Hey Liebe Leute,

ich sollte heute einer Bekannten am PC helfen und schreibe deshalb diesen Thread schonmal von ihrem Pc, in folgenden Posts wird sie antworten, weil ich dann nicht mehr hier bin.

Ich habe mir schon einen Thread zum Thema durchgelesen, und zwar diesen hier: http://www.trojaner-board.de/162886-...blockiert.html

Ich habe mir auch schon FRST besorgt und den Scan durchgeführt, hier sind die Ergebnisse:

FRST.txt:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-06-2015
Ran by heike (administrator) on HEIKE-PC on 04-06-2015 18:38:07
Running from C:\Windows\System32\config\systemprofile\Downloads
Loaded Profiles: heike (Available Profiles: heike & manni)
Platform: Windows 7 Ultimate (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files\G DATA\TotalProtection\AVK\AVKWCtl.exe
(G Data Software AG) C:\Program Files\G DATA\TotalProtection\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(G DATA Software AG) C:\Program Files\G DATA\TotalProtection\Firewall\GDFirewallTray.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files\G DATA\TotalProtection\AVK\AVKService.exe
() C:\ProgramData\DatacardService\DCService.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(G Data Software AG) C:\Program Files\G DATA\TotalProtection\AVKBackup\AVKBackupService.exe
(Interactive Brands Inc.) C:\Program Files\PDF Suite 2014\HelperService.exe
(Interactive Brands Inc.) C:\Program Files\PDF Suite 2014\ConversionService.exe
(G Data Software AG) C:\Program Files\G DATA\TotalProtection\Firewall\GDFwSvc.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G DATA\TotalProtection\Firewall\GDFirewallTray.exe [1855608 2015-02-20] (G DATA Software AG)
HKLM Group Policy restriction on software: C:\Program Files\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\G DATA\TotalProtection\AVKTray\AVKTray.exe,C:\Program Files\G DATA\TotalProtection\AVKKid\AVKCKS.exe,
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2614272 2009-10-31] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2614272 2009-10-31] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-21-4290959449-238613100-3654617076-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2614272 2009-10-31] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2614272 2009-10-31] (Microsoft Corporation) <==== ATTENTION 
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
URLSearchHook: HKLM - (No Name) - {96f454ea-9d38-474f-b504-56193e00c1a5} -  No File
SearchScopes: HKLM -> DefaultScope value is missing
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_adk3_14_29&cd=2XzuyEtN2Y1L1QzutD0CyCtDyByCzy0ByByEyDzyyDtCtB0AtN0D0Tzu0StCtDtDtCtN1L2XzutAtFtBtFtCtFtDtN1L1Czu1N1C2X1V1T1Q1JtA1VtCyE1VtBzytN1L1G1B1V1N2Y1L1Qzu2SyEzztDzz0DyB0EtAtG0ByDyEtAtG0A0BzzyCtG0E0EzzzztGtD0F0DtAyCzytB0A0D0DyD0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0ByEtAyCyCtC0AtG0DyC0DtDtGyEyD0CyDtGzztBtD0BtG0C0Azz0B0Ezz0EtAzyyCtD0E2Q&cr=537607653&ir=
SearchScopes: HKU\S-1-5-21-4290959449-238613100-3654617076-1000 -> {CC865B26-C31D-4D23-B17B-96548EEF03F6} URL = 
BHO: TheBestDeals -> {181F4E2C-915D-05D2-5F8B-ADF160B1893E} ->  No File
BHO: No Name -> {70BF78DB-B4FA-A273-4EE6-316123FF34DD} ->  No File
BHO: No Name -> {96f454ea-9d38-474f-b504-56193e00c1a5} ->  No File
BHO: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-09-04] (Adobe Systems Incorporated)
BHO: App Bud -> {d6708803-e150-4146-a314-0253663d2cec} ->  No File
BHO: PDF Suite 2014 Helper -> {E854CC03-3049-415A-AE82-77B7F2D43D4F} -> C:\Program Files\PDF Suite 2014\PDFIEHelper.dll [2013-12-10] (Interactive Brands Inc.)
BHO: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-09-04] (Adobe Systems Incorporated)
BHO: No Name -> {fbdff406-2c4c-5d35-8469-34bb67ea3353} ->  No File
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-09-04] (Adobe Systems Incorporated)
Toolbar: HKLM - PDF Suite 2014 Toolbar - {A0B8187A-4FC7-4973-907E-1A25BC8E91A5} - C:\Program Files\PDF Suite 2014\PDFIEPlugin.dll [2013-12-10] (Interactive Brands Inc.)
Toolbar: HKLM - No Name - {96f454ea-9d38-474f-b504-56193e00c1a5} -  No File
Toolbar: HKU\S-1-5-21-4290959449-238613100-3654617076-1000 -> Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-09-04] (Adobe Systems Incorporated)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{CBC3D97B-6DEE-4B89-B555-8F25A5A22730}: [NameServer] 193.189.244.225 193.189.244.206
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-06-02] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @nosltd.com/getPlus+(R),version=1.6.2.97 -> C:\Program Files\NOS\bin\np_gp.dll [2010-11-29] (NOS Microsystems Ltd.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-21] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-21] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2014-09-04] (Adobe Systems Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-09-04] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011-04-25]

Chrome: 
=======
CHR Profile: C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-20]
CHR Extension: (Google Drive) - C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-20]
CHR Extension: (Groovorio New Tab) - C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\blmchfpimpbbdmgpcieclabeafkljbhm [2015-05-20]
CHR Extension: (YouTube) - C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-20]
CHR Extension: (Google Search) - C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-20]
CHR Extension: (Bookmark Manager) - C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-05-20]
CHR Extension: (Chrome Hotword Shared Module) - C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-05-20]
CHR Extension: (Google Wallet) - C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-20]
CHR Extension: (Gmail) - C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-20]
CHR HKLM\...\Chrome\Extension: [blmchfpimpbbdmgpcieclabeafkljbhm] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [dgldkplledicnbnnliodeffobaiaodaf] - C:\Program Files\SiteRanker\Chrome\siterank_c.crx [Not Found]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2527864 2015-03-04] (G Data Software AG)
R2 AVKService; C:\Program Files\G DATA\TotalProtection\AVK\AVKService.exe [965240 2015-02-20] (G Data Software AG)
R2 AVKWCtl; C:\Program Files\G DATA\TotalProtection\AVK\AVKWCtl.exe [2876888 2015-04-07] (G Data Software AG)
S3 Browser7Maintenance; C:\Program Files\Browser 7 Maintenance Service\maintenanceservice.exe [148792 2015-04-10] (Deutsche Telekom AG)
R2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-05-08] () [File not signed]
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2010-06-24] (Teruten) [File not signed]
R2 GDBackupSvc; C:\Program Files\G DATA\TotalProtection\AVKBackup\AVKBackupService.exe [3881080 2015-02-20] (G Data Software AG)
R3 GDFwSvc; C:\Program Files\G DATA\TotalProtection\Firewall\GDFwSvc.exe [2539560 2015-02-20] (G Data Software AG)
R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [789112 2015-03-04] (G Data Software AG)
S3 GDTunerSvc; C:\Program Files\G DATA\TotalProtection\AVKTuner\AVKTunerService.exe [2235512 2015-02-20] (G Data Software AG)
S2 Orbiter; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 PDF Suite 2014 Helper Service; C:\Program Files\PDF Suite 2014\HelperService.exe [1144184 2013-12-10] (Interactive Brands Inc.)
R2 PDF Suite 2014 Service; C:\Program Files\PDF Suite 2014\ConversionService.exe [853368 2013-12-10] (Interactive Brands Inc.)
S3 TSNxGService; C:\Program Files\G DATA\TotalProtection\TSNxG\TSNxGService.exe [255608 2014-07-01] (G DATA Software)
S3 TuneUp.Defrag; C:\Windows\System32\TuneUpDefragService.exe [307968 2011-06-05] (TuneUp Software GmbH)
R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [36664 2015-01-30] (AVG Technologies)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)
S2 0c632643; "C:\Windows\system32\rundll32.exe" "c:\progra~2\intere~1\InterenetOptimizerSvc.dll",service
S2 CouponArificService; C:\Program Files\35556262-902E-49AE-8622-66E14F1F041C\arrmeapsie.exe [X]
S2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe -service [X]
S4 servervo; C:\Users\heike\AppData\Roaming\VOPackage\VOsrv.exe [X] <==== ATTENTION
S2 Update App Bud; "C:\Program Files\App Bud\updateAppBud.exe" [X]
S2 vToolbarUpdater17.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.2.0\ToolbarUpdater.exe [X]
S2 Winmgmt; C:\PROGRA~2\jrq3b2wj.dss [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 ACPIVPC; C:\Windows\System32\DRIVERS\AcpiVpc.sys [23136 2010-01-20] (Lenovo Corporation)
S3 athr; C:\Windows\System32\DRIVERS\athr.sys [1263104 2010-03-03] (Atheros Communications, Inc.) [File not signed]
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-14] (AVG Technologies)
S3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [44544 2009-08-24] (AzureWave Technologies, Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-24] () [File not signed]
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [108032 2015-06-03] (G Data Software AG)
R3 GDKBB; C:\Windows\system32\drivers\GDKBB32.sys [24192 2015-06-03] (G Data Software AG)
R3 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt32.sys [20352 2015-06-03] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [161792 2015-06-03] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [73216 2015-06-03] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2015-06-03] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2015-06-03] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [87040 2015-06-03] (G Data Software AG)
R1 netfilter; C:\Windows\System32\drivers\netfilter.sys [31744 2014-09-29] (NetFilterSDK.com) [File not signed]
S3 RTL2832UBDA; C:\Windows\System32\drivers\RTL2832UBDA.sys [188520 2012-03-06] (REALTEK SEMICONDUCTOR Corp.)
S3 RTL2832UUSB; C:\Windows\System32\Drivers\RTL2832UUSB.sys [32872 2012-03-06] (REALTEK SEMICONDUCTOR Corp.)
S3 RTL2832U_IRHID; C:\Windows\System32\DRIVERS\RTL2832U_IRHID.sys [42728 2012-03-06] (Realtek)
R0 TS4NT; C:\Windows\System32\Drivers\TS4nt.sys [103928 2015-06-03] (G Data Software)
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-04 18:37 - 2015-06-04 18:38 - 00000000 ____D C:\FRST
2015-06-04 18:36 - 2015-06-04 18:36 - 00000000 __SHD C:\Windows\system32\%APPDATA%
2015-06-04 18:35 - 2015-06-04 18:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-06-04 18:34 - 2015-06-04 18:34 - 00000000 ____D C:\Program Files\VideoLAN
2015-06-03 18:14 - 2015-06-03 18:14 - 00029528 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2015-06-03 18:14 - 2015-06-03 18:14 - 00015192 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2015-06-03 17:48 - 2015-06-03 17:48 - 00001961 _____ C:\Users\Public\Desktop\G DATA TOTAL PROTECTION.lnk
2015-06-03 17:48 - 2015-06-03 17:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA TOTAL PROTECTION
2015-06-03 17:47 - 2015-06-03 17:47 - 00103928 _____ (G Data Software) C:\Windows\system32\Drivers\TS4nt.sys
2015-06-03 17:47 - 2015-06-03 17:47 - 00024192 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBB32.sys
2015-06-03 17:47 - 2015-06-03 17:47 - 00020352 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt32.sys
2015-06-03 17:47 - 2015-06-03 17:47 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_GDKBFlt32_01007.Wdf
2015-06-03 17:47 - 2015-06-03 17:47 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_GDKBB32_01007.Wdf
2015-06-03 17:46 - 2015-06-03 17:46 - 00073216 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2015-06-03 17:46 - 2015-06-03 17:46 - 00053248 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd32.sys
2015-06-03 17:45 - 2015-06-03 17:45 - 00161792 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2015-06-03 17:45 - 2015-06-03 17:45 - 00108032 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2015-06-03 17:45 - 2015-06-03 17:45 - 00087040 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2015-06-03 17:44 - 2015-06-03 17:44 - 00001954 _____ C:\Windows\DPINST.LOG
2015-06-03 17:44 - 2015-06-03 17:44 - 00001954 _____ C:\Windows\DPINST.LOG
2015-06-03 17:43 - 2015-06-03 17:43 - 00000000 ____D C:\ProgramData\G DATA Software
2015-06-03 17:43 - 2015-06-03 17:43 - 00000000 ____D C:\Program Files\G DATA
2015-06-03 17:42 - 2015-06-03 17:43 - 00000000 ____D C:\Program Files\Common Files\G Data
2015-06-03 17:30 - 2015-06-03 18:20 - 00000000 ____D C:\ProgramData\G Data
2015-06-03 13:45 - 2015-06-03 13:45 - 00000000 ____D C:\ProgramData\Avira
2015-06-03 12:24 - 2015-06-03 12:24 - 00000000 ____D C:\Users\TEMP\AppData\Local\MFAData
2015-05-30 09:59 - 2015-06-03 17:19 - 00000000 ____D C:\Program Files\Common Files\DivX Shared
2015-05-27 17:51 - 2015-05-27 17:51 - 00000000 ____D C:\Users\TEMP\AppData\Local\Google
2015-05-19 09:55 - 2015-05-19 09:55 - 00000000 ____D C:\Users\Default\AppData\Roaming\AVG
2015-05-19 09:55 - 2015-05-19 09:55 - 00000000 ____D C:\Users\Default User\AppData\Roaming\AVG
2015-05-19 09:42 - 2015-06-03 12:34 - 00000000 ____D C:\Windows\system32\cache
2015-05-18 19:54 - 2015-05-18 19:54 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\AVG
2015-05-18 19:39 - 2015-05-18 19:39 - 00000000 ____D C:\Windows\system32\%LocalAppData%
2015-05-18 19:32 - 2015-05-18 19:32 - 00000000 ____D C:\Users\manni\AppData\Local\Avg
2015-05-18 10:29 - 2015-05-18 10:29 - 00000000 ____D C:\Users\Default\AppData\Local\AVG
2015-05-18 10:29 - 2015-05-18 10:29 - 00000000 ____D C:\Users\Default User\AppData\Local\AVG
2015-05-18 10:23 - 2015-06-02 10:16 - 00000000 ____D C:\Users\TEMP\AppData\Local\Avg
2015-05-18 10:23 - 2015-05-22 17:15 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\TuneUp Software
2015-05-18 10:23 - 2015-05-21 09:23 - 00000000 ____D C:\Users\TEMP\AppData\Local\Avg2015
2015-05-18 10:23 - 2015-05-18 10:23 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\AVG2015
2015-05-18 10:23 - 2011-02-06 20:40 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\Macromedia
2015-05-18 10:23 - 2009-07-14 06:42 - 00000000 ___RD C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-05-18 10:23 - 2009-07-14 06:37 - 00000000 ___RD C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-05-17 17:02 - 2015-05-17 17:07 - 00000000 ____D C:\Users\heike\Desktop\kinderfilme

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-04 18:32 - 2009-07-14 06:34 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-04 18:32 - 2009-07-14 06:34 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-04 18:24 - 2011-02-04 16:08 - 02052928 _____ C:\Windows\WindowsUpdate.log
2015-06-04 18:24 - 2011-02-04 16:08 - 02052928 _____ C:\Windows\WindowsUpdate.log
2015-06-04 18:23 - 2013-02-28 12:31 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-04 18:18 - 2014-10-07 13:57 - 00025596 _____ C:\Windows\setupact.log
2015-06-04 18:18 - 2014-10-07 13:57 - 00025596 _____ C:\Windows\setupact.log
2015-06-04 18:18 - 2013-03-21 16:05 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-04 18:18 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-04 06:28 - 2014-08-24 10:54 - 00000000 ____D C:\Program Files\B021CBBD-E38E-4F8C-8E93-6624B0597A23
2015-06-04 06:28 - 2014-04-22 11:30 - 00000000 ____D C:\Program Files\Systweak Support Dock
2015-06-04 06:23 - 2013-03-21 16:05 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-03 18:19 - 2014-10-18 16:27 - 00000000 ____D C:\Program Files\35556262-902E-49AE-8622-66E14F1F041C
2015-06-03 17:19 - 2012-12-25 13:10 - 00000000 ____D C:\ProgramData\DivX
2015-06-03 17:19 - 2012-10-13 11:16 - 00000000 ____D C:\Program Files\DivX
2015-06-03 17:16 - 2012-10-13 11:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX
2015-06-03 17:09 - 2014-10-07 13:56 - 00012230 _____ C:\Windows\PFRO.log
2015-06-03 17:09 - 2014-10-07 13:56 - 00012230 _____ C:\Windows\PFRO.log
2015-06-03 13:08 - 2015-05-03 11:04 - 00018186 _____ C:\Windows\system32\debug.log
2015-06-03 12:33 - 2014-10-03 19:30 - 00000000 ____D C:\ProgramData\AVG2015
2015-06-03 12:33 - 2011-07-24 19:23 - 00000000 ____D C:\Program Files\AVG
2015-06-03 12:33 - 2011-07-24 19:10 - 00000000 ____D C:\ProgramData\MFAData
2015-06-02 18:09 - 2013-02-28 12:31 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-06-02 18:09 - 2011-09-25 10:35 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-06-02 10:16 - 2014-12-28 13:47 - 00000000 ____D C:\Users\heike\AppData\Local\Avg
2015-05-30 11:23 - 2011-02-13 10:50 - 00000049 _____ C:\Windows\NeroDigital.ini
2015-05-30 11:23 - 2011-02-13 10:50 - 00000049 _____ C:\Windows\NeroDigital.ini
2015-05-26 10:56 - 2014-12-17 19:56 - 00002081 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-22 14:32 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Public\Libraries
2015-05-22 13:55 - 2009-07-14 06:46 - 00001515 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-05-18 10:25 - 2012-12-12 11:16 - 00000000 ____D C:\Users\Default\AppData\Roaming\TuneUp Software
2015-05-18 10:25 - 2012-12-12 11:16 - 00000000 ____D C:\Users\Default User\AppData\Roaming\TuneUp Software
2015-05-17 17:03 - 2011-03-21 13:04 - 00000000 ____D C:\Users\heike\Desktop\manni
2015-05-09 10:42 - 2015-04-29 19:35 - 00000000 ____D C:\Users\heike\AppData\Roaming\uTorrent

==================== Files in the root of some directories =======

2015-06-03 17:45 - 2015-06-03 17:45 - 0014381 _____ () C:\Windows\system32\config\systemprofile\AppData\Roaming\Avkwctl.log
2015-06-03 13:09 - 2015-06-03 13:10 - 0000055 _____ () C:\Windows\system32\config\systemprofile\AppData\Roaming\mbam.context.scan
2013-11-20 18:59 - 2013-12-25 22:10 - 95025368 ____T () C:\ProgramData\jw2b3qrj.bxx
2013-11-20 18:59 - 2013-12-25 21:17 - 0000000 _____ () C:\ProgramData\jw2b3qrj.fvv
2013-11-20 19:00 - 2013-11-20 19:00 - 0000285 _____ () C:\ProgramData\jw2b3qrj.reg

Files to move or delete:
====================
C:\ProgramData\jw2b3qrj.bxx
C:\ProgramData\jw2b3qrj.fvv
C:\ProgramData\jw2b3qrj.reg
C:\Users\Public\AlexaNSISPlugin.4472.dll


Some files in TEMP:
====================
C:\Users\manni\AppData\Local\Temp\InstHelper.exe
C:\Users\manni\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-26 10:54

==================== End of log ============================
         

--- --- --- ---

Addition.txt:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-06-2015
Ran by heike at 2015-06-04 18:39:03
Running from C:\Windows\System32\config\systemprofile\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4290959449-238613100-3654617076-500 - Administrator - Disabled)
Gast (S-1-5-21-4290959449-238613100-3654617076-501 - Limited - Enabled)
heike (S-1-5-21-4290959449-238613100-3654617076-1000 - Administrator - Enabled) => C:\Users\TEMP
HomeGroupUser$ (S-1-5-21-4290959449-238613100-3654617076-1003 - Limited - Enabled)
manni (S-1-5-21-4290959449-238613100-3654617076-1004 - Limited - Enabled) => C:\Users\manni

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat X Pro - English, Français, Deutsch (HKLM\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.12 - Adobe Systems)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)
Adobe Download Manager (HKLM\...\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}) (Version: 1.6.2.97 - NOS Microsystems Ltd.)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Browser 7 der Telekom 37.0.3 (x86 de) (HKLM\...\Browser 7 der Telekom 37.0.3 (x86 de)) (Version: 37.0.3 - Deutsche Telekom AG)
Browser 7 Maintenance Service (HKLM\...\Browser7MaintenanceService) (Version: 37.0.3 - Deutsche Telekom AG)
DivX Codec (HKLM\...\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.6.1 - DivX, Inc.)
G DATA TOTAL PROTECTION (HKLM\...\{2A1FF304-D778-49F1-B340-E4BF4CDA2EB0}) (Version: 25.1.0.3 - G DATA Software AG)
Google Chrome (HKLM\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.27.5 - Google Inc.) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mobile Partner (HKLM\...\Mobile Partner) (Version: 11.302.09.04.382 - Huawei Technologies Co.,Ltd)
PDF Suite 2014 (HKLM\...\{5956AB6C-492D-4ECB-8D03-8C2B7E1F766F}) (Version: 11.0.14.13975 - Interactive Brands Malta Limited)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.0.1.11053_99 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.0.1.11053_99 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Mobile Device Software (HKLM\...\SAMSUNG USB Mobile Device) (Version:  - )
TuneUp Utilities 2008 (HKLM\...\{5888428E-699C-4E71-BF71-94EE06B497DA}) (Version: 7.0.7986 - TuneUp Software)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Windows Media Center Add-in for Silverlight (HKLM\...\{0EDBEB2B-7C8D-42E6-8312-0F84394A3223}) (Version: 4.7.3.0 - Microsoft Corporation)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
WinZip 16.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CC}) (Version: 16.0.9715 - WinZip Computing, S.L. )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

Could not list restore points
Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {01ECF874-487A-4D3C-8A23-746E1F5567A5} - System32\Tasks\{AA35B50B-995E-4F68-84E2-F2AC44342DD9} => C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2013-04-04] (Malwarebytes Corporation)
Task: {0A479B55-7169-42CA-9740-4B33AF1B6A10} - System32\Tasks\{ADCC27E2-7B74-4574-8575-27E72CC2056B} => C:\Program Files\AVG\AVG2015\avgmfapx.exe
Task: {0FABED95-8091-4D7D-98BD-F23074C940B8} - System32\Tasks\{E3A6F5CA-5E06-4462-8B88-B861C569D5B9} => C:\Program Files\AVG\AVG2015\avgui.exe
Task: {2C518E0F-6608-45B5-A583-7E405871076A} - System32\Tasks\{7F567B46-49FB-4F97-A180-6D9B92EEBF21} => C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2013-04-04] (Malwarebytes Corporation)
Task: {34E70397-3F12-4537-9306-570F7096D778} - System32\Tasks\Automatische Wartung => C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-02-29] ()
Task: {3E21277E-C3BD-4943-BBB2-8F874C063038} - System32\Tasks\{C881C3C5-C646-4FBB-A662-0209E379E64F} => C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2013-04-04] (Malwarebytes Corporation)
Task: {42392773-53C0-4153-858B-E48E1BD559C8} - System32\Tasks\{8F0D9A7D-5460-4C67-AFC0-5154FDC6F49D} => C:\Program Files\AVG\AVG2015\avgmfapx.exe
Task: {52F92D0C-45F1-45B3-A2D3-867F529A79DB} - System32\Tasks\{C50FF8B7-A190-49FA-9F00-8F7E62F174F6} => C:\Program Files\AVG\AVG2015\avgmfapx.exe
Task: {5F3D9B5C-CFCA-4A88-8B7A-BFDDE3C309A7} - System32\Tasks\{37EEC356-2CA2-4E1B-8C19-6A21F6460197} => C:\Program Files\AVG\AVG2015\avgui.exe
Task: {63F94A6F-1172-492D-8E18-D288F72E8E13} - System32\Tasks\{F54B77BD-7142-4AC8-9770-216029B033B6} => C:\Program Files\AVG\AVG2015\avgmfapx.exe
Task: {6D84714F-5B99-4756-B652-404760206F04} - System32\Tasks\{CFC286DE-120D-4723-95AF-03AF8650E51D} => C:\Program Files\McAfee Security Scan\3.8.150\McUICnt.exe
Task: {6ED68A54-92EC-4529-976C-4A38F214000E} - System32\Tasks\{CE4B0916-A370-4C20-890A-43E09D815BCA} => C:\Program Files\AVG\AVG2015\avgmfapx.exe
Task: {7A9E1393-17C4-464B-9000-743448439EEE} - System32\Tasks\{0EEBDB69-0CE8-47D0-BC79-8243D8097CB2} => pcalua.exe -a C:\Users\heike\AppData\Local\Temp\GLF52E~1.EXE -d C:\Users\heike\AppData\Local\Temp -c /s -path="C:\Program Files\uTorrentBar_DE"  -dllname="tbuTo0.dll" -helpername="uTorrentBar_DEToolbarHelper.exe" -hostid="{c840e246-6b95-475e-9bd7-caa1c7eca9f2}"
Task: {80185280-5DEE-44F6-8CF4-F4579CB74E30} - System32\Tasks\{30E5C66F-C649-42F4-AE50-17DEF21844CB} => C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2013-04-04] (Malwarebytes Corporation)
Task: {9A646598-9960-47FC-94A3-4601319158ED} - System32\Tasks\{0031A329-54D8-4305-AEB2-C0AF97848259} => C:\Program Files\AVG\AVG2015\avgui.exe
Task: {A721DC83-73BC-4BC7-967D-5FB4F39CA0A6} - System32\Tasks\{274C1EEA-0F70-44BB-97BD-5C6C287A34F2} => pcalua.exe -a C:\Users\heike\AppData\Roaming\webssearches\UninstallManager.exe -c  -ptid=adks <==== ATTENTION
Task: {A8298C86-2E40-4BA5-83C4-551CB33C8552} - System32\Tasks\LaunchSignup => C:\Program Files\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {B9E1E87A-45FD-4DA3-BC21-E1FD276AB871} - System32\Tasks\{3676387C-9540-42F0-B0E9-F97706D0E218} => C:\Program Files\AVG\AVG2015\avgmfapx.exe
Task: {BDD0DE9E-64F4-4AD9-B66F-C568F9F2E1FB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-02] (Adobe Systems Incorporated)
Task: {BEC545E7-D764-400C-8EEF-FBFE7698F2AF} - System32\Tasks\{1FC5F666-E2C1-47EF-9F82-BC02BB861F68} => C:\Program Files\AVG\AVG2015\avgmfapx.exe
Task: {C885B287-1ACE-4642-A7C9-AA8F52C359D1} - System32\Tasks\{153CF264-4000-4F39-8AA7-08725D20D489} => C:\Program Files\AVG\AVG2015\avgui.exe
Task: {CE705E0A-519D-4E32-9017-5DA5C4351D7E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-03-21] (Google Inc.)
Task: {D08A0A10-9452-405D-96D3-F69238C04823} - System32\Tasks\{B6358F3A-0F2F-4C35-8A34-CC064037A212} => C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2013-04-04] (Malwarebytes Corporation)
Task: {D5182B6C-A639-43E0-89D3-2AAE5EF8B0DD} - System32\Tasks\{CCC24449-70B5-4BC9-886A-28552DE4FB23} => C:\Program Files\AVG\AVG2015\avgui.exe
Task: {D59B6DDA-322F-4DE3-A6F6-B96D72432471} - System32\Tasks\{1FFC5E1B-9BA0-4D09-B8D7-A5100CD59754} => C:\Program Files\AVG\AVG2015\avgui.exe
Task: {DEF76116-EAC5-4041-B30C-6A42EDA45020} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-03-21] (Google Inc.)
Task: {E42A9D41-CE93-4A81-87AA-750B1D81E943} - System32\Tasks\{83E250A4-48BB-407D-98BF-B33A0759F3C7} => C:\Program Files\AVG\AVG2015\avgmfapx.exe
Task: {E59B8A75-C73E-4327-8325-513FC0AB17AC} - System32\Tasks\{DD7953C9-8D88-4EE2-BE53-4166D2410C65} => C:\Program Files\AVG\AVG2015\avgui.exe
Task: {E6CC0EDE-5BDA-4D06-94DC-AA970D308864} - System32\Tasks\{FB68775D-3F3E-45AC-8963-BA6A6EDB2315} => C:\Program Files\AVG\AVG2015\avgmfapx.exe
Task: {F3D0F232-E903-4727-A6B8-893E4F69B345} - System32\Tasks\{742DE760-5D34-4EE3-B5B3-004A8FDF891C} => C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2013-04-04] (Malwarebytes Corporation)
Task: {F7B4488E-0D4D-45FA-935D-4F9B7BCF63CE} - System32\Tasks\{357B08B5-AE4F-4E1E-A4FE-F489542B5869} => C:\Program Files\AVG\AVG2015\avgmfapx.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2011-02-04 17:41 - 2010-03-15 12:28 - 00141824 _____ () C:\Program Files\WinRAR\rarext.dll
2010-05-08 13:48 - 2010-05-08 13:48 - 00229376 _____ () C:\ProgramData\DatacardService\DCService.exe
2015-02-20 05:42 - 2015-02-20 05:42 - 00317560 ____N () C:\Program Files\Common Files\G Data\AVKProxy\PktIcpt2.dll
2015-05-26 10:56 - 2015-05-22 22:22 - 14982472 _____ () C:\Program Files\Google\Chrome\Application\43.0.2357.81\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4290959449-238613100-3654617076-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: hidserv => 3
MSCONFIG\Services: IKEEXT => 2
MSCONFIG\Services: KtmRm => 3
MSCONFIG\Services: lmhosts => 2
MSCONFIG\Services: PCSUService => 2
MSCONFIG\Services: PolicyAgent => 3
MSCONFIG\Services: SensrSvc => 3
MSCONFIG\Services: servervo => 2
MSCONFIG\Services: TabletInputService => 3
MSCONFIG\Services: W32Time => 3
MSCONFIG\Services: WebClient => 3
MSCONFIG\Services: WerSvc => 3
MSCONFIG\Services: WinDefend => 2
MSCONFIG\Services: WPDBusEnum => 3
MSCONFIG\Services: wudfsvc => 2
MSCONFIG\startupreg: Acrobat Assistant 8.0 => "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
MSCONFIG\startupreg: Adobe Acrobat Speed Launcher => "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AVG_UI => "C:\Program Files\AVG\AVG2015\avgui.exe" /TRAYONLY
MSCONFIG\startupreg: BManager => C:\Program Files\Browser Features\BManager.exe
MSCONFIG\startupreg: Browser Features => C:\Program Files\Browser Features\BManager.exe
MSCONFIG\startupreg: NeroFilterCheck => C:\Windows\system32\NeroCheck.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{629EFE4D-9E37-485F-B4F4-657C1D708B6A}] => (Allow) C:\Windows\System32\ZoneLabs\vsmon.exe
FirewallRules: [{4343C871-4CBB-4C0E-97D3-412DA6568014}] => (Allow) C:\Windows\System32\ZoneLabs\vsmon.exe
FirewallRules: [{7221D3AB-DD59-462B-9CCE-EE6B43156AA0}] => (Allow) C:\Program Files\uTorrent\utorrent.exe
FirewallRules: [{819E5E52-5EEF-44E4-9D03-E4718B67F7E6}] => (Allow) C:\Program Files\uTorrent\utorrent.exe
FirewallRules: [{F82CE2ED-5A39-44F9-9938-8662E5037E5B}] => (Allow) C:\Program Files\AVG\AVG10\avgmfapx.exe
FirewallRules: [{4A52634B-4281-4D58-BF5E-6178C43A192A}] => (Allow) C:\Program Files\AVG\AVG10\avgmfapx.exe
FirewallRules: [{92B36792-E51D-4AB9-BAA9-4B97F45F3215}] => (Allow) C:\Users\heike\AppData\Local\Akamai\netsession_win.exe
FirewallRules: [{D24954AF-91A0-46AA-8418-D12EB56CF7BB}] => (Allow) C:\Users\heike\AppData\Local\Akamai\netsession_win.exe
FirewallRules: [{880A65F5-01C6-4E8F-98BD-0E41225E8D41}] => (Allow) C:\Users\heike\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{A4B7256E-6485-4EB0-B1EE-4AA811A2BA82}] => (Allow) C:\Users\heike\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{45EB647F-285B-4997-B267-491007451530}] => (Allow) C:\Users\heike\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{5EA8704B-968F-4C1A-86B2-201C270F06C8}] => (Allow) C:\Users\heike\AppData\Roaming\Spotify\spotify.exe
FirewallRules: [{661FC701-1951-4E78-8537-D41DB26E040C}] => (Allow) C:\Windows\System32\muzapp.exe
FirewallRules: [{DBCB33DB-A572-4343-8D52-775AAA32D8AB}] => (Allow) C:\Windows\System32\muzapp.exe
FirewallRules: [{EA0DD768-8AE4-42FD-94F6-63125411455A}] => (Allow) LPort=49173
FirewallRules: [{AC0B4506-77E7-4B0D-94EA-2B691870B46E}] => (Allow) LPort=5000
FirewallRules: [{D0B334A6-50FB-4775-AE5C-183009E6011D}] => (Allow) LPort=1900
FirewallRules: [{2E52017C-171A-4105-AA82-6625C3ED3E8E}] => (Allow) LPort=2869
FirewallRules: [{A95DB8BE-08EE-4E46-B619-A64AFEB4BB00}] => (Allow) C:\Windows\System32\msiexec.exe
FirewallRules: [{B9E2399A-D630-491B-B3AA-2C8684C750B8}] => (Allow) C:\Windows\System32\msiexec.exe
FirewallRules: [{95F6A5FC-AA61-4EDC-8853-78B2D6A91B51}] => (Allow) C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe
FirewallRules: [{8DCE187E-BB04-4F39-9717-DA869BC0F45B}] => (Allow) C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe
FirewallRules: [{6A1BD319-01BC-4C4E-AE97-582B86B27B0C}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{7391954B-5F91-403E-9900-B2E2E3C413B8}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{35D34666-66D1-457A-9466-7B36D9118499}] => (Allow) C:\Program Files\AVG\AVG10\avgnsx.exe
FirewallRules: [{E2701306-9552-4640-9D43-9BB1678A7C44}] => (Allow) C:\Program Files\AVG\AVG10\avgnsx.exe
FirewallRules: [{A50BAEA4-F091-4885-AFEB-F31127EE5EC1}] => (Allow) C:\Program Files\AVG\AVG10\avgam.exe
FirewallRules: [{D0D315BD-AA3F-4C45-81A0-A3C7AFFA5C9E}] => (Allow) C:\Program Files\AVG\AVG10\avgam.exe
FirewallRules: [{F643E22E-2D24-4991-9B66-AE3457687B9C}] => (Allow) C:\Program Files\AVG\AVG10\avgemcx.exe
FirewallRules: [{06C5CFEE-09C3-46C3-AA85-CC84D28064C3}] => (Allow) C:\Program Files\AVG\AVG10\avgemcx.exe
FirewallRules: [{EB767519-C98C-4744-9355-CAC69AFC4F3E}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{8E0AC74D-B398-4578-9C44-6E66E16A1900}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{5C8A3732-73BA-4E50-BADF-6DAF1E8688BD}] => (Allow) C:\Program Files\AVG\AVG10\avgnsx.exe
FirewallRules: [{77C452D6-D760-4D7E-90B5-BC9AA665C040}] => (Allow) C:\Program Files\AVG\AVG10\avgnsx.exe
FirewallRules: [{233B161C-7D08-4356-BB75-AA4853E6BE8B}] => (Allow) C:\Program Files\AVG\AVG10\avgam.exe
FirewallRules: [{F3168025-D85A-4866-9ADF-FE993DF5ACF4}] => (Allow) C:\Program Files\AVG\AVG10\avgam.exe
FirewallRules: [{36B24254-0081-44AB-B405-EBD658B760AE}] => (Allow) C:\Program Files\AVG\AVG10\avgemcx.exe
FirewallRules: [{B843D6CB-1B49-41FC-9215-5F6948BD090B}] => (Allow) C:\Program Files\AVG\AVG10\avgemcx.exe
FirewallRules: [{F80B9046-4271-4F52-84CD-3B5E792E03AE}] => (Allow) C:\Program Files\Sony Ericsson\Update Engine\Sony Ericsson Update Engine.exe
FirewallRules: [{C3E02331-8E87-4450-868C-AECE3A211FF6}] => (Allow) C:\Program Files\Sony Ericsson\Update Engine\Sony Ericsson Update Engine.exe
FirewallRules: [{94934FB9-0D39-437A-B0F8-3F1E285F4F8A}] => (Allow) C:\Program Files\Iminent\Iminent.exe
FirewallRules: [{AAAD13A1-ADF1-4F90-9C26-DDC5F861BDFC}] => (Allow) C:\Program Files\Iminent\Iminent.Messengers.exe
FirewallRules: [{7217699E-919A-4CDE-951B-A884805C0A1A}] => (Allow) LPort=49168
FirewallRules: [{FAA0252E-AEC5-42CA-BFAD-738CA9DF4676}] => (Allow) C:\Program Files\uTorrent\uTorrent.exe
FirewallRules: [{C96CE46A-27A5-4942-8928-6B6227C20F09}] => (Allow) C:\Program Files\uTorrent\uTorrent.exe
FirewallRules: [{2C5E514D-019B-413B-A7B4-DEB776D21C82}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{1D11638D-50FF-473F-B17F-B9EBF57958AF}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{40B0FD66-7794-44C3-9C83-A6634DCD3DD4}] => (Allow) C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{82E2859D-93EC-4B64-9F3F-B7904559FA10}] => (Allow) C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{1E3857BE-5400-4FE7-AA0D-041643D77D61}] => (Allow) C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{B17F1257-1E17-413C-A5FB-0B802C2BD6B8}] => (Allow) C:\Program Files\Deutsche Telekom AG\Browser 7\Browser7.exe
FirewallRules: [{777A418C-8872-44DB-B9B8-46EA221EDBF8}] => (Allow) C:\Program Files\Deutsche Telekom AG\Browser 7\Browser7.exe
FirewallRules: [{A5B68F03-C426-41A7-A381-8492A86F2E6B}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Could not list Devices. Check "winmgmt" service or repair WMI.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/04/2015 06:18:06 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (06/03/2015 09:05:55 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (06/03/2015 06:40:22 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (06/03/2015 06:09:15 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (06/03/2015 05:26:45 PM) (Source: MsiInstaller) (EventID: 11920) (User: heike-PC)
Description: Product: Avira -- Error 1920. Service 'Avira Service Host' (Avira.ServiceHost) failed to start.  Verify that you have sufficient privileges to start system services.

Error: (06/03/2015 05:23:43 PM) (Source: MsiInstaller) (EventID: 11920) (User: heike-PC)
Description: Product: Avira -- Error 1920. Service 'Avira Service Host' (Avira.ServiceHost) failed to start.  Verify that you have sufficient privileges to start system services.

Error: (06/03/2015 05:14:58 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (06/03/2015 05:10:32 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (06/03/2015 02:03:26 PM) (Source: MsiInstaller) (EventID: 11920) (User: heike-PC)
Description: Product: Avira -- Error 1920. Service 'Avira Service Host' (Avira.ServiceHost) failed to start.  Verify that you have sufficient privileges to start system services.

Error: (06/03/2015 02:00:31 PM) (Source: MsiInstaller) (EventID: 11920) (User: heike-PC)
Description: Product: Avira -- Error 1920. Service 'Avira Service Host' (Avira.ServiceHost) failed to start.  Verify that you have sufficient privileges to start system services.


System errors:
=============
Error: (06/04/2015 06:43:46 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%126

Error: (06/04/2015 06:43:16 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%126

Error: (06/04/2015 06:42:46 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%126

Error: (06/04/2015 06:42:16 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%126

Error: (06/04/2015 06:41:46 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%126

Error: (06/04/2015 06:41:16 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%126

Error: (06/04/2015 06:40:46 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%126

Error: (06/04/2015 06:40:16 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%126

Error: (06/04/2015 06:39:46 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%126

Error: (06/04/2015 06:39:16 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%126


Microsoft Office:
=========================
Error: (06/04/2015 06:18:06 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Zugriff verweigert

Error: (06/03/2015 09:05:55 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Zugriff verweigert

Error: (06/03/2015 06:40:22 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Zugriff verweigert

Error: (06/03/2015 06:09:15 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Zugriff verweigert

Error: (06/03/2015 05:26:45 PM) (Source: MsiInstaller) (EventID: 11920) (User: heike-PC)
Description: Product: Avira -- Error 1920. Service 'Avira Service Host' (Avira.ServiceHost) failed to start.  Verify that you have sufficient privileges to start system services.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (06/03/2015 05:23:43 PM) (Source: MsiInstaller) (EventID: 11920) (User: heike-PC)
Description: Product: Avira -- Error 1920. Service 'Avira Service Host' (Avira.ServiceHost) failed to start.  Verify that you have sufficient privileges to start system services.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (06/03/2015 05:14:58 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Zugriff verweigert

Error: (06/03/2015 05:10:32 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: heike-PC)
Description: Zugriff verweigert

Error: (06/03/2015 02:03:26 PM) (Source: MsiInstaller) (EventID: 11920) (User: heike-PC)
Description: Product: Avira -- Error 1920. Service 'Avira Service Host' (Avira.ServiceHost) failed to start.  Verify that you have sufficient privileges to start system services.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (06/03/2015 02:00:31 PM) (Source: MsiInstaller) (EventID: 11920) (User: heike-PC)
Description: Product: Avira -- Error 1920. Service 'Avira Service Host' (Avira.ServiceHost) failed to start.  Verify that you have sufficient privileges to start system services.(NULL)(NULL)(NULL)(NULL)(NULL)


CodeIntegrity Errors:
===================================
  Date: 2014-10-03 14:04:11.265
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-03 14:04:11.262
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-03 14:04:11.258
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-03 14:04:11.250
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-03 14:04:11.247
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-03 14:04:11.244
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-03 14:04:11.210
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-03 14:04:11.208
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-03 14:04:11.203
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-03 14:04:11.195
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Pentium(R) Dual-Core CPU T4300 @ 2.10GHz
Percentage of memory in use: 36%
Total physical RAM: 3032.6 MB
Available physical RAM: 1914.37 MB
Total Pagefile: 6063.48 MB
Available Pagefile: 4438.71 MB
Total Virtual: 2047.88 MB
Available Virtual: 1906.31 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:252.89 GB) (Free:44.57 GB) NTFS
Drive d: (Lenovo) (Fixed) (Total:30.25 GB) (Free:5.49 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 1560FFB2)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=252.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=30.2 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=14.8 GB) - (Type=12)

==================== End of log ============================
         

Das war alles soweit, ich habe ihr gesagt, dass sie von jetzt an nichts mehr Installieren oder deinstallieren soll, alles andere wird sie ausführen.

hi,

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKLM Group Policy restriction on software: C:\Program Files\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Kaspersky Lab <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.