Hallo!

Seit gestern ist mir zufällig aufgefallen, dass sich mein G Data Echtzeitschutz selbständig deaktiviert sobald man das Programm nicht minimiert in der Taskleiste geöffnet hat. Da ich dieses Problem nach jahrelanger positiver G Data Erfahrung noch niemals hatte, wurde ich stutzig und ließ mehrmals G Data Scans laufen. Diese fanden nichts. Auch der Windows defender lief ergebnislos.

Nachdem ich beunruhigt im Internet recherchierte stieß ich dort auf die Programme Spybot - search & destroy 2 und Malewarebytes Antimaleware die ich ebenfalls beide über mein System laufen ließ. Beide Logfiles dazu hänge ich an.

Desweiteren blieb auch ein Suchlauf mit dem G Data Bootmedium erfolglos.

Bisher sind mir bis auf die gravierende Fehlfunktion von G Data keine weiteren Defekte bewusst aufgefallen, allerdings bin ich jetzt sehr beunruhigt, da ich meinen PC auch für online-Bestellungen u.ä. nutze...

Anbei die vom Forum gewünschten Logfiles von Defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:47 on 11/04/2015 (Cheffa)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

von FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-04-2015
Ran by Cheffa (administrator) on POPOLOCOMPI on 11-04-2015 15:50:27
Running from C:\Users\Bunny\Desktop
Loaded Profiles: Cheffa & Bunny (Available profiles: Cheffa & Bunny)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G DATA\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\ScanWizard 5\ScannerFinder.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe
(G DATA Software AG) C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFirewallTray.exe
() C:\Windows\SysWOW64\PSIService.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(G Data Software AG) C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AvkBap64.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(G DATA Software AG) C:\Program Files (x86)\G DATA\InternetSecurity\GUI\GDSC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1855608 2015-02-20] (G DATA Software AG)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [434296 2015-02-20] (G Data Software AG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2015-03-17] (Malwarebytes Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3346787255-2282728226-2385673305-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\syswow64\GdScrSv.scr [2229880 2015-02-20] (G Data Software AG)
HKU\S-1-5-21-3346787255-2282728226-2385673305-1001\...\MountPoints2: {0927064b-f862-11e2-a904-0023ae2a505b} - F:\SISetup.exe
HKU\S-1-5-21-3346787255-2282728226-2385673305-1001\...\MountPoints2: {f1d6a553-5f94-11e1-9b06-0023ae2a505b} - G:\Menu.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Scanner Finder.lnk
ShortcutTarget: Scanner Finder.lnk -> C:\Program Files (x86)\ScanWizard 5\ScannerFinder.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Bunny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Cheffa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Cheffa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
HKU\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3346787255-2282728226-2385673305-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3346787255-2282728226-2385673305-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3346787255-2282728226-2385673305-1001 -> DefaultScope {75CE66E7-905C-4B04-8CA7-DD03E740E792} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3346787255-2282728226-2385673305-1001 -> {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKU\S-1-5-21-3346787255-2282728226-2385673305-1001 -> {75CE66E7-905C-4B04-8CA7-DD03E740E792} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3346787255-2282728226-2385673305-1001 -> {9D587077-5B20-4212-9213-11F57ED35626} URL = hxxp://de.wikipedia.org/wiki/Spezial:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-3346787255-2282728226-2385673305-1001 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC8} URL = hxxp://search.icq.com/search/results.php?q=%s&ch_id=hm&search_mode=web
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-28] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-28] (Oracle Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2015-02-19] (DVDVideoSoft Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-28] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-28] (Oracle Corporation)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2015-02-19] (DVDVideoSoft Ltd.)
DPF: HKLM-x32 {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.fujidirekt.de/ips-opdata/objects/jordan.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 134.96.7.100 134.96.7.99 134.96.7.5

FireFox:
========
FF ProfilePath: C:\Users\Cheffa\AppData\Roaming\Mozilla\Firefox\Profiles\nzyig67u.default
FF Homepage: about:home
FF Keyword.URL: 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-14] ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-28] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-28] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-14] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll [2013-06-26] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-28] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-28] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Cheffa\AppData\Roaming\Mozilla\Firefox\Profiles\nzyig67u.default\user.js [2015-04-10]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-10-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-10-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-10-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-10-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-10-25] (Apple Inc.)
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Cheffa\AppData\Roaming\Mozilla\Firefox\Profiles\nzyig67u.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-03-01]

Chrome: 
=======
CHR Profile: C:\Users\Cheffa\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe [2527864 2015-03-04] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [965240 2015-02-20] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKWCtlX64.exe [3672560 2015-04-07] (G Data Software AG)
R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2010-01-11] (Stardock Corporation) [File not signed]
R3 GDFwSvc; C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFwSvcx64.exe [3193080 2015-02-20] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe [789112 2015-03-04] (G Data Software AG)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [14848 2011-12-15] () [File not signed]
R2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [177704 2007-06-05] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-24] (AzureWave Technologies, Inc.)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S1 fanio; C:\Windows\system32\drivers\fanio.sys [22528 2007-02-16] (Christian Diefer) [File not signed]
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [150016 2015-04-01] (G Data Software AG)
R3 GDKBB; C:\Windows\system32\drivers\GDKBB64.sys [27648 2015-04-01] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2015-04-01] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [230400 2015-04-01] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [75776 2015-04-01] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64512 2015-04-09] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2015-04-09] (G Data Software)
R1 GRD; C:\Windows\SysWOW64\drivers\GRD.sys [106224 2011-02-14] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [124928 2015-04-01] (G Data Software AG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-10] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 mod7700; C:\Windows\System32\Drivers\dvb7700all.sys [913408 2009-10-21] (DiBcom) [File not signed]
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2010-10-14] (Marvell Semiconductor, Inc.)
R3 OA009Ufd; C:\Windows\System32\DRIVERS\OA009Ufd.sys [168864 2008-06-03] (Creative Technology Ltd.)
R3 OA009Vid; C:\Windows\System32\DRIVERS\OA009Vid.sys [307456 2008-08-25] (Creative Technology Ltd.)
S3 usbbus; C:\Windows\System32\DRIVERS\lgx64bus.sys [17920 2010-01-21] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgx64diag.sys [27648 2010-01-21] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgx64modem.sys [33280 2010-01-21] (LG Electronics Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 vpnva; system32\DRIVERS\vpnva64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-11 15:50 - 2015-04-11 15:51 - 00018558 _____ () C:\Users\Bunny\Desktop\FRST.txt
2015-04-11 15:49 - 2015-04-11 15:50 - 00000000 ____D () C:\FRST
2015-04-11 15:48 - 2015-04-11 15:48 - 02095616 _____ (Farbar) C:\Users\Bunny\Desktop\FRST64.exe
2015-04-11 15:46 - 2015-04-11 15:47 - 00000474 _____ () C:\Users\Bunny\Desktop\defogger_disable.log
2015-04-11 15:46 - 2015-04-11 15:46 - 00000000 _____ () C:\Users\Cheffa\defogger_reenable
2015-04-11 14:48 - 2015-04-11 14:48 - 00050477 _____ () C:\Users\Bunny\Desktop\Defogger.exe
2015-04-11 11:51 - 2013-08-21 17:29 - 00000851 _____ () C:\Windows\system32\Drivers\etc\hosts.20150411-115102.backup
2015-04-11 10:24 - 2015-04-11 11:28 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-04-11 10:24 - 2015-04-11 10:24 - 00001357 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-04-11 10:24 - 2015-04-11 10:24 - 00001345 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-04-11 10:24 - 2015-04-11 10:24 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-04-11 10:24 - 2015-04-11 10:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-04-11 10:24 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-04-11 10:23 - 2015-04-11 10:29 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-04-11 09:59 - 2015-04-11 09:59 - 00001755 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-04-11 09:59 - 2015-04-11 09:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-04-11 09:58 - 2015-04-11 09:59 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-04-11 09:58 - 2015-04-11 09:59 - 00000000 ____D () C:\Program Files\iTunes
2015-04-11 09:58 - 2015-04-11 09:58 - 00000000 ____D () C:\Program Files\iPod
2015-04-11 09:58 - 2015-04-11 09:58 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-04-10 10:56 - 2015-04-10 10:56 - 00003206 _____ () C:\Windows\System32\Tasks\{28603EC4-2BE5-4683-9E3F-84B97A8D6B88}
2015-04-10 09:07 - 2015-04-10 09:07 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-10 09:07 - 2015-04-10 09:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-10 09:07 - 2015-04-10 09:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-10 09:07 - 2015-04-10 09:07 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-04-10 09:07 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-10 09:07 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-10 09:07 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-09 08:20 - 2015-04-09 08:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY
2015-04-04 22:14 - 2015-04-04 22:14 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-04 22:14 - 2015-04-04 22:14 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-01 08:28 - 2015-04-01 08:28 - 00027648 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBB64.sys
2015-04-01 08:28 - 2015-04-01 08:28 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBB64_01007.Wdf
2015-03-25 16:31 - 2015-03-25 16:33 - 00000970 _____ () C:\Users\Bunny\FreeYTVDownloader.xml
2015-03-25 16:31 - 2015-03-25 16:31 - 00000008 _____ () C:\Users\Bunny\FreeYTVDownloader.xml.lck
2015-03-25 16:30 - 2015-03-25 16:32 - 00000238 _____ () C:\Users\Bunny\updhelper.xml
2015-03-25 16:30 - 2015-03-25 16:30 - 00000008 _____ () C:\Users\Bunny\updhelper.xml.lck
2015-03-25 09:32 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 09:32 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 09:32 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 09:32 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 09:32 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 09:32 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 09:32 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 09:32 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-11 15:46 - 2010-03-01 17:25 - 00000000 ____D () C:\Users\Cheffa
2015-04-11 15:07 - 2012-09-08 11:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-11 14:28 - 2010-03-01 16:49 - 01264218 _____ () C:\Windows\WindowsUpdate.log
2015-04-11 09:58 - 2013-11-05 16:23 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-04-11 08:40 - 2009-07-14 06:45 - 00024992 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-11 08:40 - 2009-07-14 06:45 - 00024992 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-11 08:39 - 2009-07-14 19:58 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2015-04-11 08:39 - 2009-07-14 19:58 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2015-04-11 08:39 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-11 08:33 - 2014-04-01 11:15 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-04-11 08:32 - 2013-03-14 21:49 - 00065961 _____ () C:\Windows\setupact.log
2015-04-11 08:32 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-10 09:49 - 2013-03-16 01:26 - 00110006 _____ () C:\Windows\PFRO.log
2015-04-10 09:47 - 2010-03-01 18:39 - 00000000 ____D () C:\Users\Bunny
2015-04-09 08:30 - 2012-06-27 21:48 - 00018160 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2015-04-09 08:30 - 2010-03-01 18:41 - 00106272 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2015-04-09 08:20 - 2014-08-13 15:53 - 00001940 _____ () C:\Users\Public\Desktop\G DATA INTERNET SECURITY.lnk
2015-04-09 08:20 - 2014-04-14 07:58 - 00018506 _____ () C:\Windows\DPINST.LOG
2015-04-09 08:20 - 2010-03-01 17:48 - 00064512 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2015-04-09 08:12 - 2014-12-14 19:09 - 00003858 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1418576956
2015-04-09 08:12 - 2010-03-01 19:09 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-04-05 08:33 - 2012-04-03 18:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-03 12:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-01 08:31 - 2010-05-07 13:48 - 00075776 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2015-04-01 08:28 - 2014-04-14 07:59 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2015-04-01 08:28 - 2012-05-07 14:28 - 00124928 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2015-04-01 08:28 - 2010-03-01 18:32 - 00150016 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2015-04-01 08:28 - 2010-03-01 17:49 - 00230400 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2015-03-30 15:46 - 2009-06-18 18:29 - 00000000 ____D () C:\Users\Bunny\Documents\Wichte Doc´s
2015-03-28 23:15 - 2014-02-25 09:45 - 01594964 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-03-26 09:09 - 2014-12-10 16:21 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 09:09 - 2014-05-06 22:57 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-22 16:19 - 2010-03-02 18:11 - 00000000 ____D () C:\Users\Bunny\AppData\Roaming\Skype
2015-03-21 09:40 - 2015-03-01 10:35 - 00000000 ____D () C:\Users\Bunny\Documents\DVDVideoSoft
2015-03-21 09:38 - 2013-11-09 15:26 - 00000000 ____D () C:\Users\Bunny\AppData\Roaming\DVDVideoSoft
2015-03-16 22:46 - 2012-10-10 17:14 - 00000000 ____D () C:\Users\Bunny\AppData\Roaming\vlc
2015-03-14 09:31 - 2014-10-15 10:50 - 00000000 ____D () C:\Users\Cheffa\AppData\Local\Adobe
2015-03-14 09:31 - 2012-09-08 11:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-14 09:31 - 2012-04-03 15:42 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-14 09:31 - 2011-05-13 16:56 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-12 12:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-03-12 09:15 - 2009-07-14 06:45 - 00332576 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-12 09:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-12 09:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism

==================== Files in the root of some directories =======

2013-08-26 11:47 - 2013-08-26 11:47 - 0049188 _____ () C:\Users\Cheffa\AppData\Roaming\Memory.dat
2013-08-28 13:22 - 2013-08-28 13:25 - 0026968 _____ () C:\Users\Cheffa\AppData\Local\HDGraph.log
2010-03-21 16:19 - 2013-08-26 12:48 - 0007638 _____ () C:\Users\Cheffa\AppData\Local\Resmon.ResmonCfg
2010-03-02 18:17 - 2010-03-02 18:17 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

Some content of TEMP:
====================
C:\Users\Bunny\AppData\Local\Temp\icqsetup.exe
C:\Users\Bunny\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Bunny\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Cheffa\AppData\Local\Temp\siinst.exe
C:\Users\Cheffa\AppData\Local\Temp\strings.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-04 20:06

==================== End Of Log ============================
         

von Addition.txt:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-04-2015
Ran by Cheffa at 2015-04-11 15:51:39
Running from C:\Users\Bunny\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: G DATA INTERNET SECURITY (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G DATA INTERNET SECURITY (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Flash Player 17 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.3.133 - Adobe Systems, Inc.)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version:  - )
Advanced Video FX Engine (HKLM-x32\...\Advanced Video FX Engine) (Version:  - )
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
calibre 64bit (HKLM\...\{1C6C05E6-FF52-4A03-BCA5-1497579B0B89}) (Version: 0.9.18 - Kovid Goyal)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Core Temp 1.0 RC4 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)
Defraggler (HKLM\...\Defraggler) (Version: 2.12 - Piriform)
Dell Dock (HKLM-x32\...\Dell Dock) (Version: 2.0 - Stardock Corporation)
Dell Dock (Version: 2.0 - Stardock Corporation) Hidden
Dell Webcam Center (HKLM-x32\...\Dell Webcam Center) (Version:  - )
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version:  - )
Dell Webcam Manager (HKLM-x32\...\Dell Webcam Manager) (Version:  - )
Free Audio CD Burner version 1.4 (HKLM-x32\...\Free Audio CD Burner_is1) (Version:  - DVDVideoSoft Limited.)
Free YouTube Download version 3.2.54.219 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.54.219 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.16.1030 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.16.1030 - DVDVideoSoft Ltd.)
G DATA INTERNET SECURITY (HKLM-x32\...\{AC68D2FF-1674-4C16-A536-A69FC11BBD82}) (Version: 25.1.0.3 - G DATA Software AG)
G Data InternetSecurity 2012 (HKLM-x32\...\{6006059E-013D-4B77-BC5C-4DD5E4A6570D}) (Version:  - )
GPL Ghostscript 8.71 (HKLM-x32\...\GPL Ghostscript 8.71) (Version:  - )
GSview 4.9 (HKLM-x32\...\GSview 4.9) (Version:  - )
HandBrake 0.9.8 (HKLM-x32\...\HandBrake) (Version: 0.9.8 - )
Integrated Webcam Driver (1.00.02.0825)   (HKLM\...\Creative OA009) (Version:  - )
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1029 - Intel Corporation)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Java SE Development Kit 7 Update 21 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170210}) (Version: 1.7.0.210 - Oracle)
Kobo (HKLM-x32\...\Kobo) (Version: 3.1.5 - Kobo Inc.)
LibreOffice 3.4 (HKLM-x32\...\{03CEFC42-378E-4467-9909-DCBAFD38CA9F}) (Version: 3.4.502 - LibreOffice)
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM-x32\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microtek FineReader OCR Engine (HKLM-x32\...\{345C90FB-FA10-11D5-9C2A-0080C85A0C2D}) (Version:  - )
Mozilla Firefox 37.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser und SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Müller Foto (HKLM-x32\...\Müller Foto) (Version: 5.1.6 - CEWE Stiftung u Co. KGaA)
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
OpenVPN 2.2.2 (HKLM-x32\...\OpenVPN) (Version: 2.2.2 - )
Opera 12.17 (HKLM-x32\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA)
Opera Stable 28.0.1750.51 (HKLM-x32\...\Opera 28.0.1750.51) (Version: 28.0.1750.51 - Opera Software ASA)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Saab 35 Draken 4.0a03 (HKU\S-1-5-21-3346787255-2282728226-2385673305-1000\...\Saab 35 Draken 4.0a03) (Version:  - )
Saab 35 Draken 4.0a03 (HKU\S-1-5-21-3346787255-2282728226-2385673305-1001\...\Saab 35 Draken 4.0a03) (Version:  - )
ScanWizard 5 (HKLM-x32\...\{B08D262E-D902-11D5-9C28-0080C85A0C2D}) (Version:  - )
Secure Download Manager (HKLM-x32\...\{AA57D6F1-6360-4397-B2D9-B21C69863D97}) (Version: 3.1.0 - Kivuto Solutions Inc.)
SIW 2011 Home Edition (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.2 - Sophos Limited)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)
WIDCOMM Bluetooth Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.0.9600 - Broadcom Corporation)
xp-AntiSpy 3.98-2 (HKLM-x32\...\xp-AntiSpy) (Version:  - Christian Taubenheim)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

ATTENTION: System Restore is disabled.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2015-04-11 11:51 - 00450794 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	localhost
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {17BEC384-2C16-4A7F-A265-0C1E6FB8B90C} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {2B641498-50AF-46D0-9E9D-9F99F00F7249} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2C39403A-26A2-4C75-85E3-9272CA8F07CF} - System32\Tasks\Opera scheduled Autoupdate 1418576956 => C:\Program Files (x86)\Opera\launcher.exe [2015-04-07] (Opera Software)
Task: {548F4CED-DE3B-4AAF-8899-9971A1407B88} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-14] (Adobe Systems Incorporated)
Task: {8723EE40-A9E0-4808-9B49-5F4483BE7E66} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {A127A2CA-4A3F-4355-9EB4-A8399F993891} - System32\Tasks\{E64B94F8-B309-4247-8AAD-D9580AD8EEB4} => pcalua.exe -a "C:\Program Files (x86)\WoA\WOAI Installer.exe" -d "C:\Program Files (x86)\WoA"
Task: {ACD0E36F-2133-4C6B-908F-5807DC22F6ED} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {B164CDFD-9547-4D00-8D84-35E3BEE3A9DF} - System32\Tasks\{DF3A14E1-6581-435A-AB93-2145A568A4B4} => pcalua.exe -a "C:\Program Files (x86)\Microsoft Games\Microsoft Flight Simulator X\Uninstal.exe"
Task: {CAF77CAF-1D42-4CBA-BCF4-02711D60B2BE} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {CC25FE8A-4B99-473D-A979-D9A4614A23B7} - System32\Tasks\{A59544DC-458D-49A2-A134-64E92BBA3766} => pcalua.exe -a "C:\Program Files (x86)\Microsoft Games\Flight Simulator 9\Uninstal_PT_Tu-154m_2.02.exe" -d "C:\Program Files (x86)\Microsoft Games\Flight Simulator 9"
Task: {CDA280BF-D4D5-4E39-8DDB-DEC8AD4EE908} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {D2FF1936-2190-40D0-9FEA-1F6B96E1B252} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {D900CE43-5DAB-4ACB-99CD-86AFF88D7EA9} - System32\Tasks\Advanced System Protector => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
Task: {D9C60183-2C38-405A-8ED4-4301C22E6CB4} - System32\Tasks\{F5C8B4CD-B7C4-4A4E-93DE-545532CFECD3} => pcalua.exe -a "C:\Program Files (x86)\Microsoft Games\Flight Simulator 9\UNINSTAL.EXE" -c /runtemp /addremove
Task: {E936025F-D2F2-45E8-A8BC-B7B37891F1EA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {FA9094C3-BB21-4703-8C95-44DB2AF3169D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {FB7D6331-11BB-468B-B566-508EDBB88DCE} - System32\Tasks\{28603EC4-2BE5-4683-9E3F-84B97A8D6B88} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files (x86)\G DATA\InternetSecurity\AVK\BootCDWizard.exe"
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2013-07-29 17:55 - 2010-10-14 10:05 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL
2009-07-01 19:54 - 2009-07-01 19:54 - 00173344 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2010-03-17 19:43 - 2008-03-21 14:16 - 00344064 _____ () C:\Program Files (x86)\ScanWizard 5\ScannerFinder.exe
2014-10-16 12:31 - 2014-10-16 12:31 - 00472576 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_64\VistaBridgeLibrary\e518b17c5e71c048e9a4c7314a9e37e8\VistaBridgeLibrary.ni.dll
2007-06-05 14:20 - 2007-06-05 14:20 - 00177704 _____ () C:\Windows\SysWOW64\PSIService.exe
2015-02-20 05:42 - 2015-02-20 05:42 - 00382072 ____N () C:\Program Files (x86)\Common Files\G DATA\AVKProxy\PktIcpt2x64.dll
2011-03-04 13:49 - 2011-03-04 13:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2010-03-17 19:43 - 2007-01-05 15:05 - 00249856 _____ () C:\Program Files (x86)\ScanWizard 5\SFRes.dll
2015-04-11 10:24 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-04-11 10:24 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-04-11 10:24 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-04-11 10:24 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-04-11 10:24 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3346787255-2282728226-2385673305-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Cheffa\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-3346787255-2282728226-2385673305-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Bunny\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 134.96.7.100 - 134.96.7.99

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: DELL Webcam Manager => "C:\Program Files (x86)\Dell\Dell Webcam Manager\DellWMgr.exe" /s

==================== Accounts: =============================

Administrator (S-1-5-21-3346787255-2282728226-2385673305-500 - Administrator - Disabled)
Bunny (S-1-5-21-3346787255-2282728226-2385673305-1001 - Limited - Enabled) => C:\Users\Bunny
Cheffa (S-1-5-21-3346787255-2282728226-2385673305-1000 - Administrator - Enabled) => C:\Users\Cheffa
Gast (S-1-5-21-3346787255-2282728226-2385673305-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3346787255-2282728226-2385673305-1006 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/10/2015 06:11:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cvpnd.exe, Version: 0.0.0.0, Zeitstempel: 0x4d714093
Name des fehlerhaften Moduls: cvpnd.exe, Version: 0.0.0.0, Zeitstempel: 0x4d714093
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000484b3
ID des fehlerhaften Prozesses: 0x7d4
Startzeit der fehlerhaften Anwendung: 0xcvpnd.exe0
Pfad der fehlerhaften Anwendung: cvpnd.exe1
Pfad des fehlerhaften Moduls: cvpnd.exe2
Berichtskennung: cvpnd.exe3

Error: (04/10/2015 06:10:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cvpnd.exe, Version: 0.0.0.0, Zeitstempel: 0x4d714093
Name des fehlerhaften Moduls: cvpnd.exe, Version: 0.0.0.0, Zeitstempel: 0x4d714093
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000484b3
ID des fehlerhaften Prozesses: 0x798
Startzeit der fehlerhaften Anwendung: 0xcvpnd.exe0
Pfad der fehlerhaften Anwendung: cvpnd.exe1
Pfad des fehlerhaften Moduls: cvpnd.exe2
Berichtskennung: cvpnd.exe3

Error: (04/08/2015 09:35:48 PM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Can not connect to Process Manager (0)

Error: (04/01/2015 08:28:16 AM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Can not connect to Process Manager (0)

Error: (04/01/2015 08:28:16 AM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Can not connect to Process Manager (0)

Error: (04/01/2015 08:28:16 AM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Can not connect to Process Manager (0)

Error: (04/01/2015 08:28:16 AM) (Source: GDFwSvc) (EventID: 0) (User: )
Description: Can not connect to Process Manager (0)

Error: (04/01/2015 08:28:16 AM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden:

Error: (02/20/2015 08:50:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iTunes.exe, Version: 12.1.0.71, Zeitstempel: 0x54c76235
Name des fehlerhaften Moduls: objc.dll, Version: 1.528.0.126, Zeitstempel: 0x54940801
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000020d8c
ID des fehlerhaften Prozesses: 0xe98
Startzeit der fehlerhaften Anwendung: 0xiTunes.exe0
Pfad der fehlerhaften Anwendung: iTunes.exe1
Pfad des fehlerhaften Moduls: iTunes.exe2
Berichtskennung: iTunes.exe3

Error: (02/20/2015 08:50:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iTunes.exe, Version: 12.1.0.71, Zeitstempel: 0x54c76235
Name des fehlerhaften Moduls: objc.dll, Version: 1.528.0.126, Zeitstempel: 0x54940801
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000020d8c
ID des fehlerhaften Prozesses: 0xe98
Startzeit der fehlerhaften Anwendung: 0xiTunes.exe0
Pfad der fehlerhaften Anwendung: iTunes.exe1
Pfad des fehlerhaften Moduls: iTunes.exe2
Berichtskennung: iTunes.exe3


System errors:
=============
Error: (04/11/2015 08:33:38 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (04/11/2015 08:32:36 AM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active

Error: (04/11/2015 08:32:36 AM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (04/11/2015 08:31:34 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (04/11/2015 08:04:00 AM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active

Error: (04/11/2015 08:04:00 AM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (04/10/2015 08:10:44 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (04/10/2015 08:08:47 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (04/10/2015 08:07:21 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active

Error: (04/10/2015 08:07:21 PM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter


Microsoft Office Sessions:
=========================
Error: (07/14/2011 01:49:58 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 16 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2015-04-11 08:32:29.065
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\fanio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-11 08:32:28.956
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\fanio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-11 08:03:54.408
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\fanio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-11 08:03:54.284
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\fanio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-10 20:07:15.112
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\fanio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-10 20:07:14.987
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\fanio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-10 18:12:54.268
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\fanio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-10 18:12:54.143
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\fanio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-10 18:11:29.128
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\fanio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-04-10 18:11:29.003
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\fanio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz
Percentage of memory in use: 59%
Total physical RAM: 4092.36 MB
Available physical RAM: 1641.3 MB
Total Pagefile: 8182.9 MB
Available Pagefile: 4637.51 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:283.4 GB) (Free:162.46 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:13.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 4ED1AC6F)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=14.6 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=283.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

von Gmer.log:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-04-11 16:20:16
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST932032 rev.0002 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Cheffa\AppData\Local\Temp\kxldrkog.sys


---- Registry - GMER 2.1 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00242cb1f1af                                                
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00242cb1f1af@c8979fc282b4                                   0x08 0xA1 0x3E 0x51 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00242cb1f1af@a8e018290000                                   0x64 0x85 0x3C 0xD5 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00242cb1f1af@88c6633cc97f                                   0x82 0x04 0xA1 0xCB ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00242cb1f1af@d89e3fbd92f3                                   0x9A 0xE6 0xDB 0x02 ...
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00242cb1f1af (not active ControlSet)                            
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00242cb1f1af@c8979fc282b4                                       0x08 0xA1 0x3E 0x51 ...
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00242cb1f1af@a8e018290000                                       0x64 0x85 0x3C 0xD5 ...
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00242cb1f1af@88c6633cc97f                                       0x82 0x04 0xA1 0xCB ...
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00242cb1f1af@d89e3fbd92f3                                       0x9A 0xE6 0xDB 0x02 ...
Reg  HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\temp\aulauncher.exe  1

---- EOF - GMER 2.1 ----
         

sowie auch noch die meiner eigenen Suchläufe mit Spybot:

Search results from Spybot - Search & Destroy

11.04.2015 11:48:57
Scan took 00:50:42.
107 items found.

Systweak.AdvSysProtector: [SBI $21192D7E] Program directory (Directory, nothing done)
  C:\Program Files (x86)\Advanced System Protector\

SweetIM: [SBI $8780104D]  Link (File, nothing done)
  C:\Users\Cheffa\Desktop\Search the Web.url
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\audienceinsights.net\pus.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\blackbird.zoomin.tv\flashCookie.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\de-ipd.cdn.videoplaza.tv\com.videoplaza.adplayer.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\de-ipd.cdn.videoplaza.tv\com.videoplaza.bootloader.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\de-ipd.cdn.videoplaza.tv\se.videoplaza.kit.adplayer.adplayer.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\eu.hcdn.co\com.longtailvideo.jwplayer.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\f.vimeocdn.com\com.conviva.livePass.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\images-na.ssl-images-amazon.com\mercury.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\p.jwpcdn.com\com.longtailvideo.jwplayer.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\s.ytimg.com\soundData.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\secureinclude.ebaystatic.com\ebayLSO.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\secureinclude.ebaystatic.com\ebayT.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\static.wix.com\WixComputerID.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\www.dailymotion.com\com.dm.player.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\www.paypalobjects.com\PayPalLSO.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\www.paypalobjects.com\ppLsoTest.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\www.spiegel.de\BandwidthCache.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\www.tape.tv\OVPMetricsProvider.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\www.videonest.net\com.longtailvideo.jwplayer.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Cheffa\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\QQPYLGTM\images-na.ssl-images-amazon.com\mercury.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750]  Text file (File, nothing done)
  C:\Users\Cheffa\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\QQPYLGTM\s.ytimg.com\soundData.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\aa.online-metrix.net\fpc.swf\session.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\skype.com\#ui\preferences.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\static.sockshare.com\video_player.swf\org.flowplayer.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\Cheffa\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\QQPYLGTM\skype.com\#ui\preferences.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $1EF45977]  Text file (File, nothing done)
  C:\Users\Cheffa\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\QQPYLGTM\www.todohomepage.com\index1.swf\ToDo.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\files.muzu.tv\flash\videoplayer_2.swf\muzuprefs.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\heias.com\x\heias_sc.swf\heias.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\Bunny\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PJVVCPGB\www.n24.de\_swf\HomePlayer.swf\playerAdData.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7]  Text file (File, nothing done)
  C:\Users\Cheffa\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\QQPYLGTM\embed.wistia.com\flash\embed_player_v2.0.swf\settings.sol
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E

MediaPlex: [SBI $4E2AF2AC] Tracking cookie (Internet Explorer (Inaktive Benutzer): Bunny) (Browser: Cookie, nothing done)
  

DoubleClick: [SBI $4E2AF2AC] Tracking cookie (Internet Explorer (Inaktive Benutzer): Bunny) (Browser: Cookie, nothing done)
  

Right Media: [SBI $4E2AF2AC] Tracking cookie (Internet Explorer (Inaktive Benutzer): Bunny) (Browser: Cookie, nothing done)
  

MediaPlex: [SBI $4E2AF2AC] Tracking cookie (Internet Explorer (Inaktive Benutzer): Bunny) (Browser: Cookie, nothing done)
  

CasaleMedia: [SBI $4E2AF2AC] Tracking cookie (Internet Explorer (Inaktive Benutzer): Bunny) (Browser: Cookie, nothing done)
  

DoubleClick: [SBI $4E2AF2AC] Tracking cookie (Firefox: Cheffa (default)) (Browser: Cookie, nothing done)
  

DoubleClick: [SBI $4E2AF2AC] Tracking cookie (Firefox: Bunny (default)) (Browser: Cookie, nothing done)
  

DoubleClick: [SBI $4E2AF2AC] Tracking cookie (Firefox: Bunny (default)) (Browser: Cookie, nothing done)
  

WebTrends live: [SBI $4E2AF2AC] Tracking cookie (Firefox: Bunny (default)) (Browser: Cookie, nothing done)
  

Statcounter: [SBI $4E2AF2AC] Tracking cookie (Firefox: Bunny (default)) (Browser: Cookie, nothing done)
  

Statcounter: [SBI $4E2AF2AC] Tracking cookie (Firefox: Bunny (default)) (Browser: Cookie, nothing done)
  

DoubleClick: [SBI $4E2AF2AC] Tracking cookie (Firefox: Bunny (default)) (Browser: Cookie, nothing done)
  

DoubleClick: [SBI $4E2AF2AC] Tracking cookie (Firefox: Bunny (default)) (Browser: Cookie, nothing done)
  

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Microsoft Management Console\Recent File List

MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Microsoft Management Console\Recent File List

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS Office 12.0: [SBI $31A61065] Internet history (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Office\12.0\Common\Internet\UseRWHlinkNavigation

MS Office 12.0: [SBI $31A61065] Internet history (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Office\12.0\Common\Internet\UseRWHlinkNavigation

MS Office 12.0 (Access): [SBI $5FED5527] Recent Used DB Date #1 (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Office\12.0\Access\Settings\MRUDate1

MS Office 12.0 (Excel): [SBI $546355D5] Recent Cartel List (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Office\12.0\Excel\File MRU

MS Office 12.0 (PowerPoint): [SBI $242E8728] Recent Slideshow List (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Office\12.0\PowerPoint\File MRU

MS Office 12.0 (Word): [SBI $E357B233] Recent Document List (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Office\12.0\Word\File MRU

MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

Windows: [SBI $A05E8135] Install locations (Registry Key, nothing done)
  HKEY_USERS\.DEFAULT\InstallLocationsMRU

Windows: [SBI $A05E8135] Install locations (Registry Key, nothing done)
  HKEY_USERS\S-1-5-18\InstallLocationsMRU

Windows.OpenWith: [SBI $1563C37F] Open with list - .ADR extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADR\OpenWithList

Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList

Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows.OpenWith: [SBI $9E8D5C8A] Open with list - .CDA extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList

Windows.OpenWith: [SBI $99432203] Open with list - .CFG extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CFG\OpenWithList

Windows.OpenWith: [SBI $99432203] Open with list - .CFG extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CFG\OpenWithList

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1000\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-3346787255-2282728226-2385673305-1001\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Cookie: [SBI $49804B54] Browser: Cookie (5) (Browser: Cookie, nothing done)
  

Cache: [SBI $49804B54] Browser: Cache (596) (Browser: Cache, nothing done)
  

Verlauf: [SBI $49804B54] Browser: History (10) (Browser: History, nothing done)
  

Cookie: [SBI $49804B54] Browser: Cookie (104) (Browser: Cookie, nothing done)
  

Cache: [SBI $49804B54] Browser: Cache (2) (Browser: Cache, nothing done)
  

Verlauf: [SBI $49804B54] Browser: History (2) (Browser: History, nothing done)
  

Cookie: [SBI $49804B54] Browser: Cookie (1) (Browser: Cookie, nothing done)
  

Verlauf: [SBI $49804B54] Browser: History (44) (Browser: History, nothing done)
  

Cookie: [SBI $49804B54] Browser: Cookie (1) (Browser: Cookie, nothing done)
  

Verlauf: [SBI $49804B54] Browser: History (2) (Browser: History, nothing done)
  

Cookie: [SBI $49804B54] Browser: Cookie (25) (Browser: Cookie, nothing done)
  

Cookie: [SBI $49804B54] Browser: Cookie (2566) (Browser: Cookie, nothing done)
  


--- Spybot - Search & Destroy version: 2.4.40.131  DLL (build: 20140425) ---

2014-06-24 blindman.exe (2.4.40.151)
2014-06-24 explorer.exe (2.4.40.181)
2014-06-24 SDBootCD.exe (2.4.40.109)
2014-06-24 SDCleaner.exe (2.4.40.110)
2014-06-24 SDDelFile.exe (2.4.40.94)
2013-06-18 SDDisableProxy.exe
2014-06-24 SDFiles.exe (2.4.40.135)
2014-06-24 SDFileScanHelper.exe (2.4.40.1)
2014-06-24 SDFSSvc.exe (2.4.40.217)
2014-06-24 SDHelp.exe (2.4.40.1)
2014-04-25 SDHookHelper.exe (2.3.39.2)
2014-04-25 SDHookInst32.exe (2.3.39.2)
2014-04-25 SDHookInst64.exe (2.3.39.2)
2014-06-24 SDImmunize.exe (2.4.40.130)
2014-06-24 SDLogReport.exe (2.4.40.107)
2014-06-24 SDOnAccess.exe (2.4.40.11)
2014-06-24 SDPESetup.exe (2.4.40.3)
2014-06-24 SDPEStart.exe (2.4.40.86)
2014-06-24 SDPhoneScan.exe (2.4.40.28)
2014-06-24 SDPRE.exe (2.4.40.22)
2014-06-24 SDPrepPos.exe (2.4.40.15)
2014-06-24 SDQuarantine.exe (2.4.40.103)
2014-06-24 SDRootAlyzer.exe (2.4.40.116)
2014-06-24 SDSBIEdit.exe (2.4.40.39)
2014-06-24 SDScan.exe (2.4.40.181)
2014-06-24 SDScript.exe (2.4.40.54)
2014-06-24 SDSettings.exe (2.4.40.139)
2014-06-24 SDShell.exe (2.4.40.2)
2014-06-24 SDShred.exe (2.4.40.108)
2014-06-24 SDSysRepair.exe (2.4.40.102)
2014-06-24 SDTools.exe (2.4.40.157)
2014-06-24 SDTray.exe (2.4.40.129)
2014-06-27 SDUpdate.exe (2.4.40.94)
2014-06-27 SDUpdSvc.exe (2.4.40.77)
2014-06-24 SDWelcome.exe (2.4.40.130)
2014-04-25 SDWSCSvc.exe (2.3.39.2)
2014-05-20 spybotsd2-install-bdcore-update.exe (2.3.39.0)
2014-07-31 spybotsd2-translation-esx.exe
2013-06-19 spybotsd2-translation-frx.exe
2014-08-25 spybotsd2-translation-hux2.exe
2014-10-01 spybotsd2-translation-nlx2.exe
2014-11-05 spybotsd2-translation-ukx.exe
2015-04-11 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2014-04-25 NotificationSpreader.dll
2014-06-24 SDAdvancedCheckLibrary.dll (2.4.40.98)
2014-04-25 SDAV.dll
2014-06-24 SDECon32.dll (2.4.40.114)
2014-06-24 SDECon64.dll (2.3.39.113)
2014-06-24 SDEvents.dll (2.4.40.2)
2014-06-24 SDFileScanLibrary.dll (2.4.40.14)
2014-04-25 SDHook32.dll (2.3.39.2)
2014-04-25 SDHook64.dll (2.3.39.2)
2014-06-24 SDImmunizeLibrary.dll (2.4.40.2)
2014-06-24 SDLicense.dll (2.4.40.0)
2014-06-24 SDLists.dll (2.4.40.4)
2014-06-24 SDResources.dll (2.4.40.7)
2014-06-24 SDScanLibrary.dll (2.4.40.131)
2014-06-24 SDTasks.dll (2.4.40.15)
2014-06-24 SDWinLogon.dll (2.4.40.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2014-06-24 Tools.dll (2.4.40.36)
2014-03-05 Includes\Adware-000.sbi (*)
2015-02-27 Includes\Adware-001.sbi (*)
2015-04-08 Includes\Adware-C.sbi (*)
2014-01-13 Includes\Adware.sbi (*)
2014-01-13 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2014-11-14 Includes\Dialer-000.sbi (*)
2014-11-14 Includes\Dialer-001.sbi (*)
2014-01-08 Includes\Dialer-C.sbi (*)
2014-01-13 Includes\Dialer.sbi (*)
2014-01-13 Includes\DialerC.sbi (*)
2014-01-09 Includes\Fraud-000.sbi (*)
2014-01-09 Includes\Fraud-001.sbi (*)
2014-03-31 Includes\Fraud-002.sbi (*)
2014-01-09 Includes\Fraud-003.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2014-11-14 Includes\Hijackers-000.sbi (*)
2014-11-14 Includes\Hijackers-001.sbi (*)
2014-01-08 Includes\Hijackers-C.sbi (*)
2014-01-13 Includes\Hijackers.sbi (*)
2014-01-13 Includes\HijackersC.sbi (*)
2014-01-08 Includes\iPhone-000.sbi (*)
2014-01-08 Includes\iPhone.sbi (*)
2014-11-14 Includes\Keyloggers-000.sbi (*)
2014-09-24 Includes\Keyloggers-C.sbi (*)
2014-01-13 Includes\Keyloggers.sbi (*)
2014-01-13 Includes\KeyloggersC.sbi (*)
2014-11-14 Includes\Malware-000.sbi (*)
2014-11-14 Includes\Malware-001.sbi (*)
2014-11-14 Includes\Malware-002.sbi (*)
2014-11-14 Includes\Malware-003.sbi (*)
2014-11-14 Includes\Malware-004.sbi (*)
2014-11-14 Includes\Malware-005.sbi (*)
2014-02-26 Includes\Malware-006.sbi (*)
2014-01-09 Includes\Malware-007.sbi (*)
2015-03-31 Includes\Malware-C.sbi (*)
2014-01-13 Includes\Malware.sbi (*)
2013-12-23 Includes\MalwareC.sbi (*)
2014-11-14 Includes\PUPS-000.sbi (*)
2014-01-15 Includes\PUPS-001.sbi (*)
2014-01-15 Includes\PUPS-002.sbi (*)
2015-04-07 Includes\PUPS-C.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2014-01-07 Includes\PUPSC.sbi (*)
2014-01-08 Includes\Security-000.sbi (*)
2014-01-08 Includes\Security-C.sbi (*)
2014-01-21 Includes\Security.sbi (*)
2014-01-21 Includes\SecurityC.sbi (*)
2014-11-14 Includes\Spyware-000.sbi (*)
2014-12-10 Includes\Spyware-001.sbi (*)
2015-01-14 Includes\Spyware-C.sbi (*)
2014-01-21 Includes\Spyware.sbi (*)
2014-01-21 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2014-01-15 Includes\Trojans-000.sbi (*)
2014-01-15 Includes\Trojans-001.sbi (*)
2014-11-14 Includes\Trojans-002.sbi (*)
2014-01-15 Includes\Trojans-003.sbi (*)
2014-01-15 Includes\Trojans-004.sbi (*)
2014-03-19 Includes\Trojans-005.sbi (*)
2015-03-31 Includes\Trojans-006.sbi (*)
2014-01-15 Includes\Trojans-007.sbi (*)
2014-07-09 Includes\Trojans-008.sbi (*)
2014-07-09 Includes\Trojans-009.sbi (*)
2015-04-07 Includes\Trojans-C.sbi (*)
2014-01-15 Includes\Trojans-OG-000.sbi (*)
2014-01-15 Includes\Trojans-TD-000.sbi (*)
2014-01-15 Includes\Trojans-VM-000.sbi (*)
2014-01-15 Includes\Trojans-VM-001.sbi (*)
2014-01-15 Includes\Trojans-VM-002.sbi (*)
2014-01-15 Includes\Trojans-VM-003.sbi (*)
2014-01-15 Includes\Trojans-VM-004.sbi (*)
2014-01-15 Includes\Trojans-VM-005.sbi (*)
2014-01-15 Includes\Trojans-VM-006.sbi (*)
2014-01-15 Includes\Trojans-VM-007.sbi (*)
2014-01-15 Includes\Trojans-VM-008.sbi (*)
2014-01-15 Includes\Trojans-VM-009.sbi (*)
2014-01-15 Includes\Trojans-VM-010.sbi (*)
2014-01-15 Includes\Trojans-VM-011.sbi (*)
2014-01-15 Includes\Trojans-VM-012.sbi (*)
2014-01-15 Includes\Trojans-VM-013.sbi (*)
2014-01-15 Includes\Trojans-VM-014.sbi (*)
2014-01-15 Includes\Trojans-VM-015.sbi (*)
2014-01-15 Includes\Trojans-VM-016.sbi (*)
2014-01-15 Includes\Trojans-VM-017.sbi (*)
2014-01-15 Includes\Trojans-VM-018.sbi (*)
2014-01-15 Includes\Trojans-VM-019.sbi (*)
2014-01-15 Includes\Trojans-VM-020.sbi (*)
2014-01-15 Includes\Trojans-VM-021.sbi (*)
2014-01-15 Includes\Trojans-VM-022.sbi (*)
2014-01-15 Includes\Trojans-VM-023.sbi (*)
2014-01-15 Includes\Trojans-VM-024.sbi (*)
2014-01-15 Includes\Trojans-ZB-000.sbi (*)
2014-01-15 Includes\Trojans-ZL-000.sbi (*)
2014-01-09 Includes\Trojans.sbi (*)
2014-01-16 Includes\TrojansC-01.sbi (*)
2014-01-16 Includes\TrojansC-02.sbi (*)
2014-01-16 Includes\TrojansC-03.sbi (*)
2014-01-16 Includes\TrojansC-04.sbi (*)
2014-01-16 Includes\TrojansC-05.sbi (*)
2014-01-09 Includes\TrojansC.sbi (*)
         

sowie von Malewarebytes protection.log:

<?xml version="1.0" encoding="UTF-8" ?>
<logs>
   <record severity="debug" LoggingEventType="4" datetime="2015-04-11T08:04:15.266068+02:00" source="Protection" type="Error" username="SYSTEM" systemname="POPOLOCOMPI" code="13" last_modified_tag="64917302-d659-4e12-b567-e0ed527bb6cd" message="IsLicensed"></record>
   <record severity="debug" LoggingEventType="2" datetime="2015-04-11T08:04:15.344068+02:00" source="Protection" type="Protection" username="SYSTEM" systemname="POPOLOCOMPI" last_modified_tag="2638cb7a-00aa-4930-94de-81b0405374fd" result="Stopping" subtype="Malware Protection"></record>
   <record severity="debug" LoggingEventType="2" datetime="2015-04-11T08:04:15.359668+02:00" source="Protection" type="Protection" username="SYSTEM" systemname="POPOLOCOMPI" last_modified_tag="a83f9295-05c2-4d6b-b221-5d0dd8507a67" result="Stopped" subtype="Malware Protection"></record>
   <record severity="debug" LoggingEventType="1" datetime="2015-04-11T08:11:53.582874+02:00" source="Manual" type="Update" username="SYSTEM" systemname="POPOLOCOMPI" code="Unable to access update server" last_modified_tag="5bed44f2-4256-494c-a712-8e9602a3962c" message="Failed"></record>
   <record severity="debug" starttime="2015-04-11T08:11:53+02:00" LoggingEventType="6" datetime="2015-04-11T08:26:28.086869+02:00" source="Manual" type="Scan" username="SYSTEM" systemname="POPOLOCOMPI" last_modified_tag="737b953e-4d15-4e6c-83f4-2149a8300f98" duration="866" malwaredetections="0" nonmalwaredetections="40" scanresult="completed" scantype="threat"></record>
   <record severity="debug" LoggingEventType="4" datetime="2015-04-11T08:33:07.380298+02:00" source="Protection" type="Error" username="SYSTEM" systemname="POPOLOCOMPI" code="13" last_modified_tag="6027d451-2fa5-4d4f-9a45-3ea4758c58be" message="IsLicensed"></record>
   <record severity="debug" LoggingEventType="2" datetime="2015-04-11T08:33:07.411498+02:00" source="Protection" type="Protection" username="SYSTEM" systemname="POPOLOCOMPI" last_modified_tag="cba08f62-5b39-44b8-9d64-3f17e069cbc8" result="Stopping" subtype="Malware Protection"></record>
   <record severity="debug" LoggingEventType="2" datetime="2015-04-11T08:33:07.411498+02:00" source="Protection" type="Protection" username="SYSTEM" systemname="POPOLOCOMPI" last_modified_tag="33ddacee-5468-46a4-9d58-c96e5375c950" result="Stopped" subtype="Malware Protection"></record>
   <record severity="debug" LoggingEventType="1" datetime="2015-04-11T09:03:58.368549+02:00" source="Manual" type="Update" username="SYSTEM" systemname="POPOLOCOMPI" fromVersion="2015.4.10.2" last_modified_tag="ba54267c-fd47-415f-9c1b-eb72ecb304df" name="Malware Database" toVersion="2015.4.11.1"></record>
   <record severity="debug" scantype="threat" LoggingEventType="6" starttime="2015-04-11T09:03:58+02:00" datetime="2015-04-11T09:16:34.206934+02:00" source="Manual" type="Scan" username="SYSTEM" systemname="POPOLOCOMPI" last_modified_tag="8b2a49a4-4257-4ad8-8ea6-094ffe167bcf" duration="748" malwaredetections="0" nonmalwaredetections="14" scanresult="completed"></record>
   <record severity="debug" scantype="threat" LoggingEventType="6" starttime="2015-04-11T09:16:48+02:00" datetime="2015-04-11T09:28:26.545640+02:00" source="Manual" type="Scan" username="SYSTEM" systemname="POPOLOCOMPI" last_modified_tag="10b8b50d-d17c-4bdf-9392-2018c4929966" duration="673" malwaredetections="0" nonmalwaredetections="13" scanresult="completed"></record>
   <record severity="debug" scantype="threat" LoggingEventType="6" starttime="2015-04-11T09:28:44+02:00" datetime="2015-04-11T09:40:26.985563+02:00" source="Manual" type="Scan" username="SYSTEM" systemname="POPOLOCOMPI" last_modified_tag="816b42c2-9dfe-40ec-a13f-5881a89f1b64" duration="682" malwaredetections="0" nonmalwaredetections="13" scanresult="completed"></record>
</logs>
         

sowie Malewarebytes mbam.log:

<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2015/04/11 09:28:44 +0200</date>
<logfile>mbam-log-2015-04-11 (09-28-41).xml</logfile>
<isadmin>no</isadmin>
</header>
<engine>
<version>2.01.4.1018</version>
<malware-database>v2015.04.11.01</malware-database>
<rootkit-database>v2015.03.31.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x64</arch>
<username>Bunny</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>285554</objects>
<time>682</time>
<processes>0</processes>
<modules>0</modules>
<keys>0</keys>
<values>0</values>
<datas>0</datas>
<folders>0</folders>
<files>13</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>enabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>user_pref(&quot;extensions.mysearchdial.vrsni&quot;, &quot;1.8.21.0&quot;);</baddata><gooddata></gooddata><hash>db7269025d2db97df16575ca0ff76997</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>;





user_pref(&quot;extensions.mysearchdial.vrsni&quot;, &quot;1.8.21.0&quot;</baddata><gooddata></gooddata><hash>0746c8a3ff8be1559cba9ba443c3867a</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>
user_pref(&quot;extensions.mysearchdial.vrsni&quot;, &quot;1.8.21.0&quot;);
us</baddata><gooddata></gooddata><hash>1e2f8fdc3d4dab8b4d09231cf90d59a7</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>



user_pref(&quot;extensions.mysearchdial.vrsni&quot;, &quot;1.8.21.0</baddata><gooddata></gooddata><hash>f05d402b5d2dff37f660b28d0ff717e9</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>




user_pref(&quot;extensions.mysearchdial.vrsni&quot;, &quot;1</baddata><gooddata></gooddata><hash>0c4147245238e55154027dc27c8ade22</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>);





user_pref(&quot;extensions.mysearchdial.vrsni&quot;</baddata><gooddata></gooddata><hash>d37a6209761452e4cf876ed1c04630d0</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>;





user_pref(&quot;extensions.mysearchdial.vrsn</baddata><gooddata></gooddata><hash>311c73f80e7c8fa7bf97b58a5ea83bc5</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>l.);





user_pref(&quot;extensions.mysearchdial</baddata><gooddata></gooddata><hash>8fbe7eed880269cd7bdb9fa018eedb25</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>ial.);





user_pref(&quot;extensions.mysearchd</baddata><gooddata></gooddata><hash>3d1090dbccbe999d57fffb44a363718f</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>iial.);





user_pref(&quot;extensions.mysearchdial.vrsni&quot;, &quot;1.8.21.0&quot;);
user_pref</baddata><gooddata></gooddata><hash>a4a9c8a37317152193c360df947214ec</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>ions.mysearchdial.vrsni&quot;, &quot;1.8.21.0&quot;);
user_pref(&quot;e</baddata><gooddata></gooddata><hash>311c4526b5d5989ef75f97a86d99b24e</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>ial.);





user_pref(&quot;extensions.mysearchdial.v</baddata><gooddata></gooddata><hash>51fc4427f991cd69aea8033c41c5a759</hash></file>
<file><path>C:\Users\Bunny\AppData\Roaming\Mozilla\Firefox\Profiles\i1isfbzl.default\user.js</path><vendor>PUP.Optional.MySearchDial.A</vendor><action>replaced</action><baddata>);





user_pref(&quot;extensions.mysearchdial.vrsni&quot;,</baddata><gooddata></gooddata><hash>5df0b4b79bef38fe97bf5ce3699d718f</hash></file>
</items>
</mbam-log>
         

Im Voraus danke ich vielmals für Hilfestellungen!

Freundliche Grüße
Zylpinga

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo Schrauber,

ich habe den Rat befolgt und Combofix ausgeführt.
Anfangs musste ich noch spyware deaktivieren, habe es dann einfach deinstalliert. Bei G Data hatte ich alles mir ersichtliche deaktiviert, trotzdem meldete es sich ständig mit Warnungen. Ich habe Combofix alles erlaubt und es lief reibungslos.
Am Ende ging es nach dem Löschen 2er Ordner nicht weiter. Nachdem ich ein neues G Data Fenster weggeklickt hatte führte Combofix einen Neustart aus.
Ich fand danach unter C:\Combofix weder eine Logfile noch einige andere Programme auf meinem PC. G Data ist jetzt gelöscht und andere Programme (Scanner und Co) entfernt.

Ich ließ Combofix erneut laufen. Dieses Mal ging es schneller und reibungslos. Auch wurde eine Combofix.txt Datei erstellt. Allerdings sind alle meine Browser gelöscht! Ich kann nicht mehr ins Internet und Ihnen diese Datei nicht schicken!
Bitte helfen Sie mir!

noch einige andere Programme auf meinem PC

G Data ist jetzt gelöscht und andere Programme (Scanner und Co) entfernt.

Allerdings sind alle meine Browser gelöscht

What?

Ich brauch ein frisches FRST log. ZUr Not auf nen Stick und von einem andern Rechner posten.

Ja, ich hab auch nicht schlecht geguckt...
Ich hab den Rechner jetzt komplett neu aufgesetzt und alles läuft wieder reibungslos. Dürfte sich damit erledigt haben.
Trotzdem Danke für die Hilfe!

ok

Jetzt ist mir allerdings doch nochmal eine Frage gekommen:
Trotz Neuinstallation wurde eine windows.old Datei erstellt - kann ich die bedenkenlos löschen und bin virenfrei, oder bin ich alleine aufgrund der Tatsache, dass dieser Ordner existiert doch schon wieder von dem gleichen Virus befallen?

Das ist ein Ordner, keine Datei. Und das bedeutet du hast nicht sauber neu installiert, sondern ein neues Windows über das alte gepackt, und das alte ist dann komplett mit allen Daten im Ordner Windows.old gelandet.

Datenträgerbereinigung von Windows löscht das.

Wäre nach der Datenträgerbereinigung dann alles wieder in Ordnung?

ers ist dann immer noch keine saubere Neuinstallation, aber der Ordner ist dann weg.