Trojaner-Board - Windows-Explorer funktioniert nicht mehr

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Windows-Explorer funktioniert nicht mehr (https://www.trojaner-board.de/162021-windows-explorer-funktioniert-mehr.html)

Windows-Explorer funktioniert nicht mehr

Hallo zusammen - ich hoffe sehr, dass ich hier richtig bin. Ansonsten wechsle ich auch gerne und sofort Board und Threat. Sobald ich auf meiner externen Festplatt den Ordner "Hörbücher" anklicke, kommt die Fehlermeldung "Windows-Explorer funktioniert nicht mehr" und alle Ordner der Festplatt werden automatisch geschlossen. Hat jemand eine Idee, woran das liegen könnte?

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-12-2014 01

Ran by  (administrator) on -PC on 22-12-2014 16:28:34

Running from C:\Users\\Downloads

Loaded Profile: (Available profiles: )

Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Lenovo) C:\Windows\System32\ibmpmsvc.exe

(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe

() C:\Windows\System32\PSIService.exe

(Rocket Division Software) C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe

(Search Protect) C:\Program Files\SearchProtect\Main\bin\CltMngSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe

() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe

(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Dropbox, Inc.) C:\Users\\AppData\Roaming\Dropbox\bin\Dropbox.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [124720 2014-10-09] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-27] (Microsoft Corporation)

AppInit_DLLs: C:\PROGRA~1\SearchProtect\SearchProtect\bin\VC32Loader.dll => C:\Program Files\SearchProtect\SearchProtect\bin\VC32Loader.dll [188224 2014-11-10] (Search Protect)

Startup: C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

BootExecute: autocheck autochk * sdnclean.exe

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.

ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Suche

SearchScopes: HKLM -> DefaultScope value is missing.

SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> {88CAA9A2-B68E-49FB-962C-536CE4F2F887} URL = hxxp://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=041513&q={searchTerms}&src=IE-SearchBox

BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://sslvpn.landtag-bw.de/dana-cached/sc/JuniperSetupClient.cab

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

ShellExecuteHooks:  - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default

FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll ()

FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprphtml5videoshim;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=3 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=9 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)

FF user.js: detected! => C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\user.js

FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\11-suche.xml

FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-maps.xml

FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\webde-suche.xml

FF Extension: Adblock Plus - C:\Users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]

FF Extension: Recorder Toolbar - C:\Program Files\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2014-12-02]

FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-02]

FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-11-28]

FF HKLM\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files\AmiExt\flashEnhancer\ff
 

Chrome: 

=======

CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV=

CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV="

CHR DefaultSearchKeyword: Default -> trovi.search

CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS

CHR DefaultSuggestURL: Default -> hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}

CHR Profile: D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Präsentationen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-13]

CHR Extension: (Google Docs) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-13]

CHR Extension: (Google Drive) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-13]

CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-13]

CHR Extension: (YouTube) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-13]

CHR Extension: (Google Cast) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-09-13]

CHR Extension: (Google-Suche) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-13]

CHR Extension: (Google Tabellen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-13]

CHR Extension: (RealPlayer HTML5Video Downloader Extension) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2014-09-13]

CHR Extension: (Google Wallet) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-13]

CHR Extension: (Google Mail) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-13]

CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-11-28]
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [162096 2014-10-09] (Avira Operations GmbH & Co. KG)

R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 CltMngSvc; C:\Program Files\SearchProtect\Main\bin\CltMngSvc.exe [3056960 2014-11-10] (Search Protect)

R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-10-27] (Freemake) [File not signed]

R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [226624 2011-01-27] ()

R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()

R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]

R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [1858360 2014-07-14] (AVG)

R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [35640 2014-07-14] (AVG)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-07] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-10-07] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-14] (Avira Operations GmbH & Co. KG)

S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [16128 2014-04-11] (Silicon Laboratories)

S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [67968 2014-04-11] (Silicon Laboratories)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2011-11-27] () [File not signed]

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-14] (Avira GmbH)

R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2013-12-16] (TuneUp Software)

S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579712 2009-12-01] (eMPIA Technology, Inc.)

S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [543744 2009-12-01] (eMPIA Technology, Inc.)

U3 aczcqsny; C:\Windows\system32\Drivers\aczcqsny.sys [0 ] (Microsoft Corporation)

S3 catchme; \??\C:\Users\XX\AppData\Local\Temp\catchme.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

S3 SPPD; \??\C:\Windows\system32\drivers\SPPD.sys [X]

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-22 16:19 - 2014-12-22 16:21 - 00033386 _____ () C:\Users\XX\Downloads\Addition.txt

2014-12-22 16:15 - 2014-12-22 16:28 - 00018709 _____ () C:\Users\XX\Downloads\FRST.txt

2014-12-22 16:15 - 2014-12-22 16:28 - 00000000 ___DC () C:\FRST

2014-12-22 16:14 - 2014-12-22 16:14 - 01114112 _____ (Farbar) C:\Users\XX\Downloads\FRST.exe

2014-12-18 16:27 - 2014-12-18 16:27 - 00408376 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-12-18 10:44 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-12-15 20:21 - 2014-12-15 20:21 - 00001174 _____ () C:\Users\XX\Desktop\Mandatos 4.5.0.lnk

2014-12-15 20:14 - 2014-12-15 20:15 - 04059136 _____ () C:\Users\XX\Downloads\03_Mandatos_Setup_4_5_0_20141208(1).msi

2014-12-15 19:46 - 2014-12-15 19:47 - 04059136 _____ () C:\Users\XX\Downloads\03_Mandatos_Setup_4_5_0_20141208.msi

2014-12-11 11:45 - 2014-12-11 11:45 - 00000000 ____D () C:\Windows\system32\appraiser

2014-12-11 09:27 - 2014-12-11 09:27 - 07027178 _____ () C:\Users\XX\Downloads\wordpress-4.0.1-de_DE(1).zip

2014-12-11 09:21 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2014-12-10 16:49 - 2014-12-10 16:50 - 07027178 _____ () C:\Users\XX\Downloads\wordpress-4.0.1-de_DE.zip

2014-12-10 09:20 - 2014-12-04 05:38 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2014-12-10 09:20 - 2014-12-04 05:34 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-12-10 09:20 - 2014-12-02 00:28 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2014-12-10 09:20 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-12-10 09:20 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-12-10 09:20 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-12-10 09:20 - 2014-11-22 03:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-12-10 09:20 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-12-10 09:20 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-12-10 09:20 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-12-10 09:20 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-12-10 09:20 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-12-10 09:20 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-12-10 09:20 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-12-10 09:20 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-12-10 09:20 - 2014-11-22 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-12-10 09:20 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-12-10 09:20 - 2014-11-22 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-12-10 09:20 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-12-10 09:20 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-12-10 09:20 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-12-10 09:20 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-12-10 09:20 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-12-10 09:20 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-12-10 09:20 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-12-10 09:20 - 2014-11-22 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-12-10 09:20 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-12-10 09:20 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-12-10 09:20 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-12-10 09:20 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-12-10 09:20 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-12-10 09:20 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-12-10 09:20 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-12-10 09:20 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys

2014-12-10 09:19 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-12-10 09:19 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe

2014-12-10 09:19 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll

2014-12-10 09:19 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe

2014-12-08 20:41 - 2014-12-08 20:41 - 00047442 _____ () C:\Users\XX\Downloads\Termine Gremieninfo HD.ics

2014-12-02 16:09 - 2014-12-02 18:44 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird

2014-12-02 14:18 - 2014-12-02 14:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-11-28 14:22 - 2014-07-14 11:26 - 00025400 _____ (AVG) C:\Windows\system32\authuitu.dll

2014-11-28 14:19 - 2014-11-28 14:19 - 00000000 ____D () C:\Users\XX\AppData\Local\AVG

2014-11-28 14:19 - 2014-07-14 11:26 - 00035640 _____ (AVG) C:\Windows\system32\uxtuneup.dll

2014-11-28 14:14 - 2014-11-28 14:14 - 00002175 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk

2014-11-28 14:14 - 2014-11-28 14:14 - 00002151 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2014.lnk

2014-11-28 14:14 - 2014-07-14 11:26 - 00036152 _____ (AVG) C:\Windows\system32\TURegOpt.exe

2014-11-28 14:13 - 2014-11-28 14:13 - 00002163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2014.lnk

2014-11-28 14:13 - 2014-11-28 14:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2014
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-22 16:19 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-22 16:19 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-22 15:52 - 2012-09-22 20:06 - 00000000 ____D () C:\Users\XX\AppData\Roaming\Dropbox

2014-12-22 15:31 - 2011-11-27 10:12 - 01400998 _____ () C:\Windows\WindowsUpdate.log

2014-12-22 15:27 - 2014-11-10 11:12 - 00006509 _____ () C:\Windows\setupact.log

2014-12-20 13:00 - 2013-12-29 19:19 - 00000444 __RSH () C:\ProgramData\ntuser.pol

2014-12-19 15:51 - 2014-03-16 17:19 - 00000000 ____D () C:\Users\XX\AppData\Roaming\Winamp

2014-12-18 16:27 - 2014-11-14 17:03 - 00226192 _____ () C:\Windows\PFRO.log

2014-12-18 13:50 - 2011-11-27 10:23 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-18 11:26 - 2014-11-04 17:40 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2014-12-18 11:26 - 2014-01-09 22:25 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}

2014-12-17 18:20 - 2013-08-04 22:29 - 00000000 ____D () C:\Users\XX\AppData\Roaming\Spotify

2014-12-16 09:48 - 2012-09-22 20:29 - 00000970 _____ () C:\Users\XX\Desktop\Dropbox.lnk

2014-12-16 09:48 - 2012-09-22 20:28 - 00000000 ____D () C:\Users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-12-15 20:21 - 2012-01-16 19:51 - 00000000 ____D () C:\Users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Somacos

2014-12-11 11:48 - 2013-07-03 07:46 - 00000000 ____D () C:\Program Files\FileZilla FTP Client

2014-12-11 11:45 - 2014-05-07 06:45 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE

2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat

2014-12-11 09:26 - 2011-11-27 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-12-11 09:15 - 2013-07-30 06:47 - 00000000 ____D () C:\Windows\system32\MRT

2014-12-11 09:07 - 2011-11-27 10:57 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-12-10 17:05 - 2013-07-03 07:46 - 00000000 ____D () C:\Users\XX\AppData\Roaming\FileZilla

2014-12-10 17:04 - 2013-07-03 07:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client

2014-12-10 16:20 - 2014-01-22 21:24 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-12-03 00:28 - 2012-05-08 17:56 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-11-24 12:22 - 2014-09-10 14:26 - 00109280 _____ () C:\Users\XX\AppData\Local\GDIPFONTCACHEV1.DAT

2014-11-23 23:47 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF
 

Files to move or delete:

====================

C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job

C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job

C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job

C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job
 
 

Some content of TEMP:

====================

C:\Users\XX\AppData\Local\temp\avgnt.exe

C:\Users\XX\AppData\Local\temp\avgnt.exe

C:\Users\XX\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpamj6_f.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2013-09-01 14:11
 

==================== End Of Log ============================

--- --- ---

--- --- ---

FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 22-12-2014 01

Ran by XX at 2014-12-22 16:21:14

Running from C:\Users\XX\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )

Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.43 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Amazon MP3-Downloader 1.0.17 (HKLM\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)

Apple Application Support (HKLM\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)

ArcSoft ShowBiz (HKLM\...\{9D41D2EF-2D33-4CFD-8A3E-C7E6FCC3303B}) (Version:  - ArcSoft)

Ashampoo Burning Studio 14 v.14.0.5 (HKLM\...\{91B33C97-7BCF-CDFE-4321-58EBF3E8641C}_is1) (Version: 14.0.5 - Ashampoo GmbH & Co. KG)

Audacity 1.3.13 (Unicode) (HKLM\...\Audacity 1.3 Beta (Unicode)_is1) (Version:  - Audacity Team)

AudibleManager (HKLM\...\AudibleManager) (Version: 2004245216.48.56.22154610 - Audible, Inc.)

AVG PC TuneUp 2014 (de-DE) (Version: 14.0.1001.519 - AVG) Hidden

AVG PC TuneUp 2014 (HKLM\...\AVG PC TuneUp) (Version: 14.0.1001.519 - AVG)

AVG PC TuneUp 2014 (Version: 14.0.1001.519 - AVG) Hidden

Avira (HKLM\...\{dc9a688a-12cb-4a22-b449-23d849d01dc7}) (Version: 1.1.24.28609 - Avira Operations GmbH & Co. KG)

Avira (Version: 1.1.24.28609 - Avira Operations GmbH & Co. KG) Hidden

Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)

CCleaner (HKLM\...\CCleaner) (Version: 3.23 - Piriform)

ChromecastApp (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\{079ede36-133d-44b0-8053-c7c1fa8d2e0d}_is1) (Version: 1.5.316.0 - Google Inc.)

Deutsch - Custom (HKLM\...\{665DF8DD-C829-4DAB-A39C-9A0EF073F9F0}) (Version: 1.0.3.40 - Company)

Dropbox (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)

FileZilla Client 3.9.0.6 (HKLM\...\FileZilla Client) (Version: 3.9.0.6 - Tim Kosse)

Filzip 3.06 (HKLM\...\Filzip 3.0.6.93_is1) (Version: 3.0.6 - Philipp Engel)

FormatFactory 3.1.1 (HKLM\...\FormatFactory) (Version: 3.1.1 - Free Time)

Freemake Video Converter Version 4.1.5 (HKLM\...\Freemake Video Converter_is1) (Version: 4.1.5 - Ellora Assets Corporation)

GIMP 2.8.4 (HKLM\...\GIMP-2_is1) (Version: 2.8.4 - The GIMP Team)

Google Chrome (HKLM\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)

Intel(R) TV Wizard (HKLM\...\TVWiz) (Version:  - Intel Corporation)

IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.32 - Irfan Skiljan)

Java 7 Update 65 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)

KODAK Create@Home Software (für dm) (HKLM\...\{D42D2755-D8D7-43D4-8537-A21424CA15CD}) (Version: 7.6.1392 - Eastman Kodak Company)

Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5802.24 - PC-Doctor, Inc.)

LINE (HKLM\...\LINE) (Version: 3.7.0.34 - LINE Corporation)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Keyboard Layout Creator 1.4 (HKLM\...\{99E66BC9-E4B6-485F-ABFC-31EFCE36DFDF}) (Version: 1.4.6000 - Microsoft Corp.)

Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

MotoHelper 2.0.45 Driver 5.0.0 (HKLM\...\MotoHelper) (Version: 2.0.45 - Motorola)

MotoHelper MergeModules (Version: 1.2.0 - Motorola) Hidden

Motorola Mobile Drivers Installation 5.0.0 (Version: 5.0.0 - Motorola Inc.) Hidden

Mozilla Firefox 34.0 (x86 de) (HKLM\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.1 - Mozilla)

Mozilla Thunderbird 31.3.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.3.0 (x86 de)) (Version: 31.3.0 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

PDF24 Creator 5.2.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)

PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)

QuickTime (HKLM\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.)

RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden

RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden

Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Search Protect (HKLM\...\SearchProtect) (Version: 2.18.20.210 - Search Protect) <==== ATTENTION

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)

Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)

Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)

Somacos Mandatos (HKLM\...\{083263A0-7C2C-4A0F-BB1B-C9328D15BBED}) (Version: 4.5.0 - SOMACOS GmbH & Co. KG)

SparkleShare (HKLM\...\{184950D5-67F6-4D06-9717-7E2F1607A7B0}) (Version: 1.0.0 - SparkleShare)

Spotify (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)

StreamTransport version: 1.0.2.2171 (HKLM\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )

ThinkPad Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.43 - )

TreeSize Free V2.7 (HKLM\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)

USB Video/Audio Device Driver (HKLM\...\{3717C4F2-7412-4793-9BB8-D73D2817B3D6}) (Version: 1.00.0000 - Ihr Firmenname)

Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)

Winamp (HKLM\...\Winamp) (Version: 5.666  - Nullsoft, Inc)

Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports  (03/19/2014 6.7.0.0) (HKLM\...\B97004A400E30DCF940971EFA7A0C13C6B0A4B66) (Version: 03/19/2014 6.7.0.0 - Silicon Laboratories)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
 

==================== Restore Points  =========================
 

18-12-2014 15:54:17 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:04 - 2014-01-22 14:41 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {0885E870-83C3-4F12-A0BF-6FD45A2498FE} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-03-31] (PC-Doctor, Inc.)

Task: {2CB84D8E-D9D2-4359-956F-E473D828B94F} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-03-31] (PC-Doctor, Inc.)

Task: {36F211C8-7321-42D7-BDE1-810C22345365} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3209394106-3398393384-4106522146-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2011-11-08] (RealNetworks, Inc.)

Task: {5E8008A4-49B8-4B23-BE92-48CE97603B44} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-09-24] (Piriform Ltd)

Task: {7E5019A1-DAF8-41C0-9831-422BDDC64E04} - System32\Tasks\{F0566F61-5A90-4EF4-86D7-D7AC4D7A72BB} => Firefox.exe Skype für den Desktop herunterladen

Task: {832F7DE9-2342-469D-A014-337F65028019} - System32\Tasks\MT66 Software Update => C:\Program Files\Common Files\MT66 Software Update\UpdateClient.exe

Task: {882FA565-A9E1-444D-B23C-AF7AC99A4BE2} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3209394106-3398393384-4106522146-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2011-11-08] (RealNetworks, Inc.)

Task: {8AAE035D-A9CC-4B5C-9C50-B5189C6F81A6} - System32\Tasks\{A7244EDB-6CB7-4E28-89AA-8F7014BCA92A} => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe <==== ATTENTION

Task: {C09B71F7-C2F9-48CE-9E68-B4FC69B855FA} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {DA061B9D-4A6A-4956-BF03-CFF37A0A0C77} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-03-31] (PC-Doctor, Inc.)

Task: {F8674A3D-F331-4058-9BBF-68AAD48844F0} - System32\Tasks\{125248E9-6072-42A7-987B-521BBFA6112B} => pcalua.exe -a "C:\Program Files\Juniper Networks\Secure Application Manager\dsSamUI.exe" -d "C:\Program Files\Juniper Networks\Secure Application Manager" -c /Diagnostics
 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\AVG_REG_1213b.job => C:\ProgramData\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe

Task: C:\Windows\Tasks\AVG_SYS_TASK_DELETE.job => C:\ProgramData\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cff1b7fd95e51d.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0001f186f260e.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfcf34e5858b92.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfedc6350b29ae.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1d000b2c209d060.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\Launch 8613.job => C:\Program Files\Audible\Bin\Manager.exe

Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe

Task: C:\Windows\Tasks\SidebarExecute.job => C:\Program Files\Windows Sidebar\sidebar.exe

Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe

Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files\AVG\AVG PC TuneUp\OneClick.exe

Task: C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job => c:\program files\mozilla firefox\firefox.exe

Task: C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job => c:\program files\mozilla firefox\firefox.exe

Task: C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job => c:\program files\mozilla firefox\firefox.exe

Task: C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job => c:\program files\mozilla firefox\firefox.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-01-27 22:13 - 2011-01-27 22:13 - 00226624 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe

2007-06-05 13:20 - 2007-06-05 13:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe

2014-07-14 11:26 - 2014-07-14 11:26 - 00585528 _____ () C:\Program Files\AVG\AVG PC TuneUp\avgreplibx.dll

2014-07-14 11:26 - 2014-07-14 11:26 - 00357176 _____ () C:\Program Files\AVG\AVG PC TuneUp\tuavgx.dll

2011-01-27 22:13 - 2011-01-27 22:13 - 00673088 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe

2014-12-02 14:18 - 2014-12-02 14:18 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2014-12-02 16:09 - 2014-12-02 16:09 - 03339376 _____ () C:\Program Files\Mozilla Thunderbird\mozjs.dll

2014-12-02 16:09 - 2014-12-02 16:09 - 00158832 _____ () C:\Program Files\Mozilla Thunderbird\NSLDAP32V60.dll

2014-12-02 16:09 - 2014-12-02 16:09 - 00023152 _____ () C:\Program Files\Mozilla Thunderbird\NSLDAPPR32V60.dll

2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\XX\AppData\Roaming\Dropbox\bin\libGLESv2.dll

2014-12-22 15:52 - 2014-12-22 15:52 - 00043008 _____ () c:\users\XX\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpamj6_f.dll

2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\XX\AppData\Roaming\Dropbox\bin\libEGL.dll

2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\XX\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll

2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\XX\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll

2014-10-16 10:15 - 2014-10-16 10:15 - 00035328 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll

2014-05-24 17:41 - 2014-05-24 17:41 - 00091648 _____ () C:\Program Files\FileZilla FTP Client\libgcc_s_sjlj-1.dll

2014-05-24 17:41 - 2014-05-24 17:41 - 00892416 _____ () C:\Program Files\FileZilla FTP Client\libstdc++-6.dll
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup

MSCONFIG\startupfolder: C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupfolder: C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SparkleShare.lnk => C:\Windows\pss\SparkleShare.lnk.Startup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: avgnt => "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

MSCONFIG\startupreg: Avira Systray => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe

MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

MSCONFIG\startupreg: OfficeSyncProcess => "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"

MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\XX\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-3209394106-3398393384-4106522146-500 - Administrator - Disabled)

XX (S-1-5-21-3209394106-3398393384-4106522146-1001 - Limited - Enabled) => C:\Users\XX

Gast (S-1-5-21-3209394106-3398393384-4106522146-501 - Limited - Disabled)

XX (S-1-5-21-3209394106-3398393384-4106522146-1000 - Administrator - Enabled) => C:\Users\XX
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (12/22/2014 04:08:45 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0x2e4

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (12/22/2014 04:08:30 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0xb5c

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (12/22/2014 04:08:19 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0x4bc

Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0

Pfad der fehlerhaften Anwendung: Explorer.EXE1

Pfad des fehlerhaften Moduls: Explorer.EXE2

Berichtskennung: Explorer.EXE3
 

Error: (12/22/2014 04:06:46 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0x2ec

Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0

Pfad der fehlerhaften Anwendung: Explorer.EXE1

Pfad des fehlerhaften Moduls: Explorer.EXE2

Berichtskennung: Explorer.EXE3
 

Error: (12/20/2014 02:05:07 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0x734

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (12/20/2014 01:42:20 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0xfc0

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (12/20/2014 01:42:07 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0xe04

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (12/20/2014 01:41:51 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0x5e4

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 

Error: (12/20/2014 01:41:30 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0x674

Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0

Pfad der fehlerhaften Anwendung: Explorer.EXE1

Pfad des fehlerhaften Moduls: Explorer.EXE2

Berichtskennung: Explorer.EXE3
 

Error: (12/19/2014 04:58:09 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0x155c

Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0

Pfad der fehlerhaften Anwendung: explorer.exe1

Pfad des fehlerhaften Moduls: explorer.exe2

Berichtskennung: explorer.exe3
 
 

System errors:

=============

Error: (12/20/2014 07:10:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.
 

Error: (12/19/2014 05:12:16 PM) (Source: Disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 

Error: (12/18/2014 11:43:29 AM) (Source: volsnap) (EventID: 36) (User: )

Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 

Error: (12/18/2014 10:50:46 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎18.‎12.‎2014 um 10:48:39 unerwartet heruntergefahren.
 

Error: (12/18/2014 10:32:21 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
 

Error: (12/17/2014 04:17:13 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
 

Error: (12/17/2014 10:47:30 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
 

Error: (12/17/2014 02:56:02 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
 

Error: (12/17/2014 02:53:58 AM) (Source: Disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 

Error: (12/16/2014 02:23:09 PM) (Source: ACPI) (EventID: 13) (User: )

Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 
 

Microsoft Office Sessions:

=========================

Error: (12/22/2014 04:08:45 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f2e401d01df929588a8fC:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dll6c43145f-89ec-11e4-bab5-0016d3cc412f
 

Error: (12/22/2014 04:08:30 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812fb5c01d01df9214dbebbC:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dll63002f97-89ec-11e4-bab5-0016d3cc412f
 

Error: (12/22/2014 04:08:19 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Explorer.EXE6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f4bc01d01df8ebf6a8baC:\Windows\Explorer.EXEC:\Windows\system32\KERNELBASE.dll5caf08ab-89ec-11e4-bab5-0016d3cc412f
 

Error: (12/22/2014 04:06:46 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Explorer.EXE6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f2ec01d01df448979973C:\Windows\Explorer.EXEC:\Windows\system32\KERNELBASE.dll24f56119-89ec-11e4-bab5-0016d3cc412f
 

Error: (12/20/2014 02:05:07 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f73401d01c5266c93233C:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dlld1b8458d-8848-11e4-b61b-0016d3cc412f
 

Error: (12/20/2014 01:42:20 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812ffc001d01c5260687e2fC:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dlla2a3a489-8845-11e4-b61b-0016d3cc412f
 

Error: (12/20/2014 01:42:07 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812fe0401d01c5256582f0aC:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dll9b274730-8845-11e4-b61b-0016d3cc412f
 

Error: (12/20/2014 01:41:51 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f5e401d01c524a001354C:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dll91b226bd-8845-11e4-b61b-0016d3cc412f
 

Error: (12/20/2014 01:41:30 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Explorer.EXE6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f67401d01c4cf8628e00C:\Windows\Explorer.EXEC:\Windows\system32\KERNELBASE.dll851539af-8845-11e4-b61b-0016d3cc412f
 

Error: (12/19/2014 04:58:09 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: explorer.exe6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f155c01d01ba40b98fd42C:\Windows\explorer.exeC:\Windows\system32\KERNELBASE.dlld3a9024f-8797-11e4-8d45-0016d3cc412f
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM)2 Duo CPU L7300 @ 1.40GHz

Percentage of memory in use: 68%

Total physical RAM: 2006.3 MB

Available physical RAM: 634.27 MB

Total Pagefile: 4012.59 MB

Available Pagefile: 2298.15 MB

Total Virtual: 2047.88 MB

Available Virtual: 1893.87 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:58.5 GB) (Free:6.34 GB) NTFS

Drive d: (Volume) (Fixed) (Total:53.19 GB) (Free:4.27 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 97979797)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=58.5 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=53.2 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

--- --- ---

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Search Protect
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo Schrauber,

vielen Dank für Deine Hilfe. Hier nun das Logfile:

Code:

ComboFix 14-12-25.01 - XX 29.12.2014   8:54.1.2 - x86

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.2006.754 [GMT 1:00]

ausgeführt von:: c:\users\XX\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\Wajam

c:\program files\Wajam\Logos\amazon.ico

c:\program files\Wajam\Logos\argos.ico

c:\program files\Wajam\Logos\ask.ico

c:\program files\Wajam\Logos\bestbuy.ico

c:\program files\Wajam\Logos\ebay.ico

c:\program files\Wajam\Logos\etsy.ico

c:\program files\Wajam\Logos\facebook.ico

c:\program files\Wajam\Logos\favicon.ico

c:\program files\Wajam\Logos\google.ico

c:\program files\Wajam\Logos\homedepot.ico

c:\program files\Wajam\Logos\ikea.ico

c:\program files\Wajam\Logos\imdb.ico

c:\program files\Wajam\Logos\lowes.ico

c:\program files\Wajam\Logos\mercado.ico

c:\program files\Wajam\Logos\mysearchweb.ico

c:\program files\Wajam\Logos\myshopping.ico

c:\program files\Wajam\Logos\searchresult.ico

c:\program files\Wajam\Logos\sears.ico

c:\program files\Wajam\Logos\setting.ico

c:\program files\Wajam\Logos\settings.ico

c:\program files\Wajam\Logos\shopping.ico

c:\program files\Wajam\Logos\target.ico

c:\program files\Wajam\Logos\tesco.ico

c:\program files\Wajam\Logos\tripadvisor.ico

c:\program files\Wajam\Logos\twitter.ico

c:\program files\Wajam\Logos\wajam.ico

c:\program files\Wajam\Logos\walmart.ico

c:\program files\Wajam\Logos\wiki.ico

c:\program files\Wajam\Logos\yahoo.ico

c:\program files\Wajam\Logos\zalando.ico

c:\program files\Wajam\uninstall.exe

c:\program files\Wajam\Wajam Internet Enhancer\2845734c09907de22309ed6090c7c5b9

c:\program files\Wajam\Wajam Internet Enhancer\a12534f1688fe7d400f8d5ec8c062411

c:\program files\Wajam\Wajam Internet Enhancer\b3f4b05e3ab3a5e65883524e710a4e42

c:\program files\Wajam\Wajam Internet Enhancer\b8d1e876cfa4fcb16a595bf14b388061

c:\program files\Wajam\Wajam Internet Enhancer\d90d57d5aa65ebd01388d5922e5b1360

c:\program files\Wajam\Wajam Internet Enhancer\eb4aa542ea0da53cf3fa4900611dbcc2

c:\program files\Wajam\Wajam Internet Enhancer\FiddlerCore.dll

c:\program files\Wajam\Wajam Internet Enhancer\HtmlAgilityPack.dll

c:\program files\Wajam\Wajam Internet Enhancer\makecert.exe

c:\program files\Wajam\Wajam Internet Enhancer\Newtonsoft.Json.dll

c:\program files\Wajam\Wajam Internet Enhancer\WajamHttpServer.exe

c:\program files\Wajam\Wajam Internet Enhancer\WajamInternetEnhancer.exe

c:\program files\Wajam\Wajam Internet Enhancer\WajamInternetEnhancerService.exe

c:\program files\Wajam\Wajam Internet Enhancer\wie

c:\program files\Wajam\Wajam Internet Enhancer\WJManifest

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\Ask.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\Google.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\IMDb.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\Shopping.com.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\TripAdvisor.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\Wikipedia.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Search\Yahoo!.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Amazon.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Argos.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Ebay.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Etsy.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\HomeDepot.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Ikea.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Lowe's.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Mercadolivre.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\MyShopping.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Sears.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Target.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Tesco.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Walmart.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Explore Social Shopping\Zalando.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Settings.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\SignIn with Facebook.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\SignIn with Twitter.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Uninstall Wajam\uninstall.lnk

c:\programdata\Microsoft\Windows\Start Menu\Programs\Wajam\Wajam Website.lnk

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-11-28 bis 2014-12-29  ))))))))))))))))))))))))))))))

.

.

2014-12-29 08:04 . 2014-12-29 08:04        --------        d-----w-        c:\users\Public\AppData\Local\temp

2014-12-29 08:04 . 2014-12-29 08:04        --------        d-----w-        c:\users\Xx\AppData\Local\temp

2014-12-29 08:04 . 2014-12-29 08:04        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-12-29 07:46 . 2014-12-29 07:46        --------        dc----w-        C:\OETemp

2014-12-22 15:15 . 2014-12-22 15:32        --------        dc----w-        C:\FRST

2014-12-18 09:44 . 2014-12-13 03:33        115712        ----a-w-        c:\windows\system32\ieUnatt.exe

2014-12-15 19:21 . 2014-12-15 19:21        --------        d-----w-        d:\mail - lokale ordner\Local\Apps

2014-12-11 10:45 . 2014-12-11 10:45        --------        d-----w-        c:\windows\system32\appraiser

2014-12-11 08:21 . 2014-10-18 01:33        3209728        ----a-w-        c:\windows\system32\mf.dll

2014-12-10 08:19 . 2014-11-08 02:45        2048        ----a-w-        c:\windows\system32\tzres.dll

2014-12-10 08:19 . 2014-10-03 01:45        248832        ----a-w-        c:\windows\system32\WSManMigrationPlugin.dll

2014-12-10 08:19 . 2014-10-03 01:45        1177088        ----a-w-        c:\windows\system32\WsmSvc.dll

2014-12-10 08:19 . 2014-10-03 01:45        214016        ----a-w-        c:\windows\system32\WsmWmiPl.dll

2014-12-10 08:19 . 2014-10-03 01:45        145920        ----a-w-        c:\windows\system32\WsmAuto.dll

2014-12-10 08:19 . 2014-10-03 01:44        198656        ----a-w-        c:\windows\system32\WSManHTTPConfig.exe

2014-12-10 08:19 . 2014-10-30 01:45        155136        ----a-w-        c:\windows\system32\charmap.exe

2014-12-03 06:31 . 2014-12-03 06:31        227048        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll

2014-12-02 15:09 . 2014-12-02 17:44        --------        d-----w-        c:\program files\Mozilla Thunderbird

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-11-19 03:31 . 2014-11-19 03:31        1217192        ----a-w-        c:\windows\system32\FM20.DLL

2014-11-11 02:44 . 2014-11-19 10:11        186880        ----a-w-        c:\windows\system32\pku2u.dll

2014-11-11 02:44 . 2014-11-19 10:11        550912        ----a-w-        c:\windows\system32\kerberos.dll

2014-10-25 01:32 . 2014-11-12 12:52        67584        ----a-w-        c:\windows\system32\packager.dll

2014-10-18 01:33 . 2014-11-12 12:53        571904        ----a-w-        c:\windows\system32\oleaut32.dll

2014-10-14 01:56 . 2014-11-12 12:52        136632        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys

2014-10-14 01:50 . 2014-11-12 12:52        523776        ----a-w-        c:\windows\system32\termsrv.dll

2014-10-14 01:50 . 2014-11-12 12:53        2363904        ----a-w-        c:\windows\system32\msi.dll

2014-10-14 01:50 . 2014-11-12 12:52        1059840        ----a-w-        c:\windows\system32\lsasrv.dll

2014-10-14 01:47 . 2014-11-12 12:52        146432        ----a-w-        c:\windows\system32\msaudite.dll

2014-10-14 01:46 . 2014-11-12 12:52        681984        ----a-w-        c:\windows\system32\adtschema.dll

2014-10-10 00:45 . 2014-11-12 12:53        2379264        ----a-w-        c:\windows\system32\win32k.sys

2014-10-03 01:44 . 2014-11-12 12:53        442880        ----a-w-        c:\windows\system32\AUDIOKSE.dll

2014-10-03 01:44 . 2014-11-12 12:53        275968        ----a-w-        c:\windows\system32\EncDump.dll

2014-10-03 01:44 . 2014-11-12 12:53        475136        ----a-w-        c:\windows\system32\audiosrv.dll

2014-10-03 01:44 . 2014-11-12 12:53        374784        ----a-w-        c:\windows\system32\AudioEng.dll

2014-10-03 01:44 . 2014-11-12 12:53        195584        ----a-w-        c:\windows\system32\AudioSes.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2014-06-24 22:04        131480        ----a-w-        c:\users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2014-06-24 22:04        131480        ----a-w-        c:\users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2014-06-24 22:04        131480        ----a-w-        c:\users\XX\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"SpUninstallCleanUp"="REG delete HKEY_LOCAL_MACHINE\Software\SearchProtect" [X]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-05-27 280576]

.

c:\users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\XX\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-12-9 39207112]

OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableSecureUIAPath"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0sdnclean.exe

.

[HKLM\~\startupfolder\C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]

path=c:\users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

backup=c:\windows\pss\Dropbox.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk]

path=c:\users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

backup=c:\windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^XX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SparkleShare.lnk]

path=c:\users\XX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SparkleShare.lnk

backup=c:\windows\pss\SparkleShare.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2014-11-20 18:13        1021128        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]

2012-11-05 14:27        89184        ----a-w-        c:\program files\Microsoft Office\Office14\BCSSync.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Download Assistant]

2012-09-20 14:02        1425208        ----a-w-        c:\windows\System32\LogiLDA.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]

2014-10-14 20:01        720064        ----a-w-        c:\program files\Microsoft Office\Office14\MSOSYNC.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]

2014-10-16 10:10        1514040        ----a-w-        c:\users\XX\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2014-07-11 00:39        256896        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount

"Google Update"="d:\mail - lokale ordner\Local\Google\Update\GoogleUpdate.exe" /c

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"IgfxTray"=c:\windows\system32\igfxtray.exe

"Persistence"=c:\windows\system32\igfxpers.exe

"HotKeysCmds"=c:\windows\system32\hkcmd.exe

"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" -osboot

"PDFPrint"=c:\program files\PDF24\pdf24.exe

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"ArcSoft Connection Service"=c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

.

R2 Freemake Improver;Freemake Improver;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2014-10-27 108032]

R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-29 6016]

R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-11-22 102912]

R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2010-12-03 20352]

R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 8320]

R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2010-04-01 23424]

R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [2010-01-25 9472]

R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [2014-04-11 16128]

R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2014-04-11 67968]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2013-10-30 1343400]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-11-27 721904]

S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]

S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]

S2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [2011-01-27 226624]

S2 TuneUp.UtilitiesSvc;AVG PC TuneUp Service;c:\program files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [2014-07-14 1858360]

S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]

S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]

S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]

S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]

S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [2013-12-16 12320]

S4 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*Deregistered* - avipbb

*Deregistered* - ssmdrv

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-09-13 09:11        1096520        ----a-w-        c:\program files\Google\Chrome\Application\37.0.2062.120\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-01-22 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-17 20:20]

.

2014-01-11 c:\windows\Tasks\AVG_REG_1213b.job

- c:\programdata\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe [2014-01-11 18:06]

.

2014-01-11 c:\windows\Tasks\AVG_SYS_TASK_DELETE.job

- c:\programdata\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe [2014-01-11 18:06]

.

2014-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2014-09-13 09:10]

.

2014-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cff1b7fd95e51d.job

- c:\program files\Google\Update\GoogleUpdate.exe [2014-09-13 09:10]

.

2014-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore1d0001f186f260e.job

- c:\program files\Google\Update\GoogleUpdate.exe [2014-09-13 09:10]

.

2014-10-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfcf34e5858b92.job

- d:\mail - lokale ordner\Local\Google\Update\GoogleUpdate.exe [2014-09-13 09:14]

.

2014-11-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfedc6350b29ae.job

- d:\mail - lokale ordner\Local\Google\Update\GoogleUpdate.exe [2014-09-13 09:14]

.

2014-11-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1d000b2c209d060.job

- d:\mail - lokale ordner\Local\Google\Update\GoogleUpdate.exe [2014-09-13 09:14]

.

2013-09-29 c:\windows\Tasks\Launch 8613.job

- c:\program files\Audible\Bin\Manager.exe [2014-11-04 11:19]

.

2013-08-25 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job

- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 22:04]

.

2014-01-09 c:\windows\Tasks\SidebarExecute.job

- c:\program files\Windows Sidebar\sidebar.exe [2011-11-27 12:17]

.

2013-09-01 c:\windows\Tasks\SystemToolsDailyTest.job

- c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 22:04]

.

2014-01-12 c:\windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job

- c:\program files\AVG\AVG PC TuneUp\OneClick.exe [2014-07-14 10:23]

.

2014-08-24 c:\windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job

- c:\program files\mozilla firefox\firefox.exe [2014-12-02 13:18]

.

2014-08-24 c:\windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job

- c:\program files\mozilla firefox\firefox.exe [2014-12-02 13:18]

.

2014-08-24 c:\windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job

- c:\program files\mozilla firefox\firefox.exe [2014-12-02 13:18]

.

2014-08-24 c:\windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job

- c:\program files\mozilla firefox\firefox.exe [2014-12-02 13:18]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV=

mStart Page = hxxp://www.google.com

IE: An OneNote s&enden - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.5.1

FF - ProfilePath - c:\users\XX\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)

MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir Desktop\avgnt.exe

MSConfigStartUp-Avira Systray - c:\program files\Avira\My Avira\Avira.OE.Systray.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2014-12-29  09:08:54

ComboFix-quarantined-files.txt  2014-12-29 08:08

.

Vor Suchlauf: 6.860.255.232 Bytes frei

Nach Suchlauf: 6.719.721.472 Bytes frei

.

- - End Of File - - 3C96F6C52ECFACD147DC1D54AEFE708D

A36C5E4F47E84449FF07ED3517B43A31

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

HTML-Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 30.12.2014

Suchlauf-Zeit: 14:42:58

Logdatei: male.txt

Administrator: Ja
 

Version: 2.00.4.1028

Malware Datenbank: v2014.12.30.05

Rootkit Datenbank: v2014.12.29.02

Lizenz: Testversion

Malware Schutz: Aktiviert

Bösartiger Webseiten Schutz: Aktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x86

Dateisystem: NTFS

Benutzer: XX
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 368868

Verstrichene Zeit: 35 Min, 56 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(Keine schädliche Elemente erkannt)
 

Module: 0

(Keine schädliche Elemente erkannt)
 

Registrierungsschlüssel: 0

(Keine schädliche Elemente erkannt)
 

Registrierungswerte: 0

(Keine schädliche Elemente erkannt)
 

Registrierungsdaten: 0

(Keine schädliche Elemente erkannt)
 

Ordner: 0

(Keine schädliche Elemente erkannt)
 

Dateien: 0

(Keine schädliche Elemente erkannt)
 

Physische Sektoren: 0

(Keine schädliche Elemente erkannt)
 
 

(end)

AdwCleaner Logfile:

Code:

# AdwCleaner v4.106 - Bericht erstellt am 30/12/2014 um 15:59:47

# Aktualisiert 21/12/2014 von Xplode

# Database : 2014-12-28.1 [Live]

# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)

# Benutzername : xx - xx-PC

# Gestartet von : C:\Users\xx\Downloads\AdwCleaner_4.106.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\Updater

Ordner Gelöscht : C:\ProgramData\Websteroids

Ordner Gelöscht : C:\ProgramData\SimaRtComppare

Ordner Gelöscht : C:\ProgramData\wEbbsaaver

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue

Ordner Gelöscht : C:\Program Files\AmiExt

Ordner Gelöscht : C:\Program Files\Uniblue

Ordner Gelöscht : C:\Program Files\Uninstaller

Ordner Gelöscht : C:\Users\xx\AppData\Roaming\Uniblue

Ordner Gelöscht : C:\Users\xx\AppData\Roaming\RHEng

Datei Gelöscht : C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\foxydeal.sqlite

Datei Gelöscht : C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\11-suche.xml

Datei Gelöscht : C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\user.js
 

***** [ Tasks ] *****
 

Task Gelöscht : DSite

Task Gelöscht : Lyrics-Pal Update

Task Gelöscht : QtraxPlayer
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm

Schlüssel Gelöscht : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKLM\SOFTWARE\VBMZ
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17496
 
 

-\\ Mozilla Firefox v34.0 (x86 de)
 

[rwyk3m6g.default\prefs.js] - Zeile gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
 

-\\ Google Chrome v37.0.2062.120
 

[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=

[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=

[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=

[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=

[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=

[D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=
 

*************************
 

AdwCleaner[R0].txt - [4623 octets] - [30/12/2014 15:40:05]

AdwCleaner[S0].txt - [4467 octets] - [30/12/2014 15:59:47]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4527 octets] ##########

--- --- ---

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.1 (12.28.2014:1)

OS: Windows 7 Professional x86

Ran by xx on 30.12.2014 at 16:12:48,73

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask

Successfully deleted: [File] "C:\Users\xx\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"

Successfully deleted: [File] "C:\Windows\wininit.ini"
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\ProgramData\pcdr"

Successfully deleted: [Folder] "C:\Users\xx\AppData\Roaming\pcdr"
 
 
 

~~~ FireFox
 

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\ext@flash-enhancer.com

Emptied folder: C:\Users\xx\AppData\Roaming\mozilla\firefox\profiles\rwyk3m6g.default\minidumps [214 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 30.12.2014 at 16:17:29,85

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-12-2014

Ran by xx (administrator) on xx-PC on 30-12-2014 16:38:07

Running from C:\Users\xx\Downloads

Loaded Profile: xx (Available profiles: xx & xx)

Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Lenovo) C:\Windows\System32\ibmpmsvc.exe

(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe

() C:\Windows\System32\PSIService.exe

(Rocket Division Software) C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe

() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe

(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Dropbox, Inc.) C:\Users\xx\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avcenter.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe

(Farbar) C:\Users\xx\Downloads\FRST(1).exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-27] (Microsoft Corporation)

Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\xx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

BootExecute: autocheck autochk * sdnclean.exe

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.

ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> {88CAA9A2-B68E-49FB-962C-536CE4F2F887} URL = hxxp://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=041513&q={searchTerms}&src=IE-SearchBox

BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://sslvpn.landtag-bw.de/dana-cached/sc/JuniperSetupClient.cab

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll ()

FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprphtml5videoshim;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=3 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=9 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-maps.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\webde-suche.xml

FF Extension: Adblock Plus - C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]

FF Extension: Recorder Toolbar - C:\Program Files\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2014-12-02]

FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-02]

FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-11-28]
 

Chrome: 

=======

CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV=

CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV="

CHR DefaultSearchKeyword: Default -> trovi.search

CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS

CHR DefaultSuggestURL: Default -> hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}

CHR Profile: D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Präsentationen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-13]

CHR Extension: (Google Docs) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-13]

CHR Extension: (Google Drive) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-13]

CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-13]

CHR Extension: (YouTube) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-13]

CHR Extension: (Google Cast) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-09-13]

CHR Extension: (Google-Suche) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-13]

CHR Extension: (Google Tabellen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-13]

CHR Extension: (RealPlayer HTML5Video Downloader Extension) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2014-09-13]

CHR Extension: (Google Wallet) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-13]

CHR Extension: (Google Mail) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-13]

CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-11-28]
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)

R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-10-27] (Freemake) [File not signed]

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [226624 2011-01-27] ()

R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()

R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]

R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [1858360 2014-07-14] (AVG)

R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [35640 2014-07-14] (AVG)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-24] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-24] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-11-24] (Avira Operations GmbH & Co. KG)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-12-30] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)

S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [16128 2014-04-11] (Silicon Laboratories)

S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [67968 2014-04-11] (Silicon Laboratories)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2011-11-27] () [File not signed]

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-11-24] (Avira GmbH)

R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2013-12-16] (TuneUp Software)

S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579712 2009-12-01] (eMPIA Technology, Inc.)

S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [543744 2009-12-01] (eMPIA Technology, Inc.)

U3 aom82ysh; C:\Windows\system32\Drivers\aom82ysh.sys [0 ] (Microsoft Corporation)

S3 catchme; \??\C:\Users\xx\AppData\Local\Temp\catchme.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-30 16:37 - 2014-12-30 16:37 - 01114624 _____ (Farbar) C:\Users\xx\Downloads\FRST(1).exe

2014-12-30 16:17 - 2014-12-30 16:17 - 00001256 _____ () C:\Users\xx\Desktop\JRT.txt

2014-12-30 16:10 - 2014-12-30 16:11 - 01707939 _____ (Thisisu) C:\Users\xx\Downloads\JRT.exe

2014-12-30 15:39 - 2014-12-30 15:39 - 02173952 _____ () C:\Users\xx\Downloads\AdwCleaner_4.106.exe

2014-12-30 14:42 - 2014-12-30 16:06 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-12-30 14:41 - 2014-12-30 14:41 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ___DC () C:\Program Files\Malwarebytes Anti-Malware

2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-30 14:41 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-12-30 14:41 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-12-30 14:41 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-12-30 14:40 - 2014-12-30 14:40 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xx\Downloads\mbam-setup-2.0.4.1028.exe

2014-12-29 09:38 - 2014-12-29 09:36 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-12-29 09:36 - 2014-12-29 09:36 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Avira

2014-12-29 09:34 - 2014-12-29 09:34 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-12-29 09:33 - 2014-11-24 10:23 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-12-29 09:33 - 2014-11-24 10:23 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-12-29 09:33 - 2014-11-24 10:23 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-12-29 09:33 - 2014-11-24 10:23 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

2014-12-29 09:29 - 2014-12-29 09:32 - 154051656 _____ () C:\Users\xx\Downloads\avira_free_antivirus_de.exe

2014-12-29 09:19 - 2014-12-29 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-12-29 09:18 - 2014-12-29 09:18 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av_5747036816__ws.exe

2014-12-29 09:16 - 2014-12-29 09:22 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-12-29 09:16 - 2014-12-29 09:16 - 00000041 _____ () C:\Windows\Filzip.ini

2014-12-29 09:13 - 2014-12-29 09:33 - 00000000 ____D () C:\ProgramData\Avira

2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws.exe

2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws(1).exe

2014-12-29 09:13 - 2014-12-29 09:13 - 00000000 ____D () C:\ProgramData\Package Cache

2014-12-29 09:08 - 2014-12-29 09:08 - 00021410 ____C () C:\ComboFix.txt

2014-12-29 08:48 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-12-29 08:48 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-12-29 08:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2014-12-29 08:35 - 2014-12-29 09:08 - 00000000 ___DC () C:\Qoobox

2014-12-29 08:34 - 2014-12-29 08:34 - 05603624 ____R (Swearware) C:\Users\xx\Desktop\ComboFix.exe

2014-12-29 08:30 - 2014-12-29 08:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\xx\Downloads\revosetup95.exe

2014-12-22 16:19 - 2014-12-22 16:21 - 00033386 _____ () C:\Users\xx\Downloads\Addition.txt

2014-12-22 16:15 - 2014-12-30 16:38 - 00018020 _____ () C:\Users\xx\Downloads\FRST.txt

2014-12-22 16:15 - 2014-12-30 16:38 - 00000000 ___DC () C:\FRST

2014-12-22 16:14 - 2014-12-22 16:14 - 01114112 _____ (Farbar) C:\Users\xx\Downloads\FRST.exe

2014-12-18 16:27 - 2014-12-18 16:27 - 00408376 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-12-18 10:44 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-12-15 20:21 - 2014-12-15 20:21 - 00001174 _____ () C:\Users\xx\Desktop\Mandatos 4.5.0.lnk

2014-12-15 20:14 - 2014-12-15 20:15 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208(1).msi

2014-12-15 19:46 - 2014-12-15 19:47 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208.msi

2014-12-11 11:45 - 2014-12-11 11:45 - 00000000 ____D () C:\Windows\system32\appraiser

2014-12-11 09:27 - 2014-12-11 09:27 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE(1).zip

2014-12-11 09:21 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2014-12-10 16:49 - 2014-12-10 16:50 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE.zip

2014-12-10 09:20 - 2014-12-04 05:38 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2014-12-10 09:20 - 2014-12-04 05:34 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-12-10 09:20 - 2014-12-02 00:28 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2014-12-10 09:20 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-12-10 09:20 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-12-10 09:20 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-12-10 09:20 - 2014-11-22 03:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-12-10 09:20 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-12-10 09:20 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-12-10 09:20 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-12-10 09:20 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-12-10 09:20 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-12-10 09:20 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-12-10 09:20 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-12-10 09:20 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-12-10 09:20 - 2014-11-22 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-12-10 09:20 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-12-10 09:20 - 2014-11-22 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-12-10 09:20 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-12-10 09:20 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-12-10 09:20 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-12-10 09:20 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-12-10 09:20 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-12-10 09:20 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-12-10 09:20 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-12-10 09:20 - 2014-11-22 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-12-10 09:20 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-12-10 09:20 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-12-10 09:20 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-12-10 09:20 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-12-10 09:20 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-12-10 09:20 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-12-10 09:20 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-12-10 09:20 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys

2014-12-10 09:19 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-12-10 09:19 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe

2014-12-10 09:19 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll

2014-12-10 09:19 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe

2014-12-08 20:41 - 2014-12-08 20:41 - 00047442 _____ () C:\Users\xx\Downloads\Termine Gremieninfo HD.ics

2014-12-02 16:09 - 2014-12-02 18:44 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird

2014-12-02 14:18 - 2014-12-02 14:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-30 16:14 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-30 16:14 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-30 16:12 - 2014-01-22 21:41 - 00000000 ____D () C:\Windows\ERUNT

2014-12-30 16:07 - 2012-09-22 20:06 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Dropbox

2014-12-30 16:04 - 2014-11-14 17:03 - 00387242 _____ () C:\Windows\PFRO.log

2014-12-30 16:04 - 2014-11-10 11:12 - 00006957 _____ () C:\Windows\setupact.log

2014-12-30 16:04 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET

2014-12-30 16:03 - 2011-11-27 10:12 - 01532528 _____ () C:\Windows\WindowsUpdate.log

2014-12-30 16:00 - 2013-12-29 19:37 - 00000000 ___DC () C:\AdwCleaner

2014-12-30 14:41 - 2013-12-30 22:56 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-29 09:33 - 2014-02-19 17:55 - 00000000 ____D () C:\Program Files\Avira

2014-12-29 09:21 - 2013-12-29 19:19 - 00000444 __RSH () C:\ProgramData\ntuser.pol

2014-12-29 09:04 - 2009-07-14 03:04 - 00000215 ____C () C:\Windows\system.ini

2014-12-29 08:35 - 2014-01-22 14:13 - 00000000 ____D () C:\Windows\erdnt

2014-12-29 08:31 - 2014-07-31 12:55 - 00001226 _____ () C:\Users\xx\Desktop\Revo Uninstaller.lnk

2014-12-29 08:31 - 2014-07-31 12:55 - 00000000 ____D () C:\Program Files\VS Revo Group

2014-12-27 13:56 - 2014-01-09 22:27 - 00000000 ____D () C:\ProgramData\AVG

2014-12-27 13:49 - 2011-11-27 10:23 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-23 11:54 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF

2014-12-19 15:51 - 2014-03-16 17:19 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Winamp

2014-12-18 11:26 - 2014-11-04 17:40 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2014-12-18 11:26 - 2014-01-09 22:25 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}

2014-12-17 18:20 - 2013-08-04 22:29 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Spotify

2014-12-16 09:48 - 2012-09-22 20:29 - 00000970 _____ () C:\Users\xx\Desktop\Dropbox.lnk

2014-12-16 09:48 - 2012-09-22 20:28 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-12-15 20:21 - 2012-01-16 19:51 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Somacos

2014-12-11 11:48 - 2013-07-03 07:46 - 00000000 ____D () C:\Program Files\FileZilla FTP Client

2014-12-11 11:45 - 2014-05-07 06:45 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE

2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat

2014-12-11 09:26 - 2011-11-27 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-12-11 09:15 - 2013-07-30 06:47 - 00000000 ____D () C:\Windows\system32\MRT

2014-12-11 09:07 - 2011-11-27 10:57 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-12-10 17:05 - 2013-07-03 07:46 - 00000000 ____D () C:\Users\xx\AppData\Roaming\FileZilla

2014-12-10 17:04 - 2013-07-03 07:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client

2014-12-10 16:20 - 2014-01-22 21:24 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-12-03 00:28 - 2012-05-08 17:56 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
 

Files to move or delete:

====================

C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job

C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job

C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job

C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job
 
 

Some content of TEMP:

====================

C:\Users\xx\AppData\Local\temp\avgnt.exe

C:\Users\xx\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpjsidp6.dll

C:\Users\xx\AppData\Local\temp\Quarantine.exe

C:\Users\xx\AppData\Local\temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2013-09-01 14:11
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Leider schließt sich der Windows-Explorer immer noch wenn ich bestimmte Ordner öffnen möchte. Ich hoffe, es gibt noch mehr Schritte zu tun.

Lieben Dank
Jo

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.

ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> {88CAA9A2-B68E-49FB-962C-536CE4F2F887} URL = hxxp://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=041513&q={searchTerms}&src=IE-SearchBox

CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV=

CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV="

CHR DefaultSearchKeyword: Default -> trovi.search

CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS

CHR DefaultSuggestURL: Default -> hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}

C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job

C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job

C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job

C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job

Task: {8AAE035D-A9CC-4B5C-9C50-B5189C6F81A6} - System32\Tasks\{A7244EDB-6CB7-4E28-89AA-8F7014BCA92A} => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe <==== ATTENTION

Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

http://www.deeprybka.trojaner-board....r/wraioneu.PNG

Lade Dir bitte Windows Repair - All in one von tweaking.com hier herunter und installiere es.
Deaktiviere bitte (wenn möglich) Dein Antivirusprogramm.
Bedenke, dass die einzelnen Reparaturen einige Zeit benötigen. Starte keine anderen Anwendungen in dieser Zeit.
Starte das Programm und führe die Punkte 1-5 durch. (Siehe Bildanleitung)
Achte darauf, dass bei Dir die Häkchen so gesetzt sind wie unter Punkt 4.
Setze auch ein Häkchen bei "Restart/Shutdown System" und klicke "Restart System" an bevor Du Punkt 5 durchführst.

http://deeprybka.trojaner-board.de/b...srepair271.png

Hallo Schrauber,

ein schönes Neues Jahr - ich war unterwegs und hoffe, dass ich mein Laptop nun bald wieder zum Laufen bringe. Lieben Dank für Deine Hilfe.

Hier das neue Fixlog

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 07-01-2015

Ran by xx at 2015-01-08 10:38:39 Run:1

Running from C:\Users\xx\Desktop

Loaded Profile: xx (Available profiles: xx & xx)

Boot Mode: Normal
 

==============================================
 

Content of fixlist:

*****************

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.

ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000 -> {88CAA9A2-B68E-49FB-962C-536CE4F2F887} URL = hxxp://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=041513&q={searchTerms}&src=IE-SearchBox

CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV=

CHR StartupUrls: Default -> "hxxp://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=55&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SSPV="

CHR DefaultSearchKeyword: Default -> trovi.search

CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS

CHR DefaultSuggestURL: Default -> hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}

C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job

C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job

C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job

C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job

Task: {8AAE035D-A9CC-4B5C-9C50-B5189C6F81A6} - System32\Tasks\{A7244EDB-6CB7-4E28-89AA-8F7014BCA92A} => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe <==== ATTENTION

Emptytemp:

         

*****************
 

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.

C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.

"HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

"HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{88CAA9A2-B68E-49FB-962C-536CE4F2F887}" => Key deleted successfully.

HKCR\CLSID\{88CAA9A2-B68E-49FB-962C-536CE4F2F887} => Key not found. 

Chrome HomePage deleted successfully.

Chrome StartupUrls deleted successfully.

Chrome DefaultSearchKeyword deleted successfully.

CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS => Error: No automatic fix found for this entry.

Chrome DefaultSuggestURL deleted successfully.

C:\Windows\Tasks\{48A971AB-E6D1-4120-AF3C-E9009DDEC8BD}.job => Moved successfully.

C:\Windows\Tasks\{598C710E-F35E-48EA-8955-FDBA73822952}.job => Moved successfully.

C:\Windows\Tasks\{A0927963-4A51-4E06-BFB3-57BB2CCE9E0E}.job => Moved successfully.

C:\Windows\Tasks\{CECA4BAC-C098-4833-83D5-23EF456B4ED4}.job => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8AAE035D-A9CC-4B5C-9C50-B5189C6F81A6}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8AAE035D-A9CC-4B5C-9C50-B5189C6F81A6}" => Key deleted successfully.

C:\Windows\System32\Tasks\{A7244EDB-6CB7-4E28-89AA-8F7014BCA92A} => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A7244EDB-6CB7-4E28-89AA-8F7014BCA92A}" => Key deleted successfully.

EmptyTemp: => Removed 203.2 MB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog 10:46:24 ====

Windows Repair gemacht? danach dann bitte ein frisches FRST Log und berichten, wie der Rechner läuft :)

Repair durchgeführt. Aber leider stürtzt der Explorer immer noch ab, wenn ich Ordner öffne. Hier das neue FRST Log

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-01-2015

Ran by xx (administrator) on xx-PC on 08-01-2015 13:18:33

Running from C:\Users\xx\Desktop

Loaded Profile: xx (Available profiles: xx & xx)

Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Lenovo) C:\Windows\System32\ibmpmsvc.exe

(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe

() C:\Windows\System32\PSIService.exe

(Rocket Division Software) C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe

(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-27] (Microsoft Corporation)

IFEO\dropbox.exe: [Debugger] "C:\Program Files\AVG\AVG PC TuneUp\TUAutoReactivator32.exe"

Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\xx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

BootExecute: autocheck autochk * sdnclean.exe
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.

ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://sslvpn.landtag-bw.de/dana-cached/sc/JuniperSetupClient.cab

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll ()

FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprphtml5videoshim;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=3 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=9 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-maps.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\webde-suche.xml

FF Extension: Adblock Plus - C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]

FF Extension: Recorder Toolbar - C:\Program Files\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2014-12-02]

FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-02]

FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-11-28]
 

Chrome: 

=======

CHR DefaultSearchURL: Default -> hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=

CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS

CHR Profile: D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Präsentationen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-13]

CHR Extension: (Google Docs) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-13]

CHR Extension: (Google Drive) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-13]

CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-13]

CHR Extension: (YouTube) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-13]

CHR Extension: (Google Cast) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-09-13]

CHR Extension: (Google-Suche) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-13]

CHR Extension: (Google Tabellen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-13]

CHR Extension: (RealPlayer HTML5Video Downloader Extension) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2014-09-13]

CHR Extension: (Google Wallet) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-13]

CHR Extension: (Google Mail) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-13]

CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-11-28]
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)

R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-10-27] (Freemake) [File not signed]

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [226624 2011-01-27] ()

R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()

R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]

R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [1858360 2014-07-14] (AVG)

R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [35640 2014-07-14] (AVG)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 1394ohci; C:\Windows\system32\drivers\1394ohci.sys [164864 2010-11-20] (Microsoft Corporation) [File not signed]

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-24] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-24] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-11-24] (Avira Operations GmbH & Co. KG)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-01-08] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)

S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [16128 2014-04-11] (Silicon Laboratories)

S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [67968 2014-04-11] (Silicon Laboratories)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2011-11-27] () [File not signed]

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-11-24] (Avira GmbH)

R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2013-12-16] (TuneUp Software)

S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579712 2009-12-01] (eMPIA Technology, Inc.)

S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [543744 2009-12-01] (eMPIA Technology, Inc.)

U3 as80ik1i; C:\Windows\system32\Drivers\as80ik1i.sys [0 ] (Microsoft Corporation)

S3 catchme; \??\C:\Users\xx\AppData\Local\Temp\catchme.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-08 13:16 - 2015-01-08 13:16 - 00000000 ____D () C:\ProgramData\PCDr

2015-01-08 12:36 - 2015-01-08 12:36 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-xx-PC-Microsoft-Windows-7-Professional-(32-bit).dat

2015-01-08 12:35 - 2015-01-08 12:35 - 00000000 ___DC () C:\RegBackup

2015-01-08 11:51 - 2015-01-08 11:51 - 00003416 ____N () C:\bootsqm.dat

2015-01-08 11:00 - 2015-01-08 11:00 - 00002121 _____ () C:\Users\xx\Desktop\Tweaking.com - Windows Repair (All in One).lnk

2015-01-08 10:59 - 2015-01-08 10:59 - 00000000 ___DC () C:\Program Files\Tweaking.com

2015-01-08 10:59 - 2015-01-08 10:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com

2015-01-08 10:58 - 2015-01-08 10:59 - 09817304 _____ () C:\Users\xx\Downloads\tweaking.com_windows_repair_aio_setup.exe

2015-01-08 10:37 - 2015-01-08 10:37 - 00000000 ____D () C:\Users\xx\Desktop\FRST-OlderVersion

2014-12-30 16:37 - 2014-12-30 16:37 - 01114624 _____ (Farbar) C:\Users\xx\Downloads\FRST(1).exe

2014-12-30 16:17 - 2014-12-30 16:17 - 00001256 _____ () C:\Users\xx\Desktop\JRT.txt

2014-12-30 16:10 - 2014-12-30 16:11 - 01707939 _____ (Thisisu) C:\Users\xx\Downloads\JRT.exe

2014-12-30 15:39 - 2014-12-30 15:39 - 02173952 _____ () C:\Users\xx\Downloads\AdwCleaner_4.106.exe

2014-12-30 14:42 - 2015-01-08 13:15 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-12-30 14:41 - 2014-12-30 14:41 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ___DC () C:\Program Files\Malwarebytes Anti-Malware

2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-30 14:41 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-12-30 14:41 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-12-30 14:41 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-12-30 14:40 - 2014-12-30 14:40 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xx\Downloads\mbam-setup-2.0.4.1028.exe

2014-12-29 09:38 - 2014-12-29 09:36 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-12-29 09:36 - 2014-12-29 09:36 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Avira

2014-12-29 09:34 - 2014-12-29 09:34 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-12-29 09:33 - 2014-11-24 10:23 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-12-29 09:33 - 2014-11-24 10:23 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-12-29 09:33 - 2014-11-24 10:23 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-12-29 09:33 - 2014-11-24 10:23 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

2014-12-29 09:29 - 2014-12-29 09:32 - 154051656 _____ () C:\Users\xx\Downloads\avira_free_antivirus_de.exe

2014-12-29 09:19 - 2014-12-29 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-12-29 09:18 - 2014-12-29 09:18 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av_5747036816__ws.exe

2014-12-29 09:16 - 2014-12-30 17:20 - 00000041 _____ () C:\Windows\Filzip.ini

2014-12-29 09:16 - 2014-12-29 09:22 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-12-29 09:13 - 2014-12-29 09:33 - 00000000 ____D () C:\ProgramData\Avira

2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws.exe

2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws(1).exe

2014-12-29 09:13 - 2014-12-29 09:13 - 00000000 ____D () C:\ProgramData\Package Cache

2014-12-29 09:08 - 2014-12-29 09:08 - 00021410 ____C () C:\ComboFix.txt

2014-12-29 08:48 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-12-29 08:48 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-12-29 08:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2014-12-29 08:35 - 2014-12-29 09:08 - 00000000 ___DC () C:\Qoobox

2014-12-29 08:34 - 2014-12-29 08:34 - 05603624 ____R (Swearware) C:\Users\xx\Desktop\ComboFix.exe

2014-12-29 08:30 - 2014-12-29 08:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\xx\Downloads\revosetup95.exe

2014-12-22 16:19 - 2014-12-22 16:21 - 00033386 _____ () C:\Users\xx\Downloads\Addition.txt

2014-12-22 16:15 - 2015-01-08 13:21 - 00017084 _____ () C:\Users\xx\Desktop\FRST.txt

2014-12-22 16:15 - 2015-01-08 13:18 - 00000000 ___DC () C:\FRST

2014-12-22 16:14 - 2015-01-08 10:37 - 01115648 ____C (Farbar) C:\Users\xx\Desktop\FRST.exe

2014-12-18 16:27 - 2015-01-08 13:05 - 00408376 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-12-18 10:44 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-12-15 20:21 - 2014-12-15 20:21 - 00001174 _____ () C:\Users\xx\Desktop\Mandatos 4.5.0.lnk

2014-12-15 20:14 - 2014-12-15 20:15 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208(1).msi

2014-12-15 19:46 - 2014-12-15 19:47 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208.msi

2014-12-11 11:45 - 2014-12-11 11:45 - 00000000 ____D () C:\Windows\system32\appraiser

2014-12-11 09:27 - 2014-12-11 09:27 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE(1).zip

2014-12-11 09:21 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2014-12-10 16:49 - 2014-12-10 16:50 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE.zip

2014-12-10 09:20 - 2014-12-04 05:38 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2014-12-10 09:20 - 2014-12-04 05:34 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-12-10 09:20 - 2014-12-02 00:28 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2014-12-10 09:20 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-12-10 09:20 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-12-10 09:20 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-12-10 09:20 - 2014-11-22 03:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-12-10 09:20 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-12-10 09:20 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-12-10 09:20 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-12-10 09:20 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-12-10 09:20 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-12-10 09:20 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-12-10 09:20 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-12-10 09:20 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-12-10 09:20 - 2014-11-22 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-12-10 09:20 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-12-10 09:20 - 2014-11-22 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-12-10 09:20 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-12-10 09:20 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-12-10 09:20 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-12-10 09:20 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-12-10 09:20 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-12-10 09:20 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-12-10 09:20 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-12-10 09:20 - 2014-11-22 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-12-10 09:20 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-12-10 09:20 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-12-10 09:20 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-12-10 09:20 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-12-10 09:20 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-12-10 09:20 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-12-10 09:20 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-12-10 09:20 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys

2014-12-10 09:19 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-12-10 09:19 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe

2014-12-10 09:19 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll

2014-12-10 09:19 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-08 13:17 - 2011-11-27 10:23 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-01-08 13:16 - 2011-11-27 10:44 - 00000466 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job

2015-01-08 13:15 - 2014-09-12 10:39 - 00109280 _____ () C:\Users\xx\AppData\Local\GDIPFONTCACHEV1.DAT

2015-01-08 13:14 - 2011-11-27 10:44 - 00000528 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job

2015-01-08 13:12 - 2011-11-27 10:12 - 01609117 _____ () C:\Windows\WindowsUpdate.log

2015-01-08 13:11 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-01-08 13:11 - 2009-07-14 05:34 - 00016912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-01-08 13:06 - 2014-11-10 11:12 - 00007349 _____ () C:\Windows\setupact.log

2015-01-08 13:06 - 2009-07-14 09:55 - 00000000 ___RD () C:\Users\Public\Recorded TV

2015-01-08 13:06 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-01-08 13:05 - 2014-11-14 17:03 - 00388260 _____ () C:\Windows\PFRO.log

2015-01-08 13:05 - 2009-07-14 09:55 - 00000000 ____D () C:\Windows\CSC

2015-01-08 10:49 - 2013-12-29 19:19 - 00000008 __RSH () C:\ProgramData\ntuser.pol

2015-01-08 10:39 - 2009-07-14 03:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy

2014-12-30 19:18 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF

2014-12-30 16:12 - 2014-01-22 21:41 - 00000000 ____D () C:\Windows\ERUNT

2014-12-30 16:07 - 2012-09-22 20:06 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Dropbox

2014-12-30 16:04 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET

2014-12-30 16:00 - 2013-12-29 19:37 - 00000000 ___DC () C:\AdwCleaner

2014-12-30 14:41 - 2013-12-30 22:56 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-29 09:33 - 2014-02-19 17:55 - 00000000 ____D () C:\Program Files\Avira

2014-12-29 09:04 - 2009-07-14 03:04 - 00000215 ____C () C:\Windows\system.ini

2014-12-29 08:35 - 2014-01-22 14:13 - 00000000 ____D () C:\Windows\erdnt

2014-12-29 08:31 - 2014-07-31 12:55 - 00001226 _____ () C:\Users\xx\Desktop\Revo Uninstaller.lnk

2014-12-29 08:31 - 2014-07-31 12:55 - 00000000 ____D () C:\Program Files\VS Revo Group

2014-12-27 13:56 - 2014-01-09 22:27 - 00000000 ____D () C:\ProgramData\AVG

2014-12-19 15:51 - 2014-03-16 17:19 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Winamp

2014-12-18 11:26 - 2014-11-04 17:40 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2014-12-18 11:26 - 2014-01-09 22:25 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}

2014-12-17 18:20 - 2013-08-04 22:29 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Spotify

2014-12-16 09:48 - 2012-09-22 20:29 - 00000970 _____ () C:\Users\xx\Desktop\Dropbox.lnk

2014-12-16 09:48 - 2012-09-22 20:28 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-12-15 20:21 - 2012-01-16 19:51 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Somacos

2014-12-11 11:48 - 2013-07-03 07:46 - 00000000 ____D () C:\Program Files\FileZilla FTP Client

2014-12-11 11:45 - 2014-05-07 06:45 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE

2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat

2014-12-11 09:26 - 2011-11-27 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-12-11 09:15 - 2013-07-30 06:47 - 00000000 ____D () C:\Windows\system32\MRT

2014-12-11 09:07 - 2011-11-27 10:57 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-12-10 17:05 - 2013-07-03 07:46 - 00000000 ____D () C:\Users\xx\AppData\Roaming\FileZilla

2014-12-10 17:04 - 2013-07-03 07:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client

2014-12-10 16:20 - 2014-01-22 21:24 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
 

Some content of TEMP:

====================

C:\Users\xx\AppData\Local\temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2013-09-01 14:11
 

==================== End Of Log ============================

--- --- ---

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.

ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915

Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

FRST öffnen, Haken setzen bei Addition und scannen, poste bitte beide Logfiles.

Alles klar. Mache ich direkt. Was mir aufgefallen ist: Der Explorer stürzt hauptsächlich auf der Partition D ab.

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-01-2015

Ran by xx (administrator) on xx-PC on 08-01-2015 19:45:20

Running from C:\Users\xx\Desktop

Loaded Profile: xx (Available profiles: xx & xx)

Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Lenovo) C:\Windows\System32\ibmpmsvc.exe

(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe

() C:\Windows\System32\PSIService.exe

(Rocket Division Software) C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe

(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe

(Microsoft Corporation) C:\Windows\System32\schtasks.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\RunOnce: [Adobe Speed Launcher] => 1420742672

HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-27] (Microsoft Corporation)

IFEO\dropbox.exe: [Debugger] "C:\Program Files\AVG\AVG PC TuneUp\TUAutoReactivator32.exe"

Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\xx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk

ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

BootExecute: autocheck autochk * sdnclean.exe
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.

ProxyServer: [.DEFAULT] => http=127.0.0.1:54915;https=127.0.0.1:54915

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://sslvpn.landtag-bw.de/dana-cached/sc/JuniperSetupClient.cab

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll ()

FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprphtml5videoshim;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=15.0.0.198 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll No File

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=3 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: @tools.google.com/Google Update;version=9 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-3209394106-3398393384-4106522146-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\google-maps.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\searchplugins\webde-suche.xml

FF Extension: Adblock Plus - C:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\rwyk3m6g.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]

FF Extension: Recorder Toolbar - C:\Program Files\Mozilla Firefox\extensions\{10743931-94DF-476f-A987-4391233C17A2} [2014-12-02]

FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-02]

FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-11-28]
 

Chrome: 

=======

CHR DefaultSearchURL: Default -> hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=58&CUI=&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&q={searchTerms}&SSPV=

CHR DefaultNewTabURL: Default -> https://www.trovi.com/?gd=&ctid=CT3331617&octid=EB_ORIGINAL_CTID&ISID=MD7530D7A-8195-4851-9994-50E389DBA6CB&SearchSource=69&CUI=&SSPV=&lay=5&p=cnts&UM=6&UP=SP4789A562-15A2-4BFC-9806-D9ED810BFBF5&SAT=CNTS

CHR Profile: D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Präsentationen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-13]

CHR Extension: (Google Docs) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-13]

CHR Extension: (Google Drive) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-13]

CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-13]

CHR Extension: (YouTube) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-13]

CHR Extension: (Google Cast) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-09-13]

CHR Extension: (Google-Suche) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-13]

CHR Extension: (Google Tabellen) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-13]

CHR Extension: (RealPlayer HTML5Video Downloader Extension) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2014-09-13]

CHR Extension: (Google Wallet) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-13]

CHR Extension: (Google Mail) - D:\Mail - Lokale Ordner\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-13]

CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-11-28]
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)

R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-10-27] (Freemake) [File not signed]

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [226624 2011-01-27] ()

R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()

R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]

R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [1858360 2014-07-14] (AVG)

R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [35640 2014-07-14] (AVG)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-24] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-24] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-11-24] (Avira Operations GmbH & Co. KG)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-01-08] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)

S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [16128 2014-04-11] (Silicon Laboratories)

S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [67968 2014-04-11] (Silicon Laboratories)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2011-11-27] () [File not signed]

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-11-24] (Avira GmbH)

R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2013-12-16] (TuneUp Software)

S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579712 2009-12-01] (eMPIA Technology, Inc.)

S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [543744 2009-12-01] (eMPIA Technology, Inc.)

U3 a4spxyav; C:\Windows\system32\Drivers\a4spxyav.sys [0 ] (Microsoft Corporation)

S3 catchme; \??\C:\Users\xx\AppData\Local\Temp\catchme.sys [X]

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-08 18:58 - 2015-01-08 18:58 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\18FF3EA4.sys

2015-01-08 13:30 - 2015-01-08 13:30 - 00000000 ____D () C:\Users\xx\AppData\Roaming\PCDr

2015-01-08 13:22 - 2015-01-08 13:23 - 00031767 _____ () C:\Users\xx\Desktop\Addition.txt

2015-01-08 13:16 - 2015-01-08 13:31 - 00000000 ____D () C:\ProgramData\PCDr

2015-01-08 12:36 - 2015-01-08 12:36 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-xx-PC-Microsoft-Windows-7-Professional-(32-bit).dat

2015-01-08 12:35 - 2015-01-08 12:35 - 00000000 ___DC () C:\RegBackup

2015-01-08 11:00 - 2015-01-08 11:00 - 00002121 _____ () C:\Users\xx\Desktop\Tweaking.com - Windows Repair (All in One).lnk

2015-01-08 10:59 - 2015-01-08 10:59 - 00000000 ___DC () C:\Program Files\Tweaking.com

2015-01-08 10:59 - 2015-01-08 10:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com

2015-01-08 10:58 - 2015-01-08 10:59 - 09817304 _____ () C:\Users\xx\Downloads\tweaking.com_windows_repair_aio_setup.exe

2015-01-08 10:37 - 2015-01-08 10:37 - 00000000 ____D () C:\Users\xx\Desktop\FRST-OlderVersion

2014-12-30 16:37 - 2014-12-30 16:37 - 01114624 _____ (Farbar) C:\Users\xx\Downloads\FRST(1).exe

2014-12-30 16:17 - 2014-12-30 16:17 - 00001256 _____ () C:\Users\xx\Desktop\JRT.txt

2014-12-30 16:10 - 2014-12-30 16:11 - 01707939 _____ (Thisisu) C:\Users\xx\Downloads\JRT.exe

2014-12-30 15:39 - 2014-12-30 15:39 - 02173952 _____ () C:\Users\xx\Downloads\AdwCleaner_4.106.exe

2014-12-30 14:42 - 2015-01-08 19:41 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-12-30 14:41 - 2014-12-30 14:41 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ___DC () C:\Program Files\Malwarebytes Anti-Malware

2014-12-30 14:41 - 2014-12-30 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-30 14:41 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-12-30 14:41 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-12-30 14:41 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-12-30 14:40 - 2014-12-30 14:40 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xx\Downloads\mbam-setup-2.0.4.1028.exe

2014-12-29 09:38 - 2014-12-29 09:36 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-12-29 09:36 - 2014-12-29 09:36 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Avira

2014-12-29 09:34 - 2014-12-29 09:34 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-12-29 09:33 - 2014-11-24 10:23 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-12-29 09:33 - 2014-11-24 10:23 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-12-29 09:33 - 2014-11-24 10:23 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-12-29 09:33 - 2014-11-24 10:23 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

2014-12-29 09:29 - 2014-12-29 09:32 - 154051656 _____ () C:\Users\xx\Downloads\avira_free_antivirus_de.exe

2014-12-29 09:19 - 2014-12-29 09:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-12-29 09:18 - 2014-12-29 09:18 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av_5747036816__ws.exe

2014-12-29 09:16 - 2014-12-30 17:20 - 00000041 _____ () C:\Windows\Filzip.ini

2014-12-29 09:16 - 2014-12-29 09:22 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-12-29 09:13 - 2014-12-29 09:33 - 00000000 ____D () C:\ProgramData\Avira

2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws.exe

2014-12-29 09:13 - 2014-12-29 09:13 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\xx\Downloads\avira_de_av___ws(1).exe

2014-12-29 09:13 - 2014-12-29 09:13 - 00000000 ____D () C:\ProgramData\Package Cache

2014-12-29 09:08 - 2014-12-29 09:08 - 00021410 ____C () C:\ComboFix.txt

2014-12-29 08:48 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-12-29 08:48 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-12-29 08:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2014-12-29 08:48 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2014-12-29 08:35 - 2014-12-29 09:08 - 00000000 ___DC () C:\Qoobox

2014-12-29 08:34 - 2014-12-29 08:34 - 05603624 ____R (Swearware) C:\Users\xx\Desktop\ComboFix.exe

2014-12-29 08:30 - 2014-12-29 08:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\xx\Downloads\revosetup95.exe

2014-12-22 16:19 - 2014-12-22 16:21 - 00033386 _____ () C:\Users\xx\Downloads\Addition.txt

2014-12-22 16:15 - 2015-01-08 19:46 - 00017262 _____ () C:\Users\xx\Desktop\FRST.txt

2014-12-22 16:15 - 2015-01-08 19:45 - 00000000 ___DC () C:\FRST

2014-12-22 16:14 - 2015-01-08 10:37 - 01115648 ____C (Farbar) C:\Users\xx\Desktop\FRST.exe

2014-12-18 16:27 - 2015-01-08 13:54 - 00408376 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-12-18 10:44 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-12-15 20:21 - 2014-12-15 20:21 - 00001174 _____ () C:\Users\xx\Desktop\Mandatos 4.5.0.lnk

2014-12-15 20:14 - 2014-12-15 20:15 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208(1).msi

2014-12-15 19:46 - 2014-12-15 19:47 - 04059136 _____ () C:\Users\xx\Downloads\03_Mandatos_Setup_4_5_0_20141208.msi

2014-12-11 11:45 - 2014-12-11 11:45 - 00000000 ____D () C:\Windows\system32\appraiser

2014-12-11 09:27 - 2014-12-11 09:27 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE(1).zip

2014-12-11 09:21 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2014-12-10 16:49 - 2014-12-10 16:50 - 07027178 _____ () C:\Users\xx\Downloads\wordpress-4.0.1-de_DE.zip

2014-12-10 09:20 - 2014-12-04 05:38 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-12-10 09:20 - 2014-12-04 05:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2014-12-10 09:20 - 2014-12-04 05:34 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-12-10 09:20 - 2014-12-02 00:28 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2014-12-10 09:20 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-12-10 09:20 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-12-10 09:20 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-12-10 09:20 - 2014-11-22 03:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-12-10 09:20 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-12-10 09:20 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-12-10 09:20 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-12-10 09:20 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-12-10 09:20 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-12-10 09:20 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-12-10 09:20 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-12-10 09:20 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-12-10 09:20 - 2014-11-22 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-12-10 09:20 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-12-10 09:20 - 2014-11-22 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-12-10 09:20 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-12-10 09:20 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-12-10 09:20 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-12-10 09:20 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-12-10 09:20 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-12-10 09:20 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-12-10 09:20 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-12-10 09:20 - 2014-11-22 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-12-10 09:20 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-12-10 09:20 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-12-10 09:20 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-12-10 09:20 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-12-10 09:20 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-12-10 09:20 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-12-10 09:20 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-12-10 09:20 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys

2014-12-10 09:19 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-12-10 09:19 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe

2014-12-10 09:19 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll

2014-12-10 09:19 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll

2014-12-10 09:19 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-01-08 19:44 - 2011-11-27 10:12 - 01619975 _____ () C:\Windows\WindowsUpdate.log

2015-01-08 19:39 - 2011-11-27 10:44 - 00000528 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job

2015-01-08 19:04 - 2009-07-14 05:34 - 00017136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-01-08 19:04 - 2009-07-14 05:34 - 00017136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-01-08 19:00 - 2011-11-27 10:23 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-01-08 18:55 - 2014-11-10 11:12 - 00007461 _____ () C:\Windows\setupact.log

2015-01-08 18:55 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-01-08 17:09 - 2013-08-04 22:29 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Spotify

2015-01-08 17:01 - 2014-09-13 10:11 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-08 14:23 - 2013-08-25 04:00 - 00000000 ____D () C:\Windows\rescache

2015-01-08 13:58 - 2014-10-17 21:27 - 00000000 ____D () C:\Temp

2015-01-08 13:58 - 2014-09-12 10:39 - 00109280 _____ () C:\Users\xx\AppData\Local\GDIPFONTCACHEV1.DAT

2015-01-08 13:54 - 2011-11-27 10:44 - 00000466 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job

2015-01-08 13:53 - 2014-11-14 17:03 - 00388614 _____ () C:\Windows\PFRO.log

2015-01-08 13:53 - 2009-07-14 09:55 - 00000000 ____D () C:\Windows\CSC

2015-01-08 13:06 - 2009-07-14 09:55 - 00000000 ___RD () C:\Users\Public\Recorded TV

2015-01-08 10:49 - 2013-12-29 19:19 - 00000008 __RSH () C:\ProgramData\ntuser.pol

2015-01-08 10:39 - 2009-07-14 03:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy

2014-12-30 19:18 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF

2014-12-30 16:12 - 2014-01-22 21:41 - 00000000 ____D () C:\Windows\ERUNT

2014-12-30 16:07 - 2012-09-22 20:06 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Dropbox

2014-12-30 16:04 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET

2014-12-30 16:00 - 2013-12-29 19:37 - 00000000 ___DC () C:\AdwCleaner

2014-12-30 14:41 - 2013-12-30 22:56 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-29 09:33 - 2014-02-19 17:55 - 00000000 ____D () C:\Program Files\Avira

2014-12-29 09:04 - 2009-07-14 03:04 - 00000215 ____C () C:\Windows\system.ini

2014-12-29 08:35 - 2014-01-22 14:13 - 00000000 ____D () C:\Windows\erdnt

2014-12-29 08:31 - 2014-07-31 12:55 - 00001226 _____ () C:\Users\xx\Desktop\Revo Uninstaller.lnk

2014-12-29 08:31 - 2014-07-31 12:55 - 00000000 ____D () C:\Program Files\VS Revo Group

2014-12-27 13:56 - 2014-01-09 22:27 - 00000000 ____D () C:\ProgramData\AVG

2014-12-19 15:51 - 2014-03-16 17:19 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Winamp

2014-12-18 11:26 - 2014-11-04 17:40 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2014-12-18 11:26 - 2014-01-09 22:25 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}

2014-12-16 09:48 - 2012-09-22 20:29 - 00000970 _____ () C:\Users\xx\Desktop\Dropbox.lnk

2014-12-16 09:48 - 2012-09-22 20:28 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-12-15 20:21 - 2012-01-16 19:51 - 00000000 ____D () C:\Users\xx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Somacos

2014-12-11 11:48 - 2013-07-03 07:46 - 00000000 ____D () C:\Program Files\FileZilla FTP Client

2014-12-11 11:45 - 2014-05-07 06:45 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE

2014-12-11 11:45 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat

2014-12-11 09:26 - 2011-11-27 10:53 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-12-11 09:15 - 2013-07-30 06:47 - 00000000 ____D () C:\Windows\system32\MRT

2014-12-11 09:07 - 2011-11-27 10:57 - 109818608 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-12-10 17:05 - 2013-07-03 07:46 - 00000000 ____D () C:\Users\xx\AppData\Roaming\FileZilla

2014-12-10 17:04 - 2013-07-03 07:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client

2014-12-10 16:20 - 2014-01-22 21:24 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
 

Some content of TEMP:

====================

C:\Users\xx\AppData\Local\temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-01-08 14:15
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-01-2015

Ran by xx at 2015-01-08 19:47:22

Running from C:\Users\xx\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )

Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.43 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Amazon MP3-Downloader 1.0.17 (HKLM\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)

Apple Application Support (HKLM\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)

ArcSoft ShowBiz (HKLM\...\{9D41D2EF-2D33-4CFD-8A3E-C7E6FCC3303B}) (Version:  - ArcSoft)

Ashampoo Burning Studio 14 v.14.0.5 (HKLM\...\{91B33C97-7BCF-CDFE-4321-58EBF3E8641C}_is1) (Version: 14.0.5 - Ashampoo GmbH & Co. KG)

Audacity 1.3.13 (Unicode) (HKLM\...\Audacity 1.3 Beta (Unicode)_is1) (Version:  - Audacity Team)

AudibleManager (HKLM\...\AudibleManager) (Version: 2004245216.48.56.22154610 - Audible, Inc.)

AVG PC TuneUp 2014 (de-DE) (Version: 14.0.1001.519 - AVG) Hidden

AVG PC TuneUp 2014 (HKLM\...\AVG PC TuneUp) (Version: 14.0.1001.519 - AVG)

AVG PC TuneUp 2014 (Version: 14.0.1001.519 - AVG) Hidden

Avira (HKLM\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)

Avira (Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden

Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)

CCleaner (HKLM\...\CCleaner) (Version: 3.23 - Piriform)

ChromecastApp (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\{079ede36-133d-44b0-8053-c7c1fa8d2e0d}_is1) (Version: 1.5.316.0 - Google Inc.)

Deutsch - Custom (HKLM\...\{665DF8DD-C829-4DAB-A39C-9A0EF073F9F0}) (Version: 1.0.3.40 - Company)

Dropbox (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)

FileZilla Client 3.9.0.6 (HKLM\...\FileZilla Client) (Version: 3.9.0.6 - Tim Kosse)

Filzip 3.06 (HKLM\...\Filzip 3.0.6.93_is1) (Version: 3.0.6 - Philipp Engel)

FormatFactory 3.1.1 (HKLM\...\FormatFactory) (Version: 3.1.1 - Free Time)

Freemake Video Converter Version 4.1.5 (HKLM\...\Freemake Video Converter_is1) (Version: 4.1.5 - Ellora Assets Corporation)

GIMP 2.8.4 (HKLM\...\GIMP-2_is1) (Version: 2.8.4 - The GIMP Team)

Google Chrome (HKLM\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)

Intel(R) TV Wizard (HKLM\...\TVWiz) (Version:  - Intel Corporation)

IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.32 - Irfan Skiljan)

Java 7 Update 65 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)

KODAK Create@Home Software (für dm) (HKLM\...\{D42D2755-D8D7-43D4-8537-A21424CA15CD}) (Version: 7.6.1392 - Eastman Kodak Company)

Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5802.24 - PC-Doctor, Inc.)

LINE (HKLM\...\LINE) (Version: 3.7.0.34 - LINE Corporation)

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Keyboard Layout Creator 1.4 (HKLM\...\{99E66BC9-E4B6-485F-ABFC-31EFCE36DFDF}) (Version: 1.4.6000 - Microsoft Corp.)

Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

MotoHelper 2.0.45 Driver 5.0.0 (HKLM\...\MotoHelper) (Version: 2.0.45 - Motorola)

MotoHelper MergeModules (Version: 1.2.0 - Motorola) Hidden

Motorola Mobile Drivers Installation 5.0.0 (Version: 5.0.0 - Motorola Inc.) Hidden

Mozilla Firefox 34.0 (x86 de) (HKLM\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.1 - Mozilla)

Mozilla Thunderbird 31.3.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.3.0 (x86 de)) (Version: 31.3.0 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

PDF24 Creator 5.2.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)

PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)

QuickTime (HKLM\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.)

RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden

RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden

Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)

Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)

Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)

Somacos Mandatos (HKLM\...\{083263A0-7C2C-4A0F-BB1B-C9328D15BBED}) (Version: 4.5.0 - SOMACOS GmbH & Co. KG)

SparkleShare (HKLM\...\{184950D5-67F6-4D06-9717-7E2F1607A7B0}) (Version: 1.0.0 - SparkleShare)

Spotify (HKU\S-1-5-21-3209394106-3398393384-4106522146-1000\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)

StreamTransport version: 1.0.2.2171 (HKLM\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )

ThinkPad Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.43 - )

TreeSize Free V2.7 (HKLM\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)

Tweaking.com - Windows Repair (All in One) (HKLM\...\Tweaking.com - Windows Repair (All in One)) (Version: 2.10.2 - Tweaking.com)

USB Video/Audio Device Driver (HKLM\...\{3717C4F2-7412-4793-9BB8-D73D2817B3D6}) (Version: 1.00.0000 - Ihr Firmenname)

Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)

Winamp (HKLM\...\Winamp) (Version: 5.666  - Nullsoft, Inc)

Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports  (03/19/2014 6.7.0.0) (HKLM\...\B97004A400E30DCF940971EFA7A0C13C6B0A4B66) (Version: 03/19/2014 6.7.0.0 - Silicon Laboratories)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> D:\Mail - Lokale Ordner\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3209394106-3398393384-4106522146-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xx\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
 

==================== Restore Points  =========================
 

08-01-2015 12:35:19 Tweaking.com - Windows Repair
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:04 - 2014-12-29 09:04 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {0885E870-83C3-4F12-A0BF-6FD45A2498FE} - \PCDoctorBackgroundMonitorTask No Task File <==== ATTENTION

Task: {2CB84D8E-D9D2-4359-956F-E473D828B94F} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-03-31] (PC-Doctor, Inc.)

Task: {36F211C8-7321-42D7-BDE1-810C22345365} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3209394106-3398393384-4106522146-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2011-11-08] (RealNetworks, Inc.)

Task: {5E8008A4-49B8-4B23-BE92-48CE97603B44} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-09-24] (Piriform Ltd)

Task: {64E0988E-9B9A-4EE9-918C-7B939239BBD4} - System32\Tasks\MotoHelper Initial Update => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-01-27] ()

Task: {7E5019A1-DAF8-41C0-9831-422BDDC64E04} - System32\Tasks\{F0566F61-5A90-4EF4-86D7-D7AC4D7A72BB} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&amp;page=tsInstall

Task: {832F7DE9-2342-469D-A014-337F65028019} - System32\Tasks\MT66 Software Update => C:\Program Files\Common Files\MT66 Software Update\UpdateClient.exe

Task: {882FA565-A9E1-444D-B23C-AF7AC99A4BE2} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3209394106-3398393384-4106522146-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2011-11-08] (RealNetworks, Inc.)

Task: {C09B71F7-C2F9-48CE-9E68-B4FC69B855FA} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {DA061B9D-4A6A-4956-BF03-CFF37A0A0C77} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-03-31] (PC-Doctor, Inc.)

Task: {F8674A3D-F331-4058-9BBF-68AAD48844F0} - System32\Tasks\{125248E9-6072-42A7-987B-521BBFA6112B} => pcalua.exe -a "C:\Program Files\Juniper Networks\Secure Application Manager\dsSamUI.exe" -d "C:\Program Files\Juniper Networks\Secure Application Manager" -c /Diagnostics
 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\AVG_REG_1213b.job => C:\ProgramData\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe

Task: C:\Windows\Tasks\AVG_SYS_TASK_DELETE.job => C:\ProgramData\AVG 1213b Campaign\AVG-Secure-Search-Update-1213b.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cff1b7fd95e51d.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0001f186f260e.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfcf34e5858b92.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1cfedc6350b29ae.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3209394106-3398393384-4106522146-1000Core1d000b2c209d060.job => D:\Mail - Lokale Ordner\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\Launch 8613.job => C:\Program Files\Audible\Bin\Manager.exe

Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe

Task: C:\Windows\Tasks\SidebarExecute.job => C:\Program Files\Windows Sidebar\sidebar.exe

Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe

Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files\AVG\AVG PC TuneUp\OneClick.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-01-27 22:13 - 2011-01-27 22:13 - 00226624 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe

2007-06-05 13:20 - 2007-06-05 13:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe

2014-07-14 11:26 - 2014-07-14 11:26 - 00585528 _____ () C:\Program Files\AVG\AVG PC TuneUp\avgreplibx.dll

2014-07-14 11:26 - 2014-07-14 11:26 - 00357176 _____ () C:\Program Files\AVG\AVG PC TuneUp\tuavgx.dll

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2011-01-27 22:13 - 2011-01-27 22:13 - 00673088 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe

2014-12-02 14:18 - 2014-12-02 14:18 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

2014-10-16 10:15 - 2014-10-16 10:15 - 00035328 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll

2014-05-24 17:41 - 2014-05-24 17:41 - 00091648 _____ () C:\Program Files\FileZilla FTP Client\libgcc_s_sjlj-1.dll

2014-05-24 17:41 - 2014-05-24 17:41 - 00892416 _____ () C:\Program Files\FileZilla FTP Client\libstdc++-6.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\TEMP:373E1720
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^Users^xx^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup

MSCONFIG\startupfolder: C:^Users^xx^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupfolder: C:^Users^xx^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SparkleShare.lnk => C:\Windows\pss\SparkleShare.lnk.Startup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

MSCONFIG\startupreg: OfficeSyncProcess => "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"

MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\xx\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-3209394106-3398393384-4106522146-500 - Administrator - Disabled)

xx (S-1-5-21-3209394106-3398393384-4106522146-1001 - Limited - Enabled) => C:\Users\xx

Gast (S-1-5-21-3209394106-3398393384-4106522146-501 - Limited - Disabled)

xx (S-1-5-21-3209394106-3398393384-4106522146-1000 - Administrator - Enabled) => C:\Users\xx
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (01/08/2015 07:43:51 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0x10a8

Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0

Pfad der fehlerhaften Anwendung: Explorer.EXE1

Pfad des fehlerhaften Moduls: Explorer.EXE2

Berichtskennung: Explorer.EXE3
 

Error: (01/08/2015 07:39:34 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d6727a7

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6

Ausnahmecode: 0xc06d007e

Fehleroffset: 0x0000812f

ID des fehlerhaften Prozesses: 0xb50

Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0

Pfad der fehlerhaften Anwendung: Explorer.EXE1

Pfad des fehlerhaften Moduls: Explorer.EXE2

Berichtskennung: Explorer.EXE3
 

Error: (01/08/2015 01:55:29 PM) (Source: .NET Runtime Optimization Service) (EventID: 1103) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown
 

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:31:09:4200)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.button.text locale: PCDLocale: language = de, customer = lenovo, variant = ltt
 

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:31:09:4080)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.button.text locale: PCDLocale: language = en, customer = lenovo, variant = ltt
 

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:31:09:4060)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.body locale: PCDLocale: language = de, customer = lenovo, variant = ltt
 

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:31:09:4040)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.title locale: PCDLocale: language = de, customer = lenovo, variant = ltt
 

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:30:51:7150)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 447 getDirectoryContents(C:\ProgramData\PCDr\5802/performance) failed
 

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:30:51:6870)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 349 getDirectoryContents(C:\ProgramData\PCDr\5802/performance) failed
 

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:30:51:5870)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 447 getDirectoryContents(C:\ProgramData\PCDr\5802/smartdata) failed
 
 

System errors:

=============

Error: (01/08/2015 04:55:17 PM) (Source: Disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 

Error: (01/08/2015 02:31:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.
 

Error: (01/08/2015 02:31:36 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
 

Error: (01/08/2015 01:51:46 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
 

Error: (01/08/2015 01:48:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (01/08/2015 01:02:45 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
 

Error: (01/08/2015 00:59:41 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (01/08/2015 11:09:05 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.
 

Error: (01/08/2015 10:31:12 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
 

Error: (12/31/2014 09:23:42 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: Der Dienst "Windows-Bilderfassung (WIA)" ist vom Dienst "Shellhardwareerkennung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 
 

Microsoft Office Sessions:

=========================

Error: (01/08/2015 07:43:51 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Explorer.EXE6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812f10a801d02b7276e65c86C:\Windows\Explorer.EXEC:\Windows\system32\KERNELBASE.dll49ad2d96-9766-11e4-ba9e-0016d3cc412f
 

Error: (01/08/2015 07:39:34 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Explorer.EXE6.1.7601.175674d6727a7KERNELBASE.dll6.1.7601.18409531599f6c06d007e0000812fb5001d02b6cbf278a41C:\Windows\Explorer.EXEC:\Windows\system32\KERNELBASE.dllb0407cac-9765-11e4-ba9e-0016d3cc412f
 

Error: (01/08/2015 01:55:29 PM) (Source: .NET Runtime Optimization Service) (EventID: 1103) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown
 

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:31:09:4200)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.button.text locale: PCDLocale: language = de, customer = lenovo, variant = ltt
 

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:31:09:4080)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.button.text locale: PCDLocale: language = en, customer = lenovo, variant = ltt
 

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:31:09:4060)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.body locale: PCDLocale: language = de, customer = lenovo, variant = ltt
 

Error: (01/08/2015 01:31:09 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:31:09:4040)(2772) DEFECT.LOCALIZATION - Error -- Missing String: scriptlets : homepage.panel.LenovoCare.title locale: PCDLocale: language = de, customer = lenovo, variant = ltt
 

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:30:51:7150)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 447 getDirectoryContents(C:\ProgramData\PCDr\5802/performance) failed
 

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:30:51:6870)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 349 getDirectoryContents(C:\ProgramData\PCDr\5802/performance) failed
 

Error: (01/08/2015 01:30:51 PM) (Source: PC-Doctor) (EventID: 1) (User: )

Description: (2772) Asapi: (13:30:51:5870)(2772) libMatrix.profiler.ProfilerSnapshots - Error -- 447 getDirectoryContents(C:\ProgramData\PCDr\5802/smartdata) failed
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM)2 Duo CPU L7300 @ 1.40GHz

Percentage of memory in use: 57%

Total physical RAM: 2006.3 MB

Available physical RAM: 844.88 MB

Total Pagefile: 4012.59 MB

Available Pagefile: 2390.28 MB

Total Virtual: 2047.88 MB

Available Virtual: 1919.76 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:58.5 GB) (Free:4.45 GB) NTFS

Drive d: (Volume) (Fixed) (Total:53.19 GB) (Free:3.92 GB) NTFS

Drive e: (ALI) (Removable) (Total:1.95 GB) (Free:0.18 GB) FAT
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 97979797)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=58.5 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=53.2 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 1.9 GB) (Disk ID: 221E5780)

Partition 1: (Active) - (Size=1.9 GB) - (Type=06)
 

==================== End Of Log ============================

WIndows Taste + R, schreibe CMD und drücke enter.
In CMD folgendes eintippen:

chkdsk D: /f /r