 00000000 ___DC () C:\FRST
2014-12-22 16:14 - 2015-01-08 10:37 - 01115648 ____C (Farbar) C:\Users\xx\Desktop\FRST.exe
2014-12-18 16:27 - 2015-01-08 13:05 - 00408376 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-18 10:44 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-15 20:21 - 2014-12-15 20:21 - 00001174 _____ () C:\Users\xx\Desktop\Mandatos 4.5.0.lnk
2014-12-15 20:14 - 2014-12-15 20:15 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208(1).msi
2014-12-15 19:46 - 2014-12-15 19:47 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208.msi
2014-12-11 11:45 - 2014-12-11 11:45 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-11 09:27 - 2014-12-11 09:27 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE(1).zip
2014-12-11 09:21 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-10 16:49 - 2014-12-10 16:50 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE.zip
2014-12-10 09:20 - 2014-12-04 05:38 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-10 09:20 - 2014-12-04 05:34 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-10 09:20 - 2014-12-02 00:28 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-10 09:20 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 09:20 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 09:20 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 09:20 - 2014-11-22 03:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 09:20 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 09:20 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 09:20 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 09:20 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 09:20 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 09:20 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 09:20 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 09:20 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 09:20 - 2014-11-22 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 09:20 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 09:20 - 2014-11-22 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 09:20 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 09:20 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 09:20 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 09:20 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 09:20 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 09:20 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 09:20 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 09:20 - 2014-11-22 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 09:20 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 09:20 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 09:20 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 09:20 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 09:20 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 09:20 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 09:20 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 09:20 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 09:19 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 09:19 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 09:19 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 09:19 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-08 13:17 - 2011-11-27 10:23 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-08 13:16 - 2011-11-27 10:44 - 00000466 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job
2015-01-08 13:15 - 2014-09-12 10:39 - 00109280 _____ () C:\Users\xx\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-08 13:14 - 2011-11-27 10:44 - 00000528 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2015-01-08 13:12 - 2011-11-27 10:12 - 01609117 _____ () C:\Windows\WindowsUpdate.log
2015-01-08 13:11 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-08 13:11 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-08 13:06 - 2014-11-10 11:12 - 00007349 _____ () C:\Windows\setupact.log
2015-01-08 13:06 - 2009-07-14 09:55 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-01-08 13:06 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-08 13:05 - 2014-11-14 17:03 - 00388260 _____ () C:\Windows\PFRO.log
2015-01-08 13:05 - 2009-07-14 09:55 - 00000000 ____D () C:\Windows\CSC
2015-01-08 10:49 - 2013-12-29 19:19 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2015-01-08 10:39 - 2009-07-14 03:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-12-30 19:18 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-30 16:12 - 2014-01-22 21:41 - 00000000 ____D () C:\Windows\ERUNT
2014-12-30 16:07 - 2012-09-22 20:06 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Dropbox
2014-12-30 16:04 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-12-30 16:00 - 2013-12-29 19:37 - 00000000 ___DC () C:\AdwCleaner
2014-12-30 14:41 - 2013-12-30 22:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-29 09:33 - 2014-02-19 17:55 - 00000000 ____D () C:\Program Files\Avira
2014-12-29 09:04 - 2009-07-14 03:04 - 00000215 ____C () C:\Windows\system.ini
2014-12-29 08:35 - 2014-01-22 14:13 - 00000000 ____D () C:\Windows\erdnt
2014-12-29 08:31 - 2014-07-31 12:55 - 00001226 _____ () C:\Users\xx\Desktop\Revo Uninstaller.lnk
2014-12-29 08:31 - 2014-07-31 12:55 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-12-27 13:56 - 2014-01-09 22:27 - 00000000 ____D () C:\ProgramData\AVG
2014-12-19 15:51 - 2014-03-16 17:19 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Winamp
2014-12-18 11:26 - 2014-11-04 17:40 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-12-18 11:26 - 2014-01-09 22:25 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-12-17 18:20 - 2013-08-04 22:29 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Spotify
2014-12-16 09:48 - 2012-09-22 20:29 - 00000970 _____ () C:\Users\xx\Desktop\Dropbox.lnk
2014-12-16 09:48 - 2012-09-22 20:28 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-15 20:21 - 2012-01-16 19:51 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Somacos
2014-12-11 11:48 - 2013-07-03 07:46 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-12-11 11:45 - 2014-05-07 06:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat
2014-12-11 09:26 - 2011-11-27 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-11 09:15 - 2013-07-30 06:47 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-11 09:07 - 2011-11-27 10:57 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-10 17:05 - 2013-07-03 07:46 - 00000000 ____D () C:\Users\xx\AppData\Roaming\FileZilla
2014-12-10 17:04 - 2013-07-03 07:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-12-10 16:20 - 2014-01-22 21:24 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

Some content of TEMP:
====================
C:\Users\xx\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-09-01 14:11

==================== End Of Log ============================

--- --- ---

schrauber · 08.01.2015, 17:01

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

FRST öffnen, Haken setzen bei Addition und scannen, poste bitte beide Logfiles.

Josefine_Jo · 08.01.2015, 19:44

Alles klar. Mache ich direkt. Was mir aufgefallen ist: Der Explorer stürzt hauptsächlich auf der Partition D ab.

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-01-2015
Ran by xx (administrator) on xx-PC on 08-01-2015 19:45:20
Running from C:\Users\xx\Desktop
Loaded Profile: xx (Available profiles: xx & xx)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo) C:\Windows\System32\ibmpmsvc.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
() C:\Windows\System32\PSIService.exe
(Rocket Division Software) C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
(Microsoft Corporation) C:\Windows\System32\schtasks.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\RunOnce: [Adobe Speed Launcher] => 1420742672
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-27] (Microsoft Corporation)
IFEO\dropbox.exe: [Debugger] "C:\Program Files\AVG\AVG PC TuneUp\TUAutoReactivator32.exe"
Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\xx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://sslvpn.landtag-bw.de/dana-cached/sc/JuniperSetupClient.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=3 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=9 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\webde-suche.xml
FF Extension: Adblock Plus - C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]
FF Extension: Recorder Toolbar - C:\Program Files\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2014-12-02]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-02]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-11-28]

Chrome: 
=======
CHR DefaultSearchURL: Default -> hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=
CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS
CHR Profile: D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-13]
CHR Extension: (Google Docs) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-13]
CHR Extension: (Google Drive) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-13]
CHR Extension: (YouTube) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-13]
CHR Extension: (Google Cast) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-09-13]
CHR Extension: (Google-Suche) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-13]
CHR Extension: (Google Tabellen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-13]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2014-09-13]
CHR Extension: (Google Wallet) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-13]
CHR Extension: (Google Mail) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-13]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-11-28]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-10-27] (Freemake) [File not signed]
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [226624 2011-01-27] ()
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [1858360 2014-07-14] (AVG)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [35640 2014-07-14] (AVG)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-11-24] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-01-08] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [16128 2014-04-11] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [67968 2014-04-11] (Silicon Laboratories)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2011-11-27] () [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-11-24] (Avira GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2013-12-16] (TuneUp Software)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579712 2009-12-01] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [543744 2009-12-01] (eMPIA Technology, Inc.)
U3 a4spxyav; C:\Windows\system32\Drivers\a4spxyav.sys [0 ] (Microsoft Corporation)
S3 catchme; \??\C:\Users\xx\AppData\Local\Temp\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-08 18:58 - 2015-01-08 18:58 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\18FF3EA4.sys
2015-01-08 13:30 - 2015-01-08 13:30 - 00000000 ____D () C:\Users\xx\AppData\Roaming\PCDr
2015-01-08 13:22 - 2015-01-08 13:23 - 00031767 _____ () C:\Users\xx\Desktop\Addition.txt
2015-01-08 13:16 - 2015-01-08 13:31 - 00000000 ____D () C:\ProgramData\PCDr
2015-01-08 12:36 - 2015-01-08 12:36 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-xx-PC-Microsoft-Windows-7-Professional-(32-bit).dat
2015-01-08 12:35 - 2015-01-08 12:35 - 00000000 ___DC () C:\RegBackup
2015-01-08 11:00 - 2015-01-08 11:00 - 00002121 _____ () C:\Users\xx\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2015-01-08 10:59 - 2015-01-08 10:59 - 00000000 ___DC () C:\Program Files\Tweaking.com
2015-01-08 10:59 - 2015-01-08 10:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-01-08 10:58 - 2015-01-08 10:59 - 09817304 _____ () C:\Users\xx\Downloads\tweaking.com_windows_repair_aio_setup.exe
2015-01-08 10:37 - 2015-01-08 10:37 - 00000000 ____D () C:\Users\xx\Desktop\FRST-OlderVersion
2014-12-30 16:37 - 2014-12-30 16:37 - 01114624 _____ (Farbar) C:\Users\xx\Downloads\FRST(1).exe
2014-12-30 16:17 - 2014-12-30 16:17 - 00001256 _____ () C:\Users\xx\Desktop\JRT.txt
2014-12-30 16:10 - 2014-12-30 16:11 - 01707939 _____ (Thisisu) C:\Users\xx\Downloads\JRT.exe
2014-12-30 15:39 - 2014-12-30 15:39 - 02173952 _____ () C:\Users\xx\Downloads\AdwCleaner_4.106.exe
2014-12-30 14:42 - 2015-01-08 19:41 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-30 14:41 - 2014-12-30 14:41 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ___DC () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-30 14:41 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-30 14:41 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-30 14:41 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-30 14:40 - 2014-12-30 14:40 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xx\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-29 09:38 - 2014-12-29 09:36 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-12-29 09:36 - 2014-12-29 09:36 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Avira
2014-12-29 09:34 - 2014-12-29 09:34 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-12-29 09:33 - 2014-11-24 10:23 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-12-29 09:33 - 2014-11-24 10:23 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-12-29 09:33 - 2014-11-24 10:23 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-12-29 09:33 - 2014-11-24 10:23 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-12-29 09:29 - 2014-12-29 09:32 - 154051656 _____ () C:\Users\xx\Downloads\avira_free_antivirus_de.exe
2014-12-29 09:19 - 2014-12-29 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-29 09:18 - 2014-12-29 09:18 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av_5747036816__ws.exe
2014-12-29 09:16 - 2014-12-30 17:20 - 00000041 _____ () C:\Windows\Filzip.ini
2014-12-29 09:16 - 2014-12-29 09:22 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-29 09:13 - 2014-12-29 09:33 - 00000000 ____D () C:\ProgramData\Avira
2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws.exe
2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws(1).exe
2014-12-29 09:13 - 2014-12-29 09:13 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-29 09:08 - 2014-12-29 09:08 - 00021410 ____C () C:\ComboFix.txt
2014-12-29 08:48 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-29 08:48 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-29 08:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-29 08:48 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-29 08:35 - 2014-12-29 09:08 - 00000000 ___DC () C:\Qoobox
2014-12-29 08:34 - 2014-12-29 08:34 - 05603624 ____R (Swearware) C:\Users\xx\Desktop\ComboFix.exe
2014-12-29 08:30 - 2014-12-29 08:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\xx\Downloads\revosetup95.exe
2014-12-22 16:19 - 2014-12-22 16:21 - 00033386 _____ () C:\Users\xx\Downloads\Addition.txt
2014-12-22 16:15 - 2015-01-08 19:46 - 00017262 _____ () C:\Users\xx\Desktop\FRST.txt
2014-12-22 16:15 - 2015-01-08 19:45 - 00000000 ___DC () C:\FRST
2014-12-22 16:14 - 2015-01-08 10:37 - 01115648 ____C (Farbar) C:\Users\xx\Desktop\FRST.exe
2014-12-18 16:27 - 2015-01-08 13:54 - 00408376 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-18 10:44 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-15 20:21 - 2014-12-15 20:21 - 00001174 _____ () C:\Users\xx\Desktop\Mandatos 4.5.0.lnk
2014-12-15 20:14 - 2014-12-15 20:15 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208(1).msi
2014-12-15 19:46 - 2014-12-15 19:47 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208.msi
2014-12-11 11:45 - 2014-12-11 11:45 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-11 09:27 - 2014-12-11 09:27 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE(1).zip
2014-12-11 09:21 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-10 16:49 - 2014-12-10 16:50 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE.zip
2014-12-10 09:20 - 2014-12-04 05:38 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-10 09:20 - 2014-12-04 05:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-10 09:20 - 2014-12-04 05:34 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-10 09:20 - 2014-12-02 00:28 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-10 09:20 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 09:20 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 09:20 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 09:20 - 2014-11-22 03:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 09:20 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 09:20 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 09:20 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 09:20 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 09:20 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 09:20 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 09:20 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 09:20 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 09:20 - 2014-11-22 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 09:20 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 09:20 - 2014-11-22 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 09:20 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 09:20 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 09:20 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 09:20 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 09:20 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 09:20 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 09:20 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 09:20 - 2014-11-22 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 09:20 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 09:20 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 09:20 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 09:20 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 09:20 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 09:20 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 09:20 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 09:20 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 09:19 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 09:19 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 09:19 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 09:19 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 09:19 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-08 19:44 - 2011-11-27 10:12 - 01619975 _____ () C:\Windows\WindowsUpdate.log
2015-01-08 19:39 - 2011-11-27 10:44 - 00000528 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2015-01-08 19:04 - 2009-07-14 05:34 - 00017136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-08 19:04 - 2009-07-14 05:34 - 00017136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-08 19:00 - 2011-11-27 10:23 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-08 18:55 - 2014-11-10 11:12 - 00007461 _____ () C:\Windows\setupact.log
2015-01-08 18:55 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-08 17:09 - 2013-08-04 22:29 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Spotify
2015-01-08 17:01 - 2014-09-13 10:11 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-08 14:23 - 2013-08-25 04:00 - 00000000 ____D () C:\Windows\rescache
2015-01-08 13:58 - 2014-10-17 21:27 - 00000000 ____D () C:\Temp
2015-01-08 13:58 - 2014-09-12 10:39 - 00109280 _____ () C:\Users\xx\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-08 13:54 - 2011-11-27 10:44 - 00000466 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job
2015-01-08 13:53 - 2014-11-14 17:03 - 00388614 _____ () C:\Windows\PFRO.log
2015-01-08 13:53 - 2009-07-14 09:55 - 00000000 ____D () C:\Windows\CSC
2015-01-08 13:06 - 2009-07-14 09:55 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-01-08 10:49 - 2013-12-29 19:19 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2015-01-08 10:39 - 2009-07-14 03:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-12-30 19:18 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-30 16:12 - 2014-01-22 21:41 - 00000000 ____D () C:\Windows\ERUNT
2014-12-30 16:07 - 2012-09-22 20:06 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Dropbox
2014-12-30 16:04 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-12-30 16:00 - 2013-12-29 19:37 - 00000000 ___DC () C:\AdwCleaner
2014-12-30 14:41 - 2013-12-30 22:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-29 09:33 - 2014-02-19 17:55 - 00000000 ____D () C:\Program Files\Avira
2014-12-29 09:04 - 2009-07-14 03:04 - 00000215 ____C () C:\Windows\system.ini
2014-12-29 08:35 - 2014-01-22 14:13 - 00000000 ____D () C:\Windows\erdnt
2014-12-29 08:31 - 2014-07-31 12:55 - 00001226 _____ () C:\Users\xx\Desktop\Revo Uninstaller.lnk
2014-12-29 08:31 - 2014-07-31 12:55 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-12-27 13:56 - 2014-01-09 22:27 - 00000000 ____D () C:\ProgramData\AVG
2014-12-19 15:51 - 2014-03-16 17:19 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Winamp
2014-12-18 11:26 - 2014-11-04 17:40 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-12-18 11:26 - 2014-01-09 22:25 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-12-16 09:48 - 2012-09-22 20:29 - 00000970 _____ () C:\Users\xx\Desktop\Dropbox.lnk
2014-12-16 09:48 - 2012-09-22 20:28 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-15 20:21 - 2012-01-16 19:51 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Somacos
2014-12-11 11:48 - 2013-07-03 07:46 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-12-11 11:45 - 2014-05-07 06:45 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat
2014-12-11 09:26 - 2011-11-27 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-11 09:15 - 2013-07-30 06:47 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-11 09:07 - 2011-11-27 10:57 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-10 17:05 - 2013-07-03 07:46 - 00000000 ____D () C:\Users\xx\AppData\Roaming\FileZilla
2014-12-10 17:04 - 2013-07-03 07:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-12-10 16:20 - 2014-01-22 21:24 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

Some content of TEMP:
====================
C:\Users\xx\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-08 14:15

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-01-2015
Ran by xx at 2015-01-08 19:47:22
Running from C:\Users\xx\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.43 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon MP3-Downloader 1.0.17 (HKLM\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Apple Application Support (HKLM\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)
ArcSoft ShowBiz (HKLM\...\{9D41D2EF-2D33-4CFD-8A3E-C7E6FCC3303B}) (Version:  - ArcSoft)
Ashampoo Burning Studio 14 v.14.0.5 (HKLM\...\{91B33C97-7BCF-CDFE-4321-58EBF3E8641C}_is1) (Version: 14.0.5 - Ashampoo GmbH & Co. KG)
Audacity 1.3.13 (Unicode) (HKLM\...\Audacity 1.3 Beta (Unicode)_is1) (Version:  - Audacity Team)
AudibleManager (HKLM\...\AudibleManager) (Version: 2004245216.48.56.22154610 - Audible, Inc.)
AVG PC TuneUp 2014 (de-DE) (Version: 14.0.1001.519 - AVG) Hidden
AVG PC TuneUp 2014 (HKLM\...\AVG PC TuneUp) (Version: 14.0.1001.519 - AVG)
AVG PC TuneUp 2014 (Version: 14.0.1001.519 - AVG) Hidden
Avira (HKLM\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
CCleaner (HKLM\...\CCleaner) (Version: 3.23 - Piriform)
ChromecastApp (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\{079ede36-133d-44b0-8053-c7c1fa8d2e0d}_is1) (Version: 1.5.316.0 - Google Inc.)
Deutsch - Custom (HKLM\...\{665DF8DD-C829-4DAB-A39C-9A0EF073F9F0}) (Version: 1.0.3.40 - Company)
Dropbox (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
FileZilla Client 3.9.0.6 (HKLM\...\FileZilla Client) (Version: 3.9.0.6 - Tim Kosse)
Filzip 3.06 (HKLM\...\Filzip 3.0.6.93_is1) (Version: 3.0.6 - Philipp Engel)
FormatFactory 3.1.1 (HKLM\...\FormatFactory) (Version: 3.1.1 - Free Time)
Freemake Video Converter Version 4.1.5 (HKLM\...\Freemake Video Converter_is1) (Version: 4.1.5 - Ellora Assets Corporation)
GIMP 2.8.4 (HKLM\...\GIMP-2_is1) (Version: 2.8.4 - The GIMP Team)
Google Chrome (HKLM\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Intel(R) TV Wizard (HKLM\...\TVWiz) (Version:  - Intel Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
Java 7 Update 65 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
KODAK Create@Home Software (für dm) (HKLM\...\{D42D2755-D8D7-43D4-8537-A21424CA15CD}) (Version: 7.6.1392 - Eastman Kodak Company)
Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5802.24 - PC-Doctor, Inc.)
LINE (HKLM\...\LINE) (Version: 3.7.0.34 - LINE Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Keyboard Layout Creator 1.4 (HKLM\...\{99E66BC9-E4B6-485F-ABFC-31EFCE36DFDF}) (Version: 1.4.6000 - Microsoft Corp.)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MotoHelper 2.0.45 Driver 5.0.0 (HKLM\...\MotoHelper) (Version: 2.0.45 - Motorola)
MotoHelper MergeModules (Version: 1.2.0 - Motorola) Hidden
Motorola Mobile Drivers Installation 5.0.0 (Version: 5.0.0 - Motorola Inc.) Hidden
Mozilla Firefox 34.0 (x86 de) (HKLM\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.1 - Mozilla)
Mozilla Thunderbird 31.3.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.3.0 (x86 de)) (Version: 31.3.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PDF24 Creator 5.2.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)
QuickTime (HKLM\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Somacos Mandatos (HKLM\...\{083263A0-7C2C-4A0F-BB1B-C9328D15BBED}) (Version: 4.5.0 - SOMACOS GmbH & Co. KG)
SparkleShare (HKLM\...\{184950D5-67F6-4D06-9717-7E2F1607A7B0}) (Version: 1.0.0 - SparkleShare)
Spotify (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)
StreamTransport version: 1.0.2.2171 (HKLM\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
ThinkPad Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.43 - )
TreeSize Free V2.7 (HKLM\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)
Tweaking.com - Windows Repair (All in One) (HKLM\...\Tweaking.com - Windows Repair (All in One)) (Version: 2.10.2 - Tweaking.com)
USB Video/Audio Device Driver (HKLM\...\{3717C4F2-7412-4793-9BB8-D73D2817B3D6}) (Version: 1.00.0000 - Ihr Firmenname)
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Winamp (HKLM\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports  (03/19/2014 6.7.0.0) (HKLM\...\B97004A400E30DCF940971EFA7A0C13C6B0A4B66) (Version: 03/19/2014 6.7.0.0 - Silicon Laboratories)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

08-01-2015 12:35:19 Tweaking.com - Windows Repair

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2014-12-29 09:04 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0885E870-83C3-4F12-A0BF-6FD45A2498FE} - \PCDoctorBackgroundMonitorTask No Task File <==== ATTENTION
Task: {2CB84D8E-D9D2-4359-956F-E473D828B94F} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-03-31] (PC-Doctor, Inc.)
Task: {36F211C8-7321-42D7-BDE1-810C22345365} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3209394106-3398393384-4106522146-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2011-11-08] (RealNetworks, Inc.)
Task: {5E8008A4-49B8-4B23-BE92-48CE97603B44} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-09-24] (Piriform Ltd)
Task: {64E0988E-9B9A-4EE9-918C-7B939239BBD4} - System32\Tasks\MotoHelper Initial Update => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-01-27] ()
Task: {7E5019A1-DAF8-41C0-9831-422BDDC64E04} - System32\Tasks\{F0566F61-5A90-4EF4-86D7-D7AC4D7A72BB} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: {832F7DE9-2342-469D-A014-337F65028019} - System32\Tasks\MT66 Software Update => C:\Program Files\Common Files\MT66 Software Update\UpdateClient.exe
Task: {882FA565-A9E1-444D-B23C-AF7AC99A4BE2} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3209394106-3398393384-4106522146-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2011-11-08] (RealNetworks, Inc.)
Task: {C09B71F7-C2F9-48CE-9E68-B4FC69B855FA} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {DA061B9D-4A6A-4956-BF03-CFF37A0A0C77} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-03-31] (PC-Doctor, Inc.)
Task: {F8674A3D-F331-4058-9BBF-68AAD48844F0} - System32\Tasks\{125248E9-6072-42A7-987B-521BBFA6112B} => pcalua.exe -a "C:\Program Files\Juniper Networks\Secure Application Manager\dsSamUI.exe" -d "C:\Program Files\Juniper Networks\Secure Application Manager" -c /Diagnostics

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AVG_REG_1213b.job => C:\ProgramData\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe
Task: C:\Windows\Tasks\AVG_SYS_TASK_DELETE.job => C:\ProgramData\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cff1b7fd95e51d.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0001f186f260e.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfcf34e5858b92.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfedc6350b29ae.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1d000b2c209d060.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Launch 8613.job => C:\Program Files\Audible\Bin\Manager.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\SidebarExecute.job => C:\Program Files\Windows Sidebar\sidebar.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files\AVG\AVG PC TuneUp\OneClick.exe

==================== Loaded Modules (whitelisted) =============

2011-01-27 22:13 - 2011-01-27 22:13 - 00226624 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
2007-06-05 13:20 - 2007-06-05 13:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe
2014-07-14 11:26 - 2014-07-14 11:26 - 00585528 _____ () C:\Program Files\AVG\AVG PC TuneUp\avgreplibx.dll
2014-07-14 11:26 - 2014-07-14 11:26 - 00357176 _____ () C:\Program Files\AVG\AVG PC TuneUp\tuavgx.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2011-01-27 22:13 - 2011-01-27 22:13 - 00673088 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
2014-12-02 14:18 - 2014-12-02 14:18 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-10-16 10:15 - 2014-10-16 10:15 - 00035328 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00091648 _____ () C:\Program Files\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00892416 _____ () C:\Program Files\FileZilla FTP Client\libstdc++-6.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^xx^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^xx^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupfolder: C:^Users^xx^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SparkleShare.lnk => C:\Windows\pss\SparkleShare.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
MSCONFIG\startupreg: OfficeSyncProcess => "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\xx\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-3209394106-3398393384-4106522146-500 - Administrator - Disabled)
xx (S-1-5-21-3209394106-3398393384-4106522146-1001 - Limited - Enabled) => C:\Users\xx
Gast (S-1-5-21-3209394106-3398393384-4106522146-501 - Limited - Disabled)
xx (S-1-5-21-3209394106-3398393384-4106522146-1000 - Administrator - Enabled) => C:\Users\xx

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/08/2015 07:43:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x10a8
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (01/08/2015 07:39:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xb50
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (01/08/2015 01:55:29 PM) (Source: .NET Runtime Optimization Service) (EventID: 1103) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:31:09:4200)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.button.text locale: PCDLocale: language = de, customer = lenovo, variant = ltt

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:31:09:4080)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.button.text locale: PCDLocale: language = en, customer = lenovo, variant = ltt

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:31:09:4060)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.body locale: PCDLocale: language = de, customer = lenovo, variant = ltt

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:31:09:4040)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.title locale: PCDLocale: language = de, customer = lenovo, variant = ltt

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:30:51:7150)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 447 getDirectoryContents(C:\ProgramData\PCDr\5802/performance) failed

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:30:51:6870)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 349 getDirectoryContents(C:\ProgramData\PCDr\5802/performance) failed

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:30:51:5870)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 447 getDirectoryContents(C:\ProgramData\PCDr\5802/smartdata) failed


System errors:
=============
Error: (01/08/2015 04:55:17 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/08/2015 02:31:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.

Error: (01/08/2015 02:31:36 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (01/08/2015 01:51:46 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (01/08/2015 01:48:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/08/2015 01:02:45 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (01/08/2015 00:59:41 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/08/2015 11:09:05 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.

Error: (01/08/2015 10:31:12 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.

Error: (12/31/2014 09:23:42 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Windows-Bilderfassung (WIA)" ist vom Dienst "Shellhardwareerkennung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058


Microsoft Office Sessions:
=========================
Error: (01/08/2015 07:43:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f10a801d02b7276e65c86C:\Windows\Explorer.EXEC:\Windows\system32\KERNELBASE.dll49ad2d96-9766-11e4-ba9e-0016d3cc412f

Error: (01/08/2015 07:39:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812fb5001d02b6cbf278a41C:\Windows\Explorer.EXEC:\Windows\system32\KERNELBASE.dllb0407cac-9765-11e4-ba9e-0016d3cc412f

Error: (01/08/2015 01:55:29 PM) (Source: .NET Runtime Optimization Service) (EventID: 1103) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:31:09:4200)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.button.text locale: PCDLocale: language = de, customer = lenovo, variant = ltt

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:31:09:4080)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.button.text locale: PCDLocale: language = en, customer = lenovo, variant = ltt

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:31:09:4060)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.body locale: PCDLocale: language = de, customer = lenovo, variant = ltt

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:31:09:4040)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.title locale: PCDLocale: language = de, customer = lenovo, variant = ltt

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:30:51:7150)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 447 getDirectoryContents(C:\ProgramData\PCDr\5802/performance) failed

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:30:51:6870)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 349 getDirectoryContents(C:\ProgramData\PCDr\5802/performance) failed

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )
Description: (2772) Asapi: (13:30:51:5870)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 447 getDirectoryContents(C:\ProgramData\PCDr\5802/smartdata) failed


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU L7300 @ 1.40GHz
Percentage of memory in use: 57%
Total physical RAM: 2006.3 MB
Available physical RAM: 844.88 MB
Total Pagefile: 4012.59 MB
Available Pagefile: 2390.28 MB
Total Virtual: 2047.88 MB
Available Virtual: 1919.76 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:58.5 GB) (Free:4.45 GB) NTFS
Drive d: (Volume) (Fixed) (Total:53.19 GB) (Free:3.92 GB) NTFS
Drive e: (ALI) (Removable) (Total:1.95 GB) (Free:0.18 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 97979797)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=58.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=53.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1.9 GB) (Disk ID: 221E5780)
Partition 1: (Active) - (Size=1.9 GB) - (Type=06)

==================== End Of Log ============================

schrauber · 08.01.2015, 20:43

WIndows Taste + R, schreibe CMD und drücke enter.
In CMD folgendes eintippen:

chkdsk D: /f /r

08.01.2015, 11:32	#11
schrauber /// the machine /// TB-Ausbilder	Windows-Explorer funktioniert nicht mehr Windows Repair gemacht? danach dann bitte ein frisches FRST Log und berichten, wie der Rechner läuft __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

08.01.2015, 20:43	#15
schrauber /// the machine /// TB-Ausbilder	Windows-Explorer funktioniert nicht mehr WIndows Taste + R, schreibe CMD und drücke enter. In CMD folgendes eintippen: chkdsk D: /f /r __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows-Explorer funktioniert nicht mehr

Plagegeister aller Art und deren Bekämpfung: Windows-Explorer funktioniert nicht mehr