Avira findet APPL/Download.Gen+JOKE/BAD joke.DT

Vogel35 · 16.02.2015, 17:52

Hallo, ich habe da ein Problem. Meim Avira hat beim Scannen folgende Meldung:
Avira findet APPL/Download.Gen+JOKE/BAD joke.DT
nun bin ich ein Anfäger und habe diese Biester unter Quarantäne gestellt.
Wie gehe ich aber weiter dagegen vor?
Hoffe auf guten Rat.

schrauber · 16.02.2015, 18:32

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Vogel35 · 16.02.2015, 19:45

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-02-2015
Ran by Weber (administrator) on WEBER-PC on 16-02-2015 19:26:45
Running from C:\Users\Weber\Desktop
Loaded Profiles: Weber (Available profiles: Weber)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\w32x86\3\NetFaxServer.exe
() C:\Windows\System32\ieconfig_1und1_svc.exe
(Buhl Data Service GmbH) C:\Program Files\Sceneo\Bonavista\Services\PVR\pvrservice.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
(X10) C:\Program Files\Common Files\X10\Common\X10nets.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\w32x86\3\NetFaxTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft® Corporation) C:\Program Files\Common Files\microsoft shared\Works Shared\WkCalRem.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Ascora GmbH) C:\Program Files\KeyDepot\KeyDepot.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [143360 2006-12-23] (Nero AG)
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-18] (Microsoft Corporation)
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-18] (Microsoft Corporation)
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Run: [AutoStartNPSAgent] => C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [145408 2008-02-15] (Google)
IFEO\backitup.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\coverdes.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\infotool.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\nero.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\neroburnrights.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\neromediahome.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\neroscoutoptions.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\nerostartsmart.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\neroupgrade.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\nerovision.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\nvstlink.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\nvstview.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\photoshop album starter edition.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\photosnap.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\photosnapviewer.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\powerdvd.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\recode.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\sse.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\startcenter.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\waveedit.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\w32x86\3\NetFaxTray.exe (Samsung Electronics Co., Ltd.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files\T-Online\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T-Online DSL-Manager.lnk
ShortcutTarget: T-Online DSL-Manager.lnk -> C:\Program Files\T-Online\DSL-Manager\TODslMgr.exe (No File)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files\T-Online\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T-Online DSL-Manager.lnk
ShortcutTarget: T-Online DSL-Manager.lnk -> C:\Program Files\T-Online\DSL-Manager\TODslMgr.exe (No File)
Startup: C:\Users\Weber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Weber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkcalrem.LNK
ShortcutTarget: wkcalrem.LNK -> C:\Program Files\Common Files\microsoft shared\Works Shared\WkCalRem.exe (Microsoft® Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.1und1.de/links/home
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/br/ie9_startpage
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://web.de/
URLSearchHook: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> DefaultScope {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {215F0CCF-0EA1-49C4-AE83-7C7A7BCA778F} URL = hxxp://go.web.de/suchbox/ebay?query={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {40064957-18EB-412d-9146-3F57E8D92EEC} URL = hxxp://go.web.de/br/ie9_search_pic/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {4D09445C-BB6F-4034-B4F7-3894A743F9EF} URL = hxxp://www.search.ask.com/web?tpid=ORJ&o=100000027&pf=V7&p2=^U3^OSJ000^YY^DE&gct=&itbv=12.19.0.104&apn_uid=61F89278-23F4-4BDD-80B5-934DD4825EBD&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_dbr=ff_19.0&doi=2013-06-14&trgb=IE,FF&q={searchTerms}&psv=&pt=tb
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {6446CB54-76E5-4A5D-AB54-CCB530FF9D65} URL = hxxp://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://go.web.de/suchbox/google?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {70BD6931-265D-4767-A53A-7CD5FA722A08} URL = hxxp://search.1und1.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {8D27B32E-89EE-460e-82D2-5FC354078EAD} URL = hxxp://go.web.de/br/ie9_search_produkte/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {A3812F4B-2B8C-4BE0-82BB-25A494971DF8} URL = hxxp://go.web.de/suchbox/amazon/?keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = 
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {B7320D5A-AD81-432A-9108-01C660C580C9} URL = hxxp://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {D972B939-DD25-48D5-AC20-A59F3B5741CD} URL = hxxp://go.web.de/suchbox/smartshopping/?searchText={searchTerms}&mc=searchplugin@suche@msie.suche@preisvergleich
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {DCE59F23-A446-45a5-9459-E68FDC0DE38D} URL = hxxp://go.web.de/br/ie9_search_maps/?su={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Toolbar Helper -> {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -> C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
BHO: Ask Shopping Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files\AskPartnerNetwork\Toolbar\ORJ\Passport.dll (APN LLC.)
BHO: 1&&1 Internet AG Browser Configuration by mquadr.at -> {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} -> C:\Windows\System32\ieconfig_1und1.dll (mquadr.at software engineering und consulting GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
Toolbar: HKLM - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\AskPartnerNetwork\Toolbar\ORJ\Passport.dll (APN LLC.)
Toolbar: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
Toolbar: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\AskPartnerNetwork\Toolbar\ORJ\Passport.dll (APN LLC.)
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {44990B00-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlcm.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF SearchEngineOrder.1: Ask.com
FF Homepage: hxxp://www.comdirect.de/
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Cliqz Beta - C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\Extensions\cliqz@cliqz.com [2015-02-14]
FF Extension: WEB.DE MailCheck - C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\Extensions\toolbar@web.de [2015-01-08]
FF Extension: Adblock Plus - C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-07]
FF HKLM\...\Firefox\Extensions: [jid0-1wPBLrijxGVkIUhu0kFYq6ZaWzA@jetpack] - C:\Program Files\AntiBrowserSpy\Addons\Firefox
FF Extension: AntiBrowserSpy - SocialBlocker - C:\Program Files\AntiBrowserSpy\Addons\Firefox [2015-02-14]
FF HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\extensions\cliqz@cliqz.com

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 AAV UpdateService; C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-10-30] (APN LLC.)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
S3 FirebirdServerMAGIXInstance; C:\Program Files\ALDI Foto Service Nord\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed]
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2009-03-31] (Teruten) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2006-10-19] (Hewlett-Packard Company) [File not signed]
S4 NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [774144 2006-12-05] (Nero AG) [File not signed]
S4 NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [262144 2006-12-23] (Nero AG) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] ()
R2 Samsung Network Fax Server; C:\Windows\system32\spool\drivers\w32x86\3\NetFaxServer.exe [376368 2013-01-14] (Samsung Electronics Co., Ltd.)
R2 serviceIEConfig; C:\Windows\System32\ieconfig_1und1_svc.exe [1053848 2013-03-03] ()
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]
R2 srvcPVR; C:\Program Files\Sceneo\Bonavista\Services\PVR\PVRService.exe [1459712 2006-12-15] (Buhl Data Service GmbH) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1781048 2014-07-16] (TuneUp Software)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-18] (Microsoft Corporation)
R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]
R2 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe /Processid:{ADDCC6CA-3958-4E53-9BDA-5ED577B1FED7}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3xHybrid; C:\Windows\System32\DRIVERS\3xHybrid.sys [1136600 2007-01-08] (Philips Semiconductors GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-18] (Avira Operations GmbH & Co. KG)
S3 BrSerIf; C:\Windows\System32\Drivers\BrSerIf.sys [52224 2006-12-12] (Brother Industries Ltd.) [File not signed]
S3 BrUsbSer; C:\Windows\System32\Drivers\BrUsbSer.sys [11904 2006-09-03] (Brother Industries Ltd.) [File not signed]
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [28208 2010-02-08] (REINER SCT)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [16448 2007-08-01] (T-Systems Enterprise Services GmbH)
R3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc.              )
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] () [File not signed]
S3 Ph3xIB32; C:\Windows\System32\DRIVERS\Ph3xIB32.sys [1131136 2007-04-03] (Philips Semiconductors GmbH)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [17920 2009-08-10] (Silicon Laboratories, Inc.)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [63488 2009-08-10] (Silicon Laboratories)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-18] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2012-11-19] (Samsung Electronics) [File not signed]
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-12-16] (TuneUp Software)
R2 v2imount; C:\Windows\System32\DRIVERS\v2imount.sys [38112 2008-01-19] (Symantec Corporation)
R0 videX32; C:\Windows\System32\DRIVERS\videX32.sys [9216 2006-10-17] (VIA Technologies, Inc.)
S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [15088 2008-01-19] (Symantec Corporation)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13976 2006-11-17] (X10 Wireless Technology, Inc.)
R0 xfilt; C:\Windows\System32\DRIVERS\xfilt.sys [17920 2006-10-18] (VIA Technologies,Inc)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2008-10-28] (X10 Wireless Technology, Inc.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 dsltestSp5; System32\Drivers\dsltestSp5.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 19:26 - 2015-02-16 19:28 - 00022627 _____ () C:\Users\Weber\Desktop\FRST.txt
2015-02-16 19:26 - 2015-02-16 19:26 - 00000000 ____D () C:\FRST
2015-02-16 19:25 - 2015-02-16 19:25 - 01125888 _____ (Farbar) C:\Users\Weber\Desktop\FRST.exe
2015-02-16 10:59 - 2015-02-16 10:59 - 00001883 _____ () C:\Users\Weber\Desktop\Avira Free Antivirus Profil Lokale Festplatten.LNK
2015-02-16 07:55 - 2015-02-16 07:55 - 00000438 _____ () C:\Users\Weber\Desktop\Telefonliste.wps - Verknüpfung.lnk
2015-02-14 10:33 - 2015-02-14 19:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiBrowserSpy
2015-02-14 10:31 - 2015-02-14 10:31 - 00000000 ____D () C:\Users\Weber\AppData\Roaming\Cliqz
2015-02-13 07:23 - 2015-01-23 04:00 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-13 07:23 - 2015-01-23 03:51 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-12 05:43 - 2014-11-26 03:05 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-12 05:42 - 2015-01-13 02:39 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-12 05:42 - 2015-01-09 01:20 - 02063360 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-12 05:38 - 2015-01-15 05:13 - 00440760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-12 05:38 - 2014-12-08 02:59 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 05:45 - 2015-01-14 02:51 - 12371456 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 05:45 - 2015-01-14 02:49 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-11 05:45 - 2015-01-14 02:46 - 09742336 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 05:45 - 2015-01-14 02:43 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 05:45 - 2015-01-14 02:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 05:45 - 2015-01-14 02:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 05:45 - 2015-01-14 02:41 - 01802752 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 05:45 - 2015-01-14 02:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 05:45 - 2015-01-14 02:41 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 05:45 - 2015-01-14 02:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-11 05:45 - 2015-01-14 02:41 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 05:45 - 2015-01-14 02:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 05:45 - 2015-01-14 02:40 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-02-11 05:45 - 2015-01-14 02:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-01-27 09:21 - 2015-01-27 09:21 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 19:13 - 2006-11-02 13:47 - 00003296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-16 19:13 - 2006-11-02 13:47 - 00003296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-16 18:11 - 2007-03-21 12:59 - 01254381 _____ () C:\Windows\WindowsUpdate.log
2015-02-16 11:04 - 2007-03-26 14:12 - 00023396 _____ () C:\Users\Weber\AppData\Roaming\wklnhst.dat
2015-02-16 07:48 - 2009-01-01 15:58 - 00002633 _____ () C:\Users\Weber\Desktop\Exel 2007.lnk
2015-02-16 07:41 - 2006-11-02 13:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-02-16 07:41 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2015-02-15 19:46 - 2006-11-02 11:33 - 01594468 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-15 07:59 - 2015-01-07 09:58 - 00003582 _____ () C:\Windows\PFRO.log
2015-02-14 20:59 - 2006-11-02 14:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-14 20:59 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-14 20:55 - 2008-04-24 10:45 - 00000254 _____ () C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
2015-02-14 10:35 - 2012-12-21 16:41 - 00000000 ____D () C:\Users\Weber\AppData\Local\Abelssoft
2015-02-14 10:33 - 2014-02-15 12:05 - 00000892 _____ () C:\Users\Public\Desktop\AntiBrowserSpy.lnk
2015-02-14 10:33 - 2014-02-15 12:02 - 00000000 ____D () C:\Program Files\AntiBrowserSpy
2015-02-12 06:05 - 2015-01-02 14:37 - 00517248 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 05:51 - 2013-08-15 13:41 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 05:44 - 2006-11-02 11:24 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-02-12 05:43 - 2007-02-10 15:01 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 19:46 - 2012-05-20 07:07 - 00002631 _____ () C:\Users\Weber\Desktop\Microsoft Office Word 2007.lnk
2015-02-10 15:22 - 2014-08-05 11:37 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-10 15:22 - 2014-02-10 11:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-10 15:22 - 2014-02-10 11:33 - 00000000 ____D () C:\Program Files\Avira
2015-02-10 08:09 - 2012-05-13 18:02 - 00000000 ____D () C:\Users\Weber\AppData\Local\Thunderbird
2015-01-27 11:34 - 2013-06-26 16:41 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-01-24 18:15 - 2010-09-13 07:00 - 00000000 ____D () C:\Users\Weber\Documents\OneNote-Notizbücher

==================== Files in the root of some directories =======

2007-10-18 09:29 - 2011-03-06 12:19 - 0017908 _____ () C:\Users\Weber\AppData\Roaming\UserTile.png
2007-03-26 14:12 - 2015-02-16 11:04 - 0023396 _____ () C:\Users\Weber\AppData\Roaming\wklnhst.dat
2007-03-21 16:01 - 2013-04-14 20:30 - 0016072 _____ () C:\Users\Weber\AppData\Local\d3d9caps.dat
2007-03-28 15:47 - 2014-11-26 10:28 - 0016384 _____ () C:\Users\Weber\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2007-03-28 13:47 - 2007-03-28 13:47 - 0000093 _____ () C:\Users\Weber\AppData\Local\fusioncache.dat
2014-11-03 10:43 - 2014-11-03 10:43 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2007-04-06 07:54 - 2007-04-06 08:22 - 0001026 _____ () C:\ProgramData\hpzinstall.log
2009-06-23 10:30 - 2009-06-23 13:39 - 0213443 _____ () C:\ProgramData\LUInstall.LiveUpdate

Some content of TEMP:
====================
C:\Users\Weber\AppData\Local\Temp\abs.exe
C:\Users\Weber\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-16 07:52

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-02-2015
Ran by Weber at 2015-02-16 19:28:39
Running from C:\Users\Weber\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1&1 EasyLogin (HKLM\...\1&1 EasyLogin) (Version:  - )
1und1 Internet Explorer Add-On (Version: 1.0 - 1&1 Internet AG) Hidden
320 Solitaires (HKLM\...\320 Solitaires) (Version:  - )
AAVUpdateManager (HKLM\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Acrobat Connect Add-in (HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Adobe Acrobat Connect Add-in) (Version:  - )
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\Adobe Shockwave Player) (Version: 10.1.4.20 - Adobe Systems, Inc.)
Adobe® Photoshop® Album Starter Edition 3.2 (HKLM\...\Adobe® Photoshop® Album Starter Edition 3.2) (Version: 3.2.0 - hxxp://www.adobe.de)
Amazon Kindle (HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Amazon Kindle) (Version:  - Amazon)
AntiBrowserSpy (HKLM\...\{F78B5B4F-075A-4C81-AA27-E707861EB5B7}_is1) (Version: 154 - Abelssoft)
Ask Shopping Toolbar (HKLM\...\{4F524A00-6A76-A76A-76A7-A758B70C1500}) (Version: 12.21.0.124 - APN, LLC) <==== ATTENTION
Avira (HKLM\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Cliqz (HKLM\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.63 - Cliqz.com)
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Duden Korrektor Patch 012009 (HKLM\...\{8AEBFD30-B94F-4A49-8106-03039708BDD4}) (Version: 6.00.1000 - Bibliographisches Institut & F.A. Brockhaus AG)
Duden Korrektor PLUS (HKLM\...\{62326989-2861-4911-A39E-26373BD3FF66}) (Version: 6.00.00 - Bibliographisches Institut & F.A. Brockhaus AG)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 14.3.11574 - Landesfinanzdirektion Thüringen)
Feedback Tool (HKLM\...\{13A5E785-5197-4EAD-8EE3-D660271E49BC}) (Version: 1.2.0 - Microsoft Corporation)
Firebird SQL Server - MAGIX Edition 2.0.0.1 (D) (HKLM\...\Firebird SQL Server D) (Version: 2.0.0.1 - MAGIX AG)
Firefox 3.6 WEB.DE Edition (Version: 1.6 - WEB.DE) Hidden
Grand Ages Rome 1.11 (HKLM\...\Civitas3) (Version: 1.11 - Kalypso Media)
HijackThis 2.0.2 (HKLM\...\HijackThis) (Version: 2.0.2 - TrendMicro)
InfoBibliothek 2 (HKLM\...\{78D7D7CD-A06B-4514-ACBD-8055BF945A8E}) (Version: 1.08.03.01 - Akademische Arbeitsgemeinschaft Verlag Wolters Kluwer GmbH)
Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.710 - Oracle)
KeyDepot (HKLM\...\KeyDepot_is1) (Version: 3.20 - Abelssoft)
LightScribe  1.4.124.1 (Version: 1.4.124.1 - hxxp://www.lightscribe.com) Hidden
lingDIALOG (HKLM\...\InstallShield_{071B843C-9A39-40B3-BB01-BBD6A8D2E1C5}) (Version: 3.0908 - WEVOSYS)
lingDIALOG (Version: 3.0908 - WEVOSYS) Hidden
MCE Software Encoder 1.1 (HKLM\...\{7655E113-C306-11D9-A373-0050BAE317E1}) (Version: 1.1.0.1108 - CyberLink Corporation)
MediaShow 3.0 (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version:  - )
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 German Language Pack (HKLM\...\{E78BFA60-5393-4C38-82AB-E8019E464EB4}) (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version:  - )
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}) (Version: 08.05.0822 - Microsoft Corporation)
Moorhuhn Remake (HKLM\...\{52210D57-0B1F-4681-90DD-8659DF4BCC40}) (Version: 1.00.0000 - )
Mozilla Firefox 35.0.1 (x86 de) (HKLM\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 32.0.2 - Mozilla)
MSXML 4.0 SP2 (KB925672) (HKLM\...\{A9CF9052-F4A0-475D-A00F-A8388C62DD63}) (Version: 4.20.9839.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 7 Essentials (HKLM\...\{63B75E16-F290-4FCD-AF67-A9134CD01031}) (Version: 7.02.5182 - Nero AG)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
OpenOffice 4.1.0 (HKLM\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)
PhotoNow! 1.0 (HKLM\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version:  - )
Platform (Version: 1.22 - VIA Technologies, Inc.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.2414.0 - CyberLink Corporation)
QuickTime (HKLM\...\{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}) (Version: 7.1.3.100 - Apple Computer, Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7272 - Realtek Semiconductor Corp.)
Robin Hood TsoSF (HKLM\...\Robin Hood TsoSF) (Version:  - )
Samsung Easy Document Creator (HKLM\...\Samsung Easy Document Creator) (Version: 1.04.63 (28.02.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM\...\Samsung Easy Printer Manager) (Version: 1.02.99.00(04.02.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Wireless Setup (HKLM\...\Easy Wireless Setup) (Version: 3.60.07 - Samsung Electronics Co., Ltd.)
Samsung M267x 287x Series (HKLM\...\Samsung M267x 287x Series) (Version: 1.12 (08.03.2013) - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM\...\Samsung Network PC Fax) (Version: 1.09.11 (14.01.2013) - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (HKLM\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
Samsung Printer Live Update (HKLM\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (Version: 1.00.49.00 - Samsung Electronics Co., Ltd.) Hidden
ScanSoft PaperPort 11 (HKLM\...\{7A8FF745-BBC5-482B-88E4-18D3178249A9}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Sceneo Bonavista (HKLM\...\{4C73B683-B15D-4B94-AC7A-520B70C4FFE9}) (Version:  - )
Skat Clubmeister (HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Skat Clubmeister) (Version:  - )
Skat, Schwimmen und Mau Mau (HKLM\...\Skat, Schwimmen und Mau Mau_is1) (Version:  - madcat Software GmbH)
SNS Upload for Easy Document Creator (HKLM\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SteuerBerater für Lehrer 2013-2014 (HKLM\...\{E84E9818-988D-44E1-A996-FC05F83A64DC}) (Version: 1.00.9 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung 2013 (HKLM\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.10 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung Lehrer 2014 (HKLM\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.10.89 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung Plus 2010 (HKLM\...\{82436073-5B66-4DD4-A815-437244503120}) (Version: 15.14 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung Plus 2011 (HKLM\...\{257F2279-6843-433E-9060-15BAB966F20D}) (Version: 16.16 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung Plus 2012 (HKLM\...\{3BCDCC6A-3A47-4883-8A0C-55AC061316CB}) (Version: 17.12 - Wolters Kluwer Deutschland GmbH)
Sunny Hillride 1.0 (HKLM\...\{B4B9067D-E80A-4A24-9ED5-B9C451CFE67E}) (Version: 1.0 - Headup Games)
SuperEasy Driver Updater v.1.1.1 (HKLM\...\{039BC111-D60F-A6FF-85F4-7992EA886B8D}_is1) (Version: 1.1.1 - SuperEasy Software GmbH & Co. KG)
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM\...\TuneUp Utilities) (Version: 14.0.1000.340 - TuneUp Software)
TuneUp Utilities 2014 (Version: 14.0.1000.340 - TuneUp Software) Hidden
Ulead PhotoImpact 12 (HKLM\...\{11AFE21E-B193-430D-B57A-DFF7815BB962}) (Version: 12.0 - Ulead System)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VIA Plattform-Geräte-Manager (HKLM\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.22 - VIA Technologies, Inc.)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WEB.DE Toolbar für Mozilla Firefox (HKLM\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 1.5.5.0 - 1&1 Mail & Media GmbH)
Windows Live Toolbar (HKLM\...\Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0) (HKLM\...\3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F) (Version: 10/12/2007 6.85.4.0 - Nokia)
X10 Hardware(TM) (HKLM\...\X10Hardware) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{029209E8-38B5-482B-BCDD-FC9B276FE352}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{0454F501-2BAE-4570-9F6E-440A28049AC2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{0CD20A4B-7CB5-45C1-B957-748A155E753E}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{11344345-5091-4C52-9841-D13086E0EEC2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{1B05BF56-E227-49CE-B2C9-5C1C9F40E460}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{23FB70B3-7A4F-457D-BE2F-AB583E76D8E7}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{25F841D3-408D-45F5-B3EA-4972A18B7737}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{2822DCFC-717E-4F88-9BE6-FA946CCB4017}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{2837E0FE-686B-4CB0-BE53-0EA097EAF71B}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{302276CC-737D-4D15-9A5C-EC2031D673EB}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{327DA9A8-4E9E-4E14-AC1B-C159A6B2865B}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{515A9E01-5D33-4C70-8E43-62DD3FE06B35}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{531DFEAC-826E-4C3D-BF76-425A5AF61A0E}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{5B7524C8-2446-40E9-9474-94A779DBA224}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{5E801020-E0CA-4708-9E07-A256A8FFBD2A}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{60774992-7CCF-437E-B32D-7E5DC00EFFB8}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{61975864-C48D-464E-8AC0-12D8DE16C813}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{621D3650-F1D3-414C-97F9-03A02B211261}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{623E415A-22EF-4DAA-A2FF-E68E77A673C9}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{659CE3EB-9F99-422E-9255-61CAC57B3510}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{6D89B10C-1802-430F-A3D3-FD2C621AFC26}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{714A66CE-B7B3-4029-B345-56B2B4823079}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{71A43C79-BC43-419F-A304-061AA2E74846}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{79D12C76-06D9-431F-9A5A-82B93EA5083C}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{8380194E-073A-40D0-970F-A01988D27B5C}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{885BB46A-3F1E-44C3-A01B-A7D9260CC98B}\InprocServer32 -> C:\Windows\Downloaded Program Files\dwusplay.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{885BB46A-3F1E-44C3-A01B-A7D9260CC98B}\localserver32 -> C:\Windows\Downloaded Program Files\dwusplay.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{915C2CEB-216B-4B7C-89E4-9ED3512D58D9}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{92C5E738-7372-4CD6-BE57-15833624EBF3}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{9CAAD2EA-177B-4D07-871F-47255B5D30F3}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{9F659E80-34A5-40FD-9806-3115FF07CA5A}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{9F8B217D-3EF8-44FC-9079-5581D0943725}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{A08EDBE0-D6C1-4F98-95EE-F9DABE2F57B9}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{AAFFEBCF-CEAE-44D1-87BC-21DD59AB2951}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{B391A1DB-28C8-4506-A43C-5BD6051F16BA}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{B452070B-D0CF-4C30-9E0C-FD86A154746F}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{B956DB4C-E9D5-4BA6-98F2-B569F5E89EA2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{BDFBC8FB-4E9D-4118-8B82-0F3E21B47751}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{C266DD0E-ABF0-4D2D-BC80-442941767642}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{CF03108C-3EC6-4DA8-8A89-9414431EC87E}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{D6583D24-BAD0-4F9D-9C48-7CEE73E2CEFC}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{DA68042E-486F-4BA7-ADDB-891126B8BD31}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{DC62AB5B-4A63-4AF0-A623-2CB24B400BE2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{E50C953D-311A-481B-8F8D-C55E65AF7417}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{E9880553-B8A7-4960-A668-95C68BED571E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{E9A93328-79D4-4AED-A778-146E7191F8BC}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EA2DD391-0F60-42F7-9AA8-9576C907E6E3}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EA3398E8-18DB-4369-870F-73414EE55D79}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EDE36E93-52E9-48AE-97AE-EEF558558F1F}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EF2D9BFD-E3B2-455F-A917-BA5826CEFD50}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F1522EC1-F84F-4CE2-A38C-F9384B0DFD41}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F2699F06-4BD8-46D5-AB11-D5626BA04574}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F3A9BCA1-7EE6-4E6C-B8DF-53D389F58457}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F74EBFCA-61B4-4A74-BE4B-BE91765747C1}\InprocServer32 -> C:\Program Files\Duden\Duden Korrektor\DudenKorrektor.dll (Expert System S.p.A.)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F7DE72AB-464D-4ACF-94E1-56BBDEF284B6}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{FBF36969-88B5-4F2C-991E-DCB0BF28E5C0}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{FFF2D28F-E4EE-44D9-8104-8E71556757F6}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (InstallShield Software Corporation)

==================== Restore Points  =========================

30-12-2014 07:54:32 Windows Update
07-01-2015 07:20:21 Windows Update
07-01-2015 07:46:35 Windows Defender Checkpoint
07-01-2015 11:29:16 Wiederherstellungsvorgang
07-01-2015 11:42:29 Windows Update
14-01-2015 07:43:45 Windows Update
15-01-2015 06:54:35 Windows Update
24-01-2015 17:07:47 Windows Update
30-01-2015 09:00:05 Windows Update
03-02-2015 08:37:24 Windows Update
10-02-2015 08:12:49 Windows Update
12-02-2015 05:30:31 Windows Update
14-02-2015 10:09:27 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2013-08-21 12:40 - 00000859 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1 google-analytics.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1875271A-8676-49DF-9894-66D0505B7161} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2753FBBE-BACB-43F1-A631-3BC4879B3BC8} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-18] (Microsoft Corporation)
Task: {2D0DCF85-45A1-469D-9165-91B37640B2DA} - System32\Tasks\Google Updater and Installer => C:\Users\Weber\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {585FA34D-BE66-4461-AF82-DAC206D6923E} - System32\Tasks\{086172D4-FBB3-4729-93AC-6A2273A1B0FA} => pcalua.exe -a "D:\Tools\Sceneo Bonavista\Setup.exe" -d "D:\Tools\Sceneo Bonavista"
Task: {6CA539A4-788F-44D9-9522-8312689396B8} - System32\Tasks\DriverScanner => C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe
Task: {703A128E-0807-4BA6-B8C6-3D3084C0A6E6} - System32\Tasks\Auf Updates für Windows Live Toolbar prüfen => C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19] (Microsoft Corporation)
Task: {7FC6BE06-C75C-4D29-84E1-634AAC28E488} - System32\Tasks\InstallShield Software-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2004-08-09] (InstallShield Software Corporation)
Task: {89F61BE6-D7F0-4CB4-8C89-AEEB02463808} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: {8A2FE36C-D0A1-4C59-AD3A-1D1DD19EEF26} - System32\Tasks\{A90E64BD-7A52-4F33-A61C-A0C1F2F953A1} => pcalua.exe -a "C:\Program Files\Skype\Phone\unins000.exe"
Task: {8A8370F5-62E7-4E6C-96FA-02E621206FC1} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: {8EA2784B-0F2E-4362-82E4-A99F244D2C95} - System32\Tasks\ScanSoft Background Update => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {9065648E-49DC-44B1-AA82-82E6786D8163} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: {9C2B50F8-3287-4A85-B3C1-2E20E3001ED5} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-09-26] (Oracle Corporation)
Task: {AB4EB9C4-C0A1-4CF0-BE0A-ADE26396511A} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files\TuneUp Utilities 2012\OneClick.exe
Task: {ADEFF3A5-7527-4627-B298-81767BBCBA18} - System32\Tasks\{726E303F-48F1-4362-868B-EDAFAF73C7BC} => pcalua.exe -a C:\Users\Weber\Downloads\IE8-Setup-Full-32.exe -d "C:\Program Files\Mozilla Firefox"
Task: {B1CE57E0-2B7D-4ED1-8E1A-1BEE53272612} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\TuneUp Utilities 2014\OneClick.exe [2014-07-16] (TuneUp Software)
Task: {BDBA8386-1E26-496F-A844-24389AB05642} - System32\Tasks\{67EA85AE-106E-42B6-978A-F0089C443D6D} => pcalua.exe -a E:\setup.exe -d E:\ -c -c
Task: {C5B25D39-5D19-4670-95D0-96C03C034CE2} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files\TuneUp Utilities 2010\OneClick.exe
Task: {CE52EA52-1C94-43CF-99FB-F70B7E8AEED7} - System32\Tasks\McDefragTask => c:\program files\mcafee\mqc\QcConsol.exe
Task: {E60B7E04-BBEB-4118-A1A4-9824383AFEBD} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {E8F024A1-1D86-4970-9B91-D795C251953F} - System32\Tasks\{6780C582-76B7-4530-ADA1-39100633D8C8} => pcalua.exe -a E:\MInst.exe -d E:\
Task: {F861413A-3272-4934-B14F-2E1E3F8F5B3D} - System32\Tasks\McQcTask => c:\program files\mcafee\mqc\QcConsol.exe
Task: {FBEF25C0-67EE-4BB8-808E-C0550D52A53E} - System32\Tasks\{D57D6638-1901-41F8-BB20-DB2A5DABD0DF} => pcalua.exe -a C:\Users\Weber\Downloads\IE8-Setup-Full-32.exe -d "C:\Program Files\Mozilla Firefox"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job => C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files\TuneUp Utilities 2014\OneClick.exe

==================== Loaded Modules (whitelisted) ==============

2013-06-26 11:42 - 2013-06-26 11:42 - 00024064 _____ () C:\Windows\System32\ssa6mlm.dll
2013-06-26 11:42 - 2013-06-26 11:42 - 01021952 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\ssa6mdu.dll
2007-02-13 10:23 - 2006-12-19 22:23 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2013-03-03 10:12 - 2013-03-03 10:12 - 01053848 _____ () C:\Windows\System32\ieconfig_1und1_svc.exe
2007-02-12 10:30 - 2006-06-26 13:34 - 00098304 _____ () C:\Program Files\Sceneo\Bonavista\Services\PVR\tvtvRemote.dll
2009-09-24 13:48 - 2009-04-11 07:28 - 00368640 _____ () C:\Windows\system32\msjetoledb40.dll
2007-02-12 10:30 - 2004-04-23 15:01 - 00299008 _____ () C:\Windows\system32\midas.dll
2014-07-16 09:24 - 2014-07-16 09:24 - 00585528 _____ () C:\Program Files\TuneUp Utilities 2014\avgreplibx.dll
2012-03-09 09:58 - 2012-03-09 09:58 - 00350072 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2012-03-09 09:58 - 2012-03-09 09:58 - 00056696 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2015-01-27 09:21 - 2015-01-27 09:21 - 03925104 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\Wallpaper\img24.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^OnlineControl.lnk => C:\Windows\pss\OnlineControl.lnk.CommonStartup
MSCONFIG\startupreg: WEB.DE Update => C:\Program Files\WEB.DE\LiveUpdate\m2LUTray.exe

==================== Accounts: =============================

Administrator (S-1-5-21-3016044035-3929161208-4058345445-500 - Administrator - Disabled)
ASPNET (S-1-5-21-3016044035-3929161208-4058345445-1003 - Limited - Enabled)
Gast (S-1-5-21-3016044035-3929161208-4058345445-501 - Limited - Disabled)
Weber (S-1-5-21-3016044035-3929161208-4058345445-1001 - Administrator - Enabled) => C:\Users\Weber

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} [0x80110802] ist ein Fehler aufgetreten.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Ausführungskontext: Coordinator

Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80110802]


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Ausführungskontext: Coordinator

Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} [0x80110802] ist ein Fehler aufgetreten.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
   Überprüfen, ob das Volume vom Anbieter unterstützt wird
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Snapshotkontext: 16
   Ausführungskontext: Coordinator
   Anbieter-ID: {00000000-0000-0000-0000-000000000000}
   Volumename: C:\
   Ausführungskontext: Coordinator

Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80110802]


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
   Überprüfen, ob das Volume vom Anbieter unterstützt wird
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Snapshotkontext: 16
   Ausführungskontext: Coordinator
   Anbieter-ID: {00000000-0000-0000-0000-000000000000}
   Volumename: C:\
   Ausführungskontext: Coordinator

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} [0x80110802] ist ein Fehler aufgetreten.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Ausführungskontext: Coordinator

Error: (02/16/2015 02:03:06 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80110802]


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Ausführungskontext: Coordinator


System errors:
=============
Error: (02/16/2015 09:36:14 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {74944725-B65F-4E37-8633-BD4DDE193921}

Error: (02/16/2015 07:42:09 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/15/2015 03:51:40 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/15/2015 10:09:31 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {74944725-B65F-4E37-8633-BD4DDE193921}

Error: (02/15/2015 08:01:36 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/14/2015 10:06:35 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/13/2015 06:19:24 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/13/2015 03:39:10 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/13/2015 07:09:51 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/12/2015 06:26:23 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt


Microsoft Office Sessions:
=========================
Error: (12/11/2014 08:02:24 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1704 seconds with 660 seconds of active time.  This session ended with a crash.

Error: (05/29/2014 06:50:34 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 4499 seconds with 600 seconds of active time.  This session ended with a crash.

Error: (05/18/2014 08:25:07 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 10 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (10/01/2009 06:40:17 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6504.5001, Microsoft Office Version: 12.0.6215.1000. This session lasted 754 seconds with 720 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2015-01-07 10:44:47.432
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 10:44:46.980
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 10:44:46.524
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 10:44:45.896
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 10:30:46.804
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 10:02:12.240
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 08:44:39.465
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 08:44:38.991
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 08:44:38.521
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 08:44:37.897
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
Percentage of memory in use: 59%
Total physical RAM: 2045.76 MB
Available physical RAM: 835.09 MB
Total Pagefile: 4342.78 MB
Available Pagefile: 2651.73 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.55 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:271.72 GB) (Free:182.23 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:26.34 GB) (Free:17.55 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: B4215544)
Partition 1: (Active) - (Size=271.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=26.4 GB) - (Type=OF Extended)

==================== End Of Log ============================

Erstmal vielen Dank

schrauber · 17.02.2015, 09:55

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Ask Shopping Toolbar
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Vogel35 · 17.02.2015, 16:07

Code:

ATTFilter

ComboFix 15-02-16.01 - Weber 17.02.2015  15:38:42.2.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.965 [GMT 1:00]
ausgeführt von:: c:\users\Weber\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
c:\programdata\LUInstall.LiveUpdate
c:\users\Public\videos\Windows7UpgradeAdvisorSetup.exe
c:\windows\unin0407.exe
.
-- Vorheriger Suchlauf --
.
Infizierte Kopie von c:\windows\system32\samsrv.dll wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\x86_microsoft-windows-directory-services-sam_31bf3856ad364e35_6.0.6002.18005_none_b3d9d2699e1659b0\samsrv.dll wurde wiederhergestellt 
.
--------
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-01-17 bis 2015-02-17  ))))))))))))))))))))))))))))))
.
.
2015-02-17 14:48 . 2015-02-17 14:48	--------	d-----w-	c:\users\Weber\AppData\Local\temp
2015-02-17 14:48 . 2015-02-17 14:48	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-02-17 13:41 . 2015-02-17 13:41	--------	d-----w-	c:\program files\VS Revo Group
2015-02-16 18:26 . 2015-02-16 18:30	--------	d-----w-	C:\FRST
2015-02-14 09:31 . 2015-02-14 09:31	--------	d-----w-	c:\users\Weber\AppData\Roaming\Cliqz
2015-02-13 06:23 . 2014-12-02 11:01	9054624	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{89427A02-7980-4F77-A2A0-5677678F70E4}\mpengine.dll
2015-02-13 06:23 . 2015-01-23 03:00	1810944	----a-w-	c:\windows\system32\jscript9.dll
2015-02-12 04:43 . 2014-11-26 02:05	564224	----a-w-	c:\windows\system32\oleaut32.dll
2015-02-12 04:42 . 2015-01-09 00:20	2063360	----a-w-	c:\windows\system32\win32k.sys
2015-02-12 04:42 . 2015-01-13 01:39	974848	----a-w-	c:\windows\system32\WindowsCodecs.dll
2015-02-12 04:38 . 2015-01-15 04:13	440760	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2015-02-12 04:38 . 2014-12-08 01:59	306176	----a-w-	c:\windows\system32\scesrv.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-01-08 08:55 . 2009-10-04 08:26	249488	------w-	c:\windows\system32\MpSigStub.exe
2014-12-19 00:25 . 2015-01-15 06:08	115200	----a-w-	c:\windows\system32\drivers\mrxdav.sys
2014-12-06 03:14 . 2015-01-15 05:55	153600	----a-w-	c:\windows\system32\profsvc.dll
2014-12-06 03:14 . 2015-01-15 05:56	48640	----a-w-	c:\windows\system32\nlaapi.dll
2014-12-06 03:14 . 2015-01-15 05:56	174080	----a-w-	c:\windows\system32\nlasvc.dll
2014-12-06 03:14 . 2015-01-15 05:56	93184	----a-w-	c:\windows\system32\ncsi.dll
2014-12-03 02:06 . 2014-12-11 06:29	278528	----a-w-	c:\windows\system32\schannel.dll
2011-04-14 12:01 . 2015-01-27 08:21	24376	----a-w-	c:\program files\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-04-02 102400]
.
c:\users\Weber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
wkcalrem.LNK - c:\program files\Common Files\microsoft shared\Works Shared\WkCalRem.exe [2005-8-19 21504]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Samsung Network PC Fax.lnk - c:\windows\System32\spool\drivers\w32x86\3\NetFaxTray.exe [2014-1-26 287792]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files\T-Online\DSL-Manager\DslMgr.exe [2007-12-27 1085440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^OnlineControl.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\OnlineControl.lnk
backup=c:\windows\pss\OnlineControl.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"ehTray.exe"=c:\windows\ehome\ehTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-01-08 1136600]
R4 AAV UpdateService;AAV UpdateService;c:\program files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [2008-10-24 128296]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - avipbb
*Deregistered* - ssmdrv
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-14 c:\windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 09:20]
.
2014-02-02 c:\windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job
- c:\program files\TuneUp Utilities 2014\OneClick.exe [2014-07-16 08:22]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://go.1und1.de/links/home
uSearchURL,(Default) = hxxp://go.1und1.de/suchbox/1und1suche?su=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.comdirect.de/
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T-Online DSL-Manager.lnk - c:\program files\T-Online\DSL-Manager\TODslMgr.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-WEB - c:\program files\WEB.DE\LiveUpdate\m2LUTray.exe
AddRemove-{2EF095CE-24AF-4AAA-BB82-85F988EC51C0} - c:\programdata\{411234A5-A7C5-4628-A4D3-64C942F8C38C}\1und1 Internet Explorer Add-On.exe
AddRemove-{9B8E1C10-3952-48D3-BC66-F223DDC3A556} - c:\programdata\{BA53D93D-6DA8-41AA-AD03-9D07C35074A6}\Firefox-3.6-WEB.DE-Edition.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2015-02-17 15:48
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\serviceIEConfig]
"ImagePath"="c:\windows\System32\ieconfig_1und1_svc.exe /startedbyscm:016FE01B-40E31F2D-serviceIEConfig"
.
Zeit der Fertigstellung: 2015-02-17  15:50:21
ComboFix-quarantined-files.txt  2015-02-17 14:50
.
Vor Suchlauf: 18 Verzeichnis(se), 194.918.576.128 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 194.836.115.456 Bytes frei
.
- - End Of File - - 71453583DF849DDEBFBEB31269631473
3B36DED9C27949DC7D0E3C9DF8F8A5D4

Nochmals vielen Dank und bis bald.
Gruß Vogel 35

schrauber · 17.02.2015, 20:30

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Vogel35 · 18.02.2015, 12:33

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-02-2015
Ran by Weber at 2015-02-16 19:28:39
Running from C:\Users\Weber\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1&1 EasyLogin (HKLM\...\1&1 EasyLogin) (Version: - )
1und1 Internet Explorer Add-On (Version: 1.0 - 1&1 Internet AG) Hidden
320 Solitaires (HKLM\...\320 Solitaires) (Version: - )
AAVUpdateManager (HKLM\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Acrobat Connect Add-in (HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Adobe Acrobat Connect Add-in) (Version: - )
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\Adobe Shockwave Player) (Version: 10.1.4.20 - Adobe Systems, Inc.)
Adobe® Photoshop® Album Starter Edition 3.2 (HKLM\...\Adobe® Photoshop® Album Starter Edition 3.2) (Version: 3.2.0 - hxxp://www.adobe.de)
Amazon Kindle (HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Amazon Kindle) (Version: - Amazon)
AntiBrowserSpy (HKLM\...\{F78B5B4F-075A-4C81-AA27-E707861EB5B7}_is1) (Version: 154 - Abelssoft)
Ask Shopping Toolbar (HKLM\...\{4F524A00-6A76-A76A-76A7-A758B70C1500}) (Version: 12.21.0.124 - APN, LLC) <==== ATTENTION
Avira (HKLM\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Cliqz (HKLM\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.63 - Cliqz.com)
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Duden Korrektor Patch 012009 (HKLM\...\{8AEBFD30-B94F-4A49-8106-03039708BDD4}) (Version: 6.00.1000 - Bibliographisches Institut & F.A. Brockhaus AG)
Duden Korrektor PLUS (HKLM\...\{62326989-2861-4911-A39E-26373BD3FF66}) (Version: 6.00.00 - Bibliographisches Institut & F.A. Brockhaus AG)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 14.3.11574 - Landesfinanzdirektion Thüringen)
Feedback Tool (HKLM\...\{13A5E785-5197-4EAD-8EE3-D660271E49BC}) (Version: 1.2.0 - Microsoft Corporation)
Firebird SQL Server - MAGIX Edition 2.0.0.1 (D) (HKLM\...\Firebird SQL Server D) (Version: 2.0.0.1 - MAGIX AG)
Firefox 3.6 WEB.DE Edition (Version: 1.6 - WEB.DE) Hidden
Grand Ages Rome 1.11 (HKLM\...\Civitas3) (Version: 1.11 - Kalypso Media)
HijackThis 2.0.2 (HKLM\...\HijackThis) (Version: 2.0.2 - TrendMicro)
InfoBibliothek 2 (HKLM\...\{78D7D7CD-A06B-4514-ACBD-8055BF945A8E}) (Version: 1.08.03.01 - Akademische Arbeitsgemeinschaft Verlag Wolters Kluwer GmbH)
Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.710 - Oracle)
KeyDepot (HKLM\...\KeyDepot_is1) (Version: 3.20 - Abelssoft)
LightScribe 1.4.124.1 (Version: 1.4.124.1 - hxxp://www.lightscribe.com) Hidden
lingDIALOG (HKLM\...\InstallShield_{071B843C-9A39-40B3-BB01-BBD6A8D2E1C5}) (Version: 3.0908 - WEVOSYS)
lingDIALOG (Version: 3.0908 - WEVOSYS) Hidden
MCE Software Encoder 1.1 (HKLM\...\{7655E113-C306-11D9-A373-0050BAE317E1}) (Version: 1.1.0.1108 - CyberLink Corporation)
MediaShow 3.0 (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version: - )
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 German Language Pack (HKLM\...\{E78BFA60-5393-4C38-82AB-E8019E464EB4}) (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - )
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}) (Version: 08.05.0822 - Microsoft Corporation)
Moorhuhn Remake (HKLM\...\{52210D57-0B1F-4681-90DD-8659DF4BCC40}) (Version: 1.00.0000 - )
Mozilla Firefox 35.0.1 (x86 de) (HKLM\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 32.0.2 - Mozilla)
MSXML 4.0 SP2 (KB925672) (HKLM\...\{A9CF9052-F4A0-475D-A00F-A8388C62DD63}) (Version: 4.20.9839.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 7 Essentials (HKLM\...\{63B75E16-F290-4FCD-AF67-A9134CD01031}) (Version: 7.02.5182 - Nero AG)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
OpenOffice 4.1.0 (HKLM\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)
PhotoNow! 1.0 (HKLM\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: - )
Platform (Version: 1.22 - VIA Technologies, Inc.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.2414.0 - CyberLink Corporation)
QuickTime (HKLM\...\{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}) (Version: 7.1.3.100 - Apple Computer, Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7272 - Realtek Semiconductor Corp.)
Robin Hood TsoSF (HKLM\...\Robin Hood TsoSF) (Version: - )
Samsung Easy Document Creator (HKLM\...\Samsung Easy Document Creator) (Version: 1.04.63 (28.02.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM\...\Samsung Easy Printer Manager) (Version: 1.02.99.00(04.02.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Wireless Setup (HKLM\...\Easy Wireless Setup) (Version: 3.60.07 - Samsung Electronics Co., Ltd.)
Samsung M267x 287x Series (HKLM\...\Samsung M267x 287x Series) (Version: 1.12 (08.03.2013) - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM\...\Samsung Network PC Fax) (Version: 1.09.11 (14.01.2013) - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (HKLM\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
Samsung Printer Live Update (HKLM\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (Version: 1.00.49.00 - Samsung Electronics Co., Ltd.) Hidden
ScanSoft PaperPort 11 (HKLM\...\{7A8FF745-BBC5-482B-88E4-18D3178249A9}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Sceneo Bonavista (HKLM\...\{4C73B683-B15D-4B94-AC7A-520B70C4FFE9}) (Version: - )
Skat Clubmeister (HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Skat Clubmeister) (Version: - )
Skat, Schwimmen und Mau Mau (HKLM\...\Skat, Schwimmen und Mau Mau_is1) (Version: - madcat Software GmbH)
SNS Upload for Easy Document Creator (HKLM\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SteuerBerater für Lehrer 2013-2014 (HKLM\...\{E84E9818-988D-44E1-A996-FC05F83A64DC}) (Version: 1.00.9 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung 2013 (HKLM\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.10 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung Lehrer 2014 (HKLM\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.10.89 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung Plus 2010 (HKLM\...\{82436073-5B66-4DD4-A815-437244503120}) (Version: 15.14 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung Plus 2011 (HKLM\...\{257F2279-6843-433E-9060-15BAB966F20D}) (Version: 16.16 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung Plus 2012 (HKLM\...\{3BCDCC6A-3A47-4883-8A0C-55AC061316CB}) (Version: 17.12 - Wolters Kluwer Deutschland GmbH)
Sunny Hillride 1.0 (HKLM\...\{B4B9067D-E80A-4A24-9ED5-B9C451CFE67E}) (Version: 1.0 - Headup Games)
SuperEasy Driver Updater v.1.1.1 (HKLM\...\{039BC111-D60F-A6FF-85F4-7992EA886B8D}_is1) (Version: 1.1.1 - SuperEasy Software GmbH & Co. KG)
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM\...\TuneUp Utilities) (Version: 14.0.1000.340 - TuneUp Software)
TuneUp Utilities 2014 (Version: 14.0.1000.340 - TuneUp Software) Hidden
Ulead PhotoImpact 12 (HKLM\...\{11AFE21E-B193-430D-B57A-DFF7815BB962}) (Version: 12.0 - Ulead System)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VIA Plattform-Geräte-Manager (HKLM\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.22 - VIA Technologies, Inc.)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WEB.DE Toolbar für Mozilla Firefox (HKLM\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 1.5.5.0 - 1&1 Mail & Media GmbH)
Windows Live Toolbar (HKLM\...\Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0) (HKLM\...\3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F) (Version: 10/12/2007 6.85.4.0 - Nokia)
X10 Hardware(TM) (HKLM\...\X10Hardware) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{029209E8-38B5-482B-BCDD-FC9B276FE352}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{0454F501-2BAE-4570-9F6E-440A28049AC2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{0CD20A4B-7CB5-45C1-B957-748A155E753E}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{11344345-5091-4C52-9841-D13086E0EEC2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{1B05BF56-E227-49CE-B2C9-5C1C9F40E460}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{23FB70B3-7A4F-457D-BE2F-AB583E76D8E7}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{25F841D3-408D-45F5-B3EA-4972A18B7737}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{2822DCFC-717E-4F88-9BE6-FA946CCB4017}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{2837E0FE-686B-4CB0-BE53-0EA097EAF71B}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{302276CC-737D-4D15-9A5C-EC2031D673EB}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{327DA9A8-4E9E-4E14-AC1B-C159A6B2865B}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{515A9E01-5D33-4C70-8E43-62DD3FE06B35}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{531DFEAC-826E-4C3D-BF76-425A5AF61A0E}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{5B7524C8-2446-40E9-9474-94A779DBA224}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{5E801020-E0CA-4708-9E07-A256A8FFBD2A}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{60774992-7CCF-437E-B32D-7E5DC00EFFB8}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{61975864-C48D-464E-8AC0-12D8DE16C813}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{621D3650-F1D3-414C-97F9-03A02B211261}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{623E415A-22EF-4DAA-A2FF-E68E77A673C9}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{659CE3EB-9F99-422E-9255-61CAC57B3510}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{6D89B10C-1802-430F-A3D3-FD2C621AFC26}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{714A66CE-B7B3-4029-B345-56B2B4823079}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{71A43C79-BC43-419F-A304-061AA2E74846}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{79D12C76-06D9-431F-9A5A-82B93EA5083C}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{8380194E-073A-40D0-970F-A01988D27B5C}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{885BB46A-3F1E-44C3-A01B-A7D9260CC98B}\InprocServer32 -> C:\Windows\Downloaded Program Files\dwusplay.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{885BB46A-3F1E-44C3-A01B-A7D9260CC98B}\localserver32 -> C:\Windows\Downloaded Program Files\dwusplay.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{915C2CEB-216B-4B7C-89E4-9ED3512D58D9}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{92C5E738-7372-4CD6-BE57-15833624EBF3}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{9CAAD2EA-177B-4D07-871F-47255B5D30F3}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{9F659E80-34A5-40FD-9806-3115FF07CA5A}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{9F8B217D-3EF8-44FC-9079-5581D0943725}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{A08EDBE0-D6C1-4F98-95EE-F9DABE2F57B9}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{AAFFEBCF-CEAE-44D1-87BC-21DD59AB2951}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{B391A1DB-28C8-4506-A43C-5BD6051F16BA}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{B452070B-D0CF-4C30-9E0C-FD86A154746F}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{B956DB4C-E9D5-4BA6-98F2-B569F5E89EA2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{BDFBC8FB-4E9D-4118-8B82-0F3E21B47751}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{C266DD0E-ABF0-4D2D-BC80-442941767642}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{CF03108C-3EC6-4DA8-8A89-9414431EC87E}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{D6583D24-BAD0-4F9D-9C48-7CEE73E2CEFC}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{DA68042E-486F-4BA7-ADDB-891126B8BD31}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{DC62AB5B-4A63-4AF0-A623-2CB24B400BE2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{E50C953D-311A-481B-8F8D-C55E65AF7417}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{E9880553-B8A7-4960-A668-95C68BED571E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{E9A93328-79D4-4AED-A778-146E7191F8BC}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EA2DD391-0F60-42F7-9AA8-9576C907E6E3}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EA3398E8-18DB-4369-870F-73414EE55D79}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EDE36E93-52E9-48AE-97AE-EEF558558F1F}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EF2D9BFD-E3B2-455F-A917-BA5826CEFD50}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F1522EC1-F84F-4CE2-A38C-F9384B0DFD41}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F2699F06-4BD8-46D5-AB11-D5626BA04574}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F3A9BCA1-7EE6-4E6C-B8DF-53D389F58457}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F74EBFCA-61B4-4A74-BE4B-BE91765747C1}\InprocServer32 -> C:\Program Files\Duden\Duden Korrektor\DudenKorrektor.dll (Expert System S.p.A.)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F7DE72AB-464D-4ACF-94E1-56BBDEF284B6}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{FBF36969-88B5-4F2C-991E-DCB0BF28E5C0}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{FFF2D28F-E4EE-44D9-8104-8E71556757F6}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (InstallShield Software Corporation)

==================== Restore Points =========================

30-12-2014 07:54:32 Windows Update
07-01-2015 07:20:21 Windows Update
07-01-2015 07:46:35 Windows Defender Checkpoint
07-01-2015 11:29:16 Wiederherstellungsvorgang
07-01-2015 11:42:29 Windows Update
14-01-2015 07:43:45 Windows Update
15-01-2015 06:54:35 Windows Update
24-01-2015 17:07:47 Windows Update
30-01-2015 09:00:05 Windows Update
03-02-2015 08:37:24 Windows Update
10-02-2015 08:12:49 Windows Update
12-02-2015 05:30:31 Windows Update
14-02-2015 10:09:27 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2013-08-21 12:40 - 00000859 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 google-analytics.com

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1875271A-8676-49DF-9894-66D0505B7161} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2753FBBE-BACB-43F1-A631-3BC4879B3BC8} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-18] (Microsoft Corporation)
Task: {2D0DCF85-45A1-469D-9165-91B37640B2DA} - System32\Tasks\Google Updater and Installer => C:\Users\Weber\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {585FA34D-BE66-4461-AF82-DAC206D6923E} - System32\Tasks\{086172D4-FBB3-4729-93AC-6A2273A1B0FA} => pcalua.exe -a "D:\Tools\Sceneo Bonavista\Setup.exe" -d "D:\Tools\Sceneo Bonavista"
Task: {6CA539A4-788F-44D9-9522-8312689396B8} - System32\Tasks\DriverScanner => C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe
Task: {703A128E-0807-4BA6-B8C6-3D3084C0A6E6} - System32\Tasks\Auf Updates für Windows Live Toolbar prüfen => C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19] (Microsoft Corporation)
Task: {7FC6BE06-C75C-4D29-84E1-634AAC28E488} - System32\Tasks\InstallShield Software-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2004-08-09] (InstallShield Software Corporation)
Task: {89F61BE6-D7F0-4CB4-8C89-AEEB02463808} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: {8A2FE36C-D0A1-4C59-AD3A-1D1DD19EEF26} - System32\Tasks\{A90E64BD-7A52-4F33-A61C-A0C1F2F953A1} => pcalua.exe -a "C:\Program Files\Skype\Phone\unins000.exe"
Task: {8A8370F5-62E7-4E6C-96FA-02E621206FC1} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: {8EA2784B-0F2E-4362-82E4-A99F244D2C95} - System32\Tasks\ScanSoft Background Update => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {9065648E-49DC-44B1-AA82-82E6786D8163} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: {9C2B50F8-3287-4A85-B3C1-2E20E3001ED5} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-09-26] (Oracle Corporation)
Task: {AB4EB9C4-C0A1-4CF0-BE0A-ADE26396511A} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files\TuneUp Utilities 2012\OneClick.exe
Task: {ADEFF3A5-7527-4627-B298-81767BBCBA18} - System32\Tasks\{726E303F-48F1-4362-868B-EDAFAF73C7BC} => pcalua.exe -a C:\Users\Weber\Downloads\IE8-Setup-Full-32.exe -d "C:\Program Files\Mozilla Firefox"
Task: {B1CE57E0-2B7D-4ED1-8E1A-1BEE53272612} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\TuneUp Utilities 2014\OneClick.exe [2014-07-16] (TuneUp Software)
Task: {BDBA8386-1E26-496F-A844-24389AB05642} - System32\Tasks\{67EA85AE-106E-42B6-978A-F0089C443D6D} => pcalua.exe -a E:\setup.exe -d E:\ -c -c
Task: {C5B25D39-5D19-4670-95D0-96C03C034CE2} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files\TuneUp Utilities 2010\OneClick.exe
Task: {CE52EA52-1C94-43CF-99FB-F70B7E8AEED7} - System32\Tasks\McDefragTask => c:\program files\mcafee\mqc\QcConsol.exe
Task: {E60B7E04-BBEB-4118-A1A4-9824383AFEBD} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {E8F024A1-1D86-4970-9B91-D795C251953F} - System32\Tasks\{6780C582-76B7-4530-ADA1-39100633D8C8} => pcalua.exe -a E:\MInst.exe -d E:\
Task: {F861413A-3272-4934-B14F-2E1E3F8F5B3D} - System32\Tasks\McQcTask => c:\program files\mcafee\mqc\QcConsol.exe
Task: {FBEF25C0-67EE-4BB8-808E-C0550D52A53E} - System32\Tasks\{D57D6638-1901-41F8-BB20-DB2A5DABD0DF} => pcalua.exe -a C:\Users\Weber\Downloads\IE8-Setup-Full-32.exe -d "C:\Program Files\Mozilla Firefox"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job => C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files\TuneUp Utilities 2014\OneClick.exe

==================== Loaded Modules (whitelisted) ==============

2013-06-26 11:42 - 2013-06-26 11:42 - 00024064 _____ () C:\Windows\System32\ssa6mlm.dll
2013-06-26 11:42 - 2013-06-26 11:42 - 01021952 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\ssa6mdu.dll
2007-02-13 10:23 - 2006-12-19 22:23 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2013-03-03 10:12 - 2013-03-03 10:12 - 01053848 _____ () C:\Windows\System32\ieconfig_1und1_svc.exe
2007-02-12 10:30 - 2006-06-26 13:34 - 00098304 _____ () C:\Program Files\Sceneo\Bonavista\Services\PVR\tvtvRemote.dll
2009-09-24 13:48 - 2009-04-11 07:28 - 00368640 _____ () C:\Windows\system32\msjetoledb40.dll
2007-02-12 10:30 - 2004-04-23 15:01 - 00299008 _____ () C:\Windows\system32\midas.dll
2014-07-16 09:24 - 2014-07-16 09:24 - 00585528 _____ () C:\Program Files\TuneUp Utilities 2014\avgreplibx.dll
2012-03-09 09:58 - 2012-03-09 09:58 - 00350072 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2012-03-09 09:58 - 2012-03-09 09:58 - 00056696 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2015-01-27 09:21 - 2015-01-27 09:21 - 03925104 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\Wallpaper\img24.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^OnlineControl.lnk => C:\Windows\pss\OnlineControl.lnk.CommonStartup
MSCONFIG\startupreg: WEB.DE Update => C:\Program Files\WEB.DE\LiveUpdate\m2LUTray.exe

==================== Accounts: =============================

Administrator (S-1-5-21-3016044035-3929161208-4058345445-500 - Administrator - Disabled)
ASPNET (S-1-5-21-3016044035-3929161208-4058345445-1003 - Limited - Enabled)
Gast (S-1-5-21-3016044035-3929161208-4058345445-501 - Limited - Disabled)
Weber (S-1-5-21-3016044035-3929161208-4058345445-1001 - Administrator - Enabled) => C:\Users\Weber

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} [0x80110802] ist ein Fehler aufgetreten.

Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Volume einem Schattenkopiesatz hinzufügen

Kontext:
Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
Snapshotkontext: 16
Ausführungskontext: Coordinator

Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80110802]

Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Volume einem Schattenkopiesatz hinzufügen

Kontext:
Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
Snapshotkontext: 16
Ausführungskontext: Coordinator

Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} [0x80110802] ist ein Fehler aufgetreten.

Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
Überprüfen, ob das Volume vom Anbieter unterstützt wird
Volume einem Schattenkopiesatz hinzufügen

Kontext:
Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
Snapshotkontext: 16
Snapshotkontext: 16
Ausführungskontext: Coordinator
Anbieter-ID: {00000000-0000-0000-0000-000000000000}
Volumename: C:\
Ausführungskontext: Coordinator

Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80110802]

Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
Überprüfen, ob das Volume vom Anbieter unterstützt wird
Volume einem Schattenkopiesatz hinzufügen

Kontext:
Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
Snapshotkontext: 16
Snapshotkontext: 16
Ausführungskontext: Coordinator
Anbieter-ID: {00000000-0000-0000-0000-000000000000}
Volumename: C:\
Ausführungskontext: Coordinator

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} [0x80110802] ist ein Fehler aufgetreten.

Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Volume einem Schattenkopiesatz hinzufügen

Kontext:
Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
Snapshotkontext: 16
Ausführungskontext: Coordinator

Error: (02/16/2015 02:03:06 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80110802]

Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Volume einem Schattenkopiesatz hinzufügen

Kontext:
Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
Snapshotkontext: 16
Ausführungskontext: Coordinator

System errors:
=============
Error: (02/16/2015 09:36:14 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {74944725-B65F-4E37-8633-BD4DDE193921}

Error: (02/16/2015 07:42:09 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/15/2015 03:51:40 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/15/2015 10:09:31 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {74944725-B65F-4E37-8633-BD4DDE193921}

Error: (02/15/2015 08:01:36 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/14/2015 10:06:35 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/13/2015 06:19:24 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/13/2015 03:39:10 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/13/2015 07:09:51 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/12/2015 06:26:23 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Microsoft Office Sessions:
=========================
Error: (12/11/2014 08:02:24 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1704 seconds with 660 seconds of active time. This session ended with a crash.

Error: (05/29/2014 06:50:34 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 4499 seconds with 600 seconds of active time. This session ended with a crash.

Error: (05/18/2014 08:25:07 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 10 seconds with 0 seconds of active time. This session ended with a crash.

Error: (10/01/2009 06:40:17 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6504.5001, Microsoft Office Version: 12.0.6215.1000. This session lasted 754 seconds with 720 seconds of active time. This session ended with a crash.

CodeIntegrity Errors:
===================================
Date: 2015-01-07 10:44:47.432
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 10:44:46.980
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 10:44:46.524
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 10:44:45.896
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 10:30:46.804
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 10:02:12.240
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 08:44:39.465
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 08:44:38.991
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 08:44:38.521
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 08:44:37.897
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

==================== Memory info ===========================

Processor: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
Percentage of memory in use: 59%
Total physical RAM: 2045.76 MB
Available physical RAM: 835.09 MB
Total Pagefile: 4342.78 MB
Available Pagefile: 2651.73 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.55 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:271.72 GB) (Free:182.23 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:26.34 GB) (Free:17.55 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: B4215544)
Partition 1: (Active) - (Size=271.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=26.4 GB) - (Type=OF Extended)

==================== End Of Log ============================[CODE]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Weber on 18.02.2015 at 12:08:32,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{F2AFA479-49FA-448B-A74D-2D364E7F7E37}

~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\DriverScanner

~~~ Folders

~~~ FireFox

Successfully deleted the following from C:\Users\Weber\AppData\Roaming\mozilla\firefox\profiles\h5gq9l5o.default\prefs.js

user_pref("avira.safe_search.search_was_active", "false");

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.02.2015 at 12:12:16,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Weber on 18.02.2015 at 12:08:32,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{F2AFA479-49FA-448B-A74D-2D364E7F7E37}



~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\DriverScanner



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Weber\AppData\Roaming\mozilla\firefox\profiles\h5gq9l5o.default\prefs.js

user_pref("avira.safe_search.search_was_active", "false");



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.02.2015 at 12:12:16,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~JRT Logfile:

	Code: 

 ATTFilter

  
	~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Weber on 18.02.2015 at 12:08:32,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{F2AFA479-49FA-448B-A74D-2D364E7F7E37}



~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\DriverScanner



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Weber\AppData\Roaming\mozilla\firefox\profiles\h5gq9l5o.default\prefs.js

user_pref("avira.safe_search.search_was_active", "false");



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.02.2015 at 12:12:16,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
 --- --- ---
FRST Logfile:

FRST Logfile:
 Code: 

 ATTFilter
 
 Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-02-2015
Ran by Weber (administrator) on WEBER-PC on 16-02-2015 19:26:45
Running from C:\Users\Weber\Desktop
Loaded Profiles: Weber (Available profiles: Weber)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\w32x86\3\NetFaxServer.exe
() C:\Windows\System32\ieconfig_1und1_svc.exe
(Buhl Data Service GmbH) C:\Program Files\Sceneo\Bonavista\Services\PVR\pvrservice.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
(X10) C:\Program Files\Common Files\X10\Common\X10nets.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\w32x86\3\NetFaxTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft® Corporation) C:\Program Files\Common Files\microsoft shared\Works Shared\WkCalRem.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Ascora GmbH) C:\Program Files\KeyDepot\KeyDepot.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [143360 2006-12-23] (Nero AG)
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-18] (Microsoft Corporation)
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-18] (Microsoft Corporation)
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Run: [AutoStartNPSAgent] => C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [145408 2008-02-15] (Google)
IFEO\backitup.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\coverdes.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\infotool.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\nero.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\neroburnrights.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\neromediahome.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\neroscoutoptions.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\nerostartsmart.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\neroupgrade.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\nerovision.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\nvstlink.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\nvstview.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\photoshop album starter edition.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\photosnap.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\photosnapviewer.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\powerdvd.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\recode.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\sse.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\startcenter.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
IFEO\waveedit.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\w32x86\3\NetFaxTray.exe (Samsung Electronics Co., Ltd.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files\T-Online\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T-Online DSL-Manager.lnk
ShortcutTarget: T-Online DSL-Manager.lnk -> C:\Program Files\T-Online\DSL-Manager\TODslMgr.exe (No File)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files\T-Online\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T-Online DSL-Manager.lnk
ShortcutTarget: T-Online DSL-Manager.lnk -> C:\Program Files\T-Online\DSL-Manager\TODslMgr.exe (No File)
Startup: C:\Users\Weber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Weber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkcalrem.LNK
ShortcutTarget: wkcalrem.LNK -> C:\Program Files\Common Files\microsoft shared\Works Shared\WkCalRem.exe (Microsoft® Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.1und1.de/links/home
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/br/ie9_startpage
HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://web.de/
URLSearchHook: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> DefaultScope {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {215F0CCF-0EA1-49C4-AE83-7C7A7BCA778F} URL = hxxp://go.web.de/suchbox/ebay?query={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {40064957-18EB-412d-9146-3F57E8D92EEC} URL = hxxp://go.web.de/br/ie9_search_pic/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {4D09445C-BB6F-4034-B4F7-3894A743F9EF} URL = hxxp://www.search.ask.com/web?tpid=ORJ&o=100000027&pf=V7&p2=^U3^OSJ000^YY^DE&gct=&itbv=12.19.0.104&apn_uid=61F89278-23F4-4BDD-80B5-934DD4825EBD&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_dbr=ff_19.0&doi=2013-06-14&trgb=IE,FF&q={searchTerms}&psv=&pt=tb
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {6446CB54-76E5-4A5D-AB54-CCB530FF9D65} URL = hxxp://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://go.web.de/suchbox/google?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {70BD6931-265D-4767-A53A-7CD5FA722A08} URL = hxxp://search.1und1.de/search/web/?su={searchTerms}&mc=searchplugin@suche@msie.suche@web&origin=searchplugin
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {8D27B32E-89EE-460e-82D2-5FC354078EAD} URL = hxxp://go.web.de/br/ie9_search_produkte/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {A3812F4B-2B8C-4BE0-82BB-25A494971DF8} URL = hxxp://go.web.de/suchbox/amazon/?keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = 
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {B7320D5A-AD81-432A-9108-01C660C580C9} URL = hxxp://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {D972B939-DD25-48D5-AC20-A59F3B5741CD} URL = hxxp://go.web.de/suchbox/smartshopping/?searchText={searchTerms}&mc=searchplugin@suche@msie.suche@preisvergleich
SearchScopes: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> {DCE59F23-A446-45a5-9459-E68FDC0DE38D} URL = hxxp://go.web.de/br/ie9_search_maps/?su={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Toolbar Helper -> {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -> C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
BHO: Ask Shopping Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files\AskPartnerNetwork\Toolbar\ORJ\Passport.dll (APN LLC.)
BHO: 1&&1 Internet AG Browser Configuration by mquadr.at -> {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} -> C:\Windows\System32\ieconfig_1und1.dll (mquadr.at software engineering und consulting GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
Toolbar: HKLM - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\AskPartnerNetwork\Toolbar\ORJ\Passport.dll (APN LLC.)
Toolbar: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
Toolbar: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001 -> Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\AskPartnerNetwork\Toolbar\ORJ\Passport.dll (APN LLC.)
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {44990B00-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlcm.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF SearchEngineOrder.1: Ask.com
FF Homepage: hxxp://www.comdirect.de/
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Cliqz Beta - C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\Extensions\cliqz@cliqz.com [2015-02-14]
FF Extension: WEB.DE MailCheck - C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\Extensions\toolbar@web.de [2015-01-08]
FF Extension: Adblock Plus - C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-07]
FF HKLM\...\Firefox\Extensions: [jid0-1wPBLrijxGVkIUhu0kFYq6ZaWzA@jetpack] - C:\Program Files\AntiBrowserSpy\Addons\Firefox
FF Extension: AntiBrowserSpy - SocialBlocker - C:\Program Files\AntiBrowserSpy\Addons\Firefox [2015-02-14]
FF HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Weber\AppData\Roaming\Mozilla\Firefox\Profiles\h5gq9l5o.default\extensions\cliqz@cliqz.com

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 AAV UpdateService; C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-10-30] (APN LLC.)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
S3 FirebirdServerMAGIXInstance; C:\Program Files\ALDI Foto Service Nord\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed]
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2009-03-31] (Teruten) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2006-10-19] (Hewlett-Packard Company) [File not signed]
S4 NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [774144 2006-12-05] (Nero AG) [File not signed]
S4 NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [262144 2006-12-23] (Nero AG) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] ()
R2 Samsung Network Fax Server; C:\Windows\system32\spool\drivers\w32x86\3\NetFaxServer.exe [376368 2013-01-14] (Samsung Electronics Co., Ltd.)
R2 serviceIEConfig; C:\Windows\System32\ieconfig_1und1_svc.exe [1053848 2013-03-03] ()
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]
R2 srvcPVR; C:\Program Files\Sceneo\Bonavista\Services\PVR\PVRService.exe [1459712 2006-12-15] (Buhl Data Service GmbH) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1781048 2014-07-16] (TuneUp Software)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-18] (Microsoft Corporation)
R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]
R2 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe /Processid:{ADDCC6CA-3958-4E53-9BDA-5ED577B1FED7}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3xHybrid; C:\Windows\System32\DRIVERS\3xHybrid.sys [1136600 2007-01-08] (Philips Semiconductors GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-18] (Avira Operations GmbH & Co. KG)
S3 BrSerIf; C:\Windows\System32\Drivers\BrSerIf.sys [52224 2006-12-12] (Brother Industries Ltd.) [File not signed]
S3 BrUsbSer; C:\Windows\System32\Drivers\BrUsbSer.sys [11904 2006-09-03] (Brother Industries Ltd.) [File not signed]
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [28208 2010-02-08] (REINER SCT)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [16448 2007-08-01] (T-Systems Enterprise Services GmbH)
R3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc.              )
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] () [File not signed]
S3 Ph3xIB32; C:\Windows\System32\DRIVERS\Ph3xIB32.sys [1131136 2007-04-03] (Philips Semiconductors GmbH)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [17920 2009-08-10] (Silicon Laboratories, Inc.)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [63488 2009-08-10] (Silicon Laboratories)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-18] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2012-11-19] (Samsung Electronics) [File not signed]
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-12-16] (TuneUp Software)
R2 v2imount; C:\Windows\System32\DRIVERS\v2imount.sys [38112 2008-01-19] (Symantec Corporation)
R0 videX32; C:\Windows\System32\DRIVERS\videX32.sys [9216 2006-10-17] (VIA Technologies, Inc.)
S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [15088 2008-01-19] (Symantec Corporation)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13976 2006-11-17] (X10 Wireless Technology, Inc.)
R0 xfilt; C:\Windows\System32\DRIVERS\xfilt.sys [17920 2006-10-18] (VIA Technologies,Inc)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2008-10-28] (X10 Wireless Technology, Inc.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 dsltestSp5; System32\Drivers\dsltestSp5.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 19:26 - 2015-02-16 19:28 - 00022627 _____ () C:\Users\Weber\Desktop\FRST.txt
2015-02-16 19:26 - 2015-02-16 19:26 - 00000000 ____D () C:\FRST
2015-02-16 19:25 - 2015-02-16 19:25 - 01125888 _____ (Farbar) C:\Users\Weber\Desktop\FRST.exe
2015-02-16 10:59 - 2015-02-16 10:59 - 00001883 _____ () C:\Users\Weber\Desktop\Avira Free Antivirus Profil Lokale Festplatten.LNK
2015-02-16 07:55 - 2015-02-16 07:55 - 00000438 _____ () C:\Users\Weber\Desktop\Telefonliste.wps - Verknüpfung.lnk
2015-02-14 10:33 - 2015-02-14 19:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiBrowserSpy
2015-02-14 10:31 - 2015-02-14 10:31 - 00000000 ____D () C:\Users\Weber\AppData\Roaming\Cliqz
2015-02-13 07:23 - 2015-01-23 04:00 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-13 07:23 - 2015-01-23 03:51 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-12 05:43 - 2014-11-26 03:05 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-12 05:42 - 2015-01-13 02:39 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-12 05:42 - 2015-01-09 01:20 - 02063360 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-12 05:38 - 2015-01-15 05:13 - 00440760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-12 05:38 - 2014-12-08 02:59 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 05:45 - 2015-01-14 02:51 - 12371456 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 05:45 - 2015-01-14 02:49 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-11 05:45 - 2015-01-14 02:46 - 09742336 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 05:45 - 2015-01-14 02:43 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 05:45 - 2015-01-14 02:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 05:45 - 2015-01-14 02:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 05:45 - 2015-01-14 02:41 - 01802752 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 05:45 - 2015-01-14 02:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 05:45 - 2015-01-14 02:41 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 05:45 - 2015-01-14 02:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-11 05:45 - 2015-01-14 02:41 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 05:45 - 2015-01-14 02:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 05:45 - 2015-01-14 02:40 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-11 05:45 - 2015-01-14 02:40 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-02-11 05:45 - 2015-01-14 02:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-01-27 09:21 - 2015-01-27 09:21 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 19:13 - 2006-11-02 13:47 - 00003296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-16 19:13 - 2006-11-02 13:47 - 00003296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-16 18:11 - 2007-03-21 12:59 - 01254381 _____ () C:\Windows\WindowsUpdate.log
2015-02-16 11:04 - 2007-03-26 14:12 - 00023396 _____ () C:\Users\Weber\AppData\Roaming\wklnhst.dat
2015-02-16 07:48 - 2009-01-01 15:58 - 00002633 _____ () C:\Users\Weber\Desktop\Exel 2007.lnk
2015-02-16 07:41 - 2006-11-02 13:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-02-16 07:41 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration
2015-02-15 19:46 - 2006-11-02 11:33 - 01594468 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-15 07:59 - 2015-01-07 09:58 - 00003582 _____ () C:\Windows\PFRO.log
2015-02-14 20:59 - 2006-11-02 14:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-14 20:59 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-14 20:55 - 2008-04-24 10:45 - 00000254 _____ () C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
2015-02-14 10:35 - 2012-12-21 16:41 - 00000000 ____D () C:\Users\Weber\AppData\Local\Abelssoft
2015-02-14 10:33 - 2014-02-15 12:05 - 00000892 _____ () C:\Users\Public\Desktop\AntiBrowserSpy.lnk
2015-02-14 10:33 - 2014-02-15 12:02 - 00000000 ____D () C:\Program Files\AntiBrowserSpy
2015-02-12 06:05 - 2015-01-02 14:37 - 00517248 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 05:51 - 2013-08-15 13:41 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 05:44 - 2006-11-02 11:24 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-02-12 05:43 - 2007-02-10 15:01 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 19:46 - 2012-05-20 07:07 - 00002631 _____ () C:\Users\Weber\Desktop\Microsoft Office Word 2007.lnk
2015-02-10 15:22 - 2014-08-05 11:37 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-10 15:22 - 2014-02-10 11:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-10 15:22 - 2014-02-10 11:33 - 00000000 ____D () C:\Program Files\Avira
2015-02-10 08:09 - 2012-05-13 18:02 - 00000000 ____D () C:\Users\Weber\AppData\Local\Thunderbird
2015-01-27 11:34 - 2013-06-26 16:41 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-01-24 18:15 - 2010-09-13 07:00 - 00000000 ____D () C:\Users\Weber\Documents\OneNote-Notizbücher

==================== Files in the root of some directories =======

2007-10-18 09:29 - 2011-03-06 12:19 - 0017908 _____ () C:\Users\Weber\AppData\Roaming\UserTile.png
2007-03-26 14:12 - 2015-02-16 11:04 - 0023396 _____ () C:\Users\Weber\AppData\Roaming\wklnhst.dat
2007-03-21 16:01 - 2013-04-14 20:30 - 0016072 _____ () C:\Users\Weber\AppData\Local\d3d9caps.dat
2007-03-28 15:47 - 2014-11-26 10:28 - 0016384 _____ () C:\Users\Weber\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2007-03-28 13:47 - 2007-03-28 13:47 - 0000093 _____ () C:\Users\Weber\AppData\Local\fusioncache.dat
2014-11-03 10:43 - 2014-11-03 10:43 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2007-04-06 07:54 - 2007-04-06 08:22 - 0001026 _____ () C:\ProgramData\hpzinstall.log
2009-06-23 10:30 - 2009-06-23 13:39 - 0213443 _____ () C:\ProgramData\LUInstall.LiveUpdate

Some content of TEMP:
====================
C:\Users\Weber\AppData\Local\Temp\abs.exe
C:\Users\Weber\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-16 07:52

==================== End Of Log ============================
         
 --- --- ---
--- --- ---

Hallo Schrauber, hoffe bisher alles richtig gemacht zu haben, Bin ja schon 77 und habe fast einen Klecks in die Hose bekommen.
Na mal sehen was noch alles kommt.
Bis dann. Gruß vom Vogel

schrauber · 18.02.2015, 19:07

Hast Du alle 3 Programme laufen lassen?

Vogel35 · 18.02.2015, 19:25

Eigentlich ja, warum die Frage?
Gruß Vogel35

schrauber · 18.02.2015, 19:28

Weil die Logfiles von Malwarebytes und AdwCleaner fehlen

Vogel35 · 18.02.2015, 20:45

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-02-2015
Ran by Weber at 2015-02-16 19:28:39
Running from C:\Users\Weber\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1&1 EasyLogin (HKLM\...\1&1 EasyLogin) (Version:  - )
1und1 Internet Explorer Add-On (Version: 1.0 - 1&1 Internet AG) Hidden
320 Solitaires (HKLM\...\320 Solitaires) (Version:  - )
AAVUpdateManager (HKLM\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Acrobat Connect Add-in (HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Adobe Acrobat Connect Add-in) (Version:  - )
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\Adobe Shockwave Player) (Version: 10.1.4.20 - Adobe Systems, Inc.)
Adobe® Photoshop® Album Starter Edition 3.2 (HKLM\...\Adobe® Photoshop® Album Starter Edition 3.2) (Version: 3.2.0 - hxxp://www.adobe.de)
Amazon Kindle (HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Amazon Kindle) (Version:  - Amazon)
AntiBrowserSpy (HKLM\...\{F78B5B4F-075A-4C81-AA27-E707861EB5B7}_is1) (Version: 154 - Abelssoft)
Ask Shopping Toolbar (HKLM\...\{4F524A00-6A76-A76A-76A7-A758B70C1500}) (Version: 12.21.0.124 - APN, LLC) <==== ATTENTION
Avira (HKLM\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Cliqz (HKLM\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.63 - Cliqz.com)
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Duden Korrektor Patch 012009 (HKLM\...\{8AEBFD30-B94F-4A49-8106-03039708BDD4}) (Version: 6.00.1000 - Bibliographisches Institut & F.A. Brockhaus AG)
Duden Korrektor PLUS (HKLM\...\{62326989-2861-4911-A39E-26373BD3FF66}) (Version: 6.00.00 - Bibliographisches Institut & F.A. Brockhaus AG)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 14.3.11574 - Landesfinanzdirektion Thüringen)
Feedback Tool (HKLM\...\{13A5E785-5197-4EAD-8EE3-D660271E49BC}) (Version: 1.2.0 - Microsoft Corporation)
Firebird SQL Server - MAGIX Edition 2.0.0.1 (D) (HKLM\...\Firebird SQL Server D) (Version: 2.0.0.1 - MAGIX AG)
Firefox 3.6 WEB.DE Edition (Version: 1.6 - WEB.DE) Hidden
Grand Ages Rome 1.11 (HKLM\...\Civitas3) (Version: 1.11 - Kalypso Media)
HijackThis 2.0.2 (HKLM\...\HijackThis) (Version: 2.0.2 - TrendMicro)
InfoBibliothek 2 (HKLM\...\{78D7D7CD-A06B-4514-ACBD-8055BF945A8E}) (Version: 1.08.03.01 - Akademische Arbeitsgemeinschaft Verlag Wolters Kluwer GmbH)
Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.710 - Oracle)
KeyDepot (HKLM\...\KeyDepot_is1) (Version: 3.20 - Abelssoft)
LightScribe  1.4.124.1 (Version: 1.4.124.1 - hxxp://www.lightscribe.com) Hidden
lingDIALOG (HKLM\...\InstallShield_{071B843C-9A39-40B3-BB01-BBD6A8D2E1C5}) (Version: 3.0908 - WEVOSYS)
lingDIALOG (Version: 3.0908 - WEVOSYS) Hidden
MCE Software Encoder 1.1 (HKLM\...\{7655E113-C306-11D9-A373-0050BAE317E1}) (Version: 1.1.0.1108 - CyberLink Corporation)
MediaShow 3.0 (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version:  - )
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 German Language Pack (HKLM\...\{E78BFA60-5393-4C38-82AB-E8019E464EB4}) (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version:  - )
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}) (Version: 08.05.0822 - Microsoft Corporation)
Moorhuhn Remake (HKLM\...\{52210D57-0B1F-4681-90DD-8659DF4BCC40}) (Version: 1.00.0000 - )
Mozilla Firefox 35.0.1 (x86 de) (HKLM\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 32.0.2 - Mozilla)
MSXML 4.0 SP2 (KB925672) (HKLM\...\{A9CF9052-F4A0-475D-A00F-A8388C62DD63}) (Version: 4.20.9839.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 7 Essentials (HKLM\...\{63B75E16-F290-4FCD-AF67-A9134CD01031}) (Version: 7.02.5182 - Nero AG)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
OpenOffice 4.1.0 (HKLM\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)
PhotoNow! 1.0 (HKLM\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version:  - )
Platform (Version: 1.22 - VIA Technologies, Inc.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.2414.0 - CyberLink Corporation)
QuickTime (HKLM\...\{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}) (Version: 7.1.3.100 - Apple Computer, Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7272 - Realtek Semiconductor Corp.)
Robin Hood TsoSF (HKLM\...\Robin Hood TsoSF) (Version:  - )
Samsung Easy Document Creator (HKLM\...\Samsung Easy Document Creator) (Version: 1.04.63 (28.02.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM\...\Samsung Easy Printer Manager) (Version: 1.02.99.00(04.02.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Wireless Setup (HKLM\...\Easy Wireless Setup) (Version: 3.60.07 - Samsung Electronics Co., Ltd.)
Samsung M267x 287x Series (HKLM\...\Samsung M267x 287x Series) (Version: 1.12 (08.03.2013) - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM\...\Samsung Network PC Fax) (Version: 1.09.11 (14.01.2013) - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (HKLM\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
Samsung Printer Live Update (HKLM\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (Version: 1.00.49.00 - Samsung Electronics Co., Ltd.) Hidden
ScanSoft PaperPort 11 (HKLM\...\{7A8FF745-BBC5-482B-88E4-18D3178249A9}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Sceneo Bonavista (HKLM\...\{4C73B683-B15D-4B94-AC7A-520B70C4FFE9}) (Version:  - )
Skat Clubmeister (HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\...\Skat Clubmeister) (Version:  - )
Skat, Schwimmen und Mau Mau (HKLM\...\Skat, Schwimmen und Mau Mau_is1) (Version:  - madcat Software GmbH)
SNS Upload for Easy Document Creator (HKLM\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SteuerBerater für Lehrer 2013-2014 (HKLM\...\{E84E9818-988D-44E1-A996-FC05F83A64DC}) (Version: 1.00.9 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung 2013 (HKLM\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.10 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung Lehrer 2014 (HKLM\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.10.89 - Akademische Arbeitsgemeinschaft)
Steuer-Spar-Erklärung Plus 2010 (HKLM\...\{82436073-5B66-4DD4-A815-437244503120}) (Version: 15.14 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung Plus 2011 (HKLM\...\{257F2279-6843-433E-9060-15BAB966F20D}) (Version: 16.16 - Akademische Arbeitsgemeinschaft Verlag)
Steuer-Spar-Erklärung Plus 2012 (HKLM\...\{3BCDCC6A-3A47-4883-8A0C-55AC061316CB}) (Version: 17.12 - Wolters Kluwer Deutschland GmbH)
Sunny Hillride 1.0 (HKLM\...\{B4B9067D-E80A-4A24-9ED5-B9C451CFE67E}) (Version: 1.0 - Headup Games)
SuperEasy Driver Updater v.1.1.1 (HKLM\...\{039BC111-D60F-A6FF-85F4-7992EA886B8D}_is1) (Version: 1.1.1 - SuperEasy Software GmbH & Co. KG)
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM\...\TuneUp Utilities) (Version: 14.0.1000.340 - TuneUp Software)
TuneUp Utilities 2014 (Version: 14.0.1000.340 - TuneUp Software) Hidden
Ulead PhotoImpact 12 (HKLM\...\{11AFE21E-B193-430D-B57A-DFF7815BB962}) (Version: 12.0 - Ulead System)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VIA Plattform-Geräte-Manager (HKLM\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.22 - VIA Technologies, Inc.)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WEB.DE Toolbar für Mozilla Firefox (HKLM\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 1.5.5.0 - 1&1 Mail & Media GmbH)
Windows Live Toolbar (HKLM\...\Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0) (HKLM\...\3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F) (Version: 10/12/2007 6.85.4.0 - Nokia)
X10 Hardware(TM) (HKLM\...\X10Hardware) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{029209E8-38B5-482B-BCDD-FC9B276FE352}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{0454F501-2BAE-4570-9F6E-440A28049AC2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{0CD20A4B-7CB5-45C1-B957-748A155E753E}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{11344345-5091-4C52-9841-D13086E0EEC2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{1B05BF56-E227-49CE-B2C9-5C1C9F40E460}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{23FB70B3-7A4F-457D-BE2F-AB583E76D8E7}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{25F841D3-408D-45F5-B3EA-4972A18B7737}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{2822DCFC-717E-4F88-9BE6-FA946CCB4017}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{2837E0FE-686B-4CB0-BE53-0EA097EAF71B}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{302276CC-737D-4D15-9A5C-EC2031D673EB}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{327DA9A8-4E9E-4E14-AC1B-C159A6B2865B}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{515A9E01-5D33-4C70-8E43-62DD3FE06B35}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{531DFEAC-826E-4C3D-BF76-425A5AF61A0E}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{5B7524C8-2446-40E9-9474-94A779DBA224}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{5E801020-E0CA-4708-9E07-A256A8FFBD2A}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{60774992-7CCF-437E-B32D-7E5DC00EFFB8}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{61975864-C48D-464E-8AC0-12D8DE16C813}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{621D3650-F1D3-414C-97F9-03A02B211261}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{623E415A-22EF-4DAA-A2FF-E68E77A673C9}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{659CE3EB-9F99-422E-9255-61CAC57B3510}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{6D89B10C-1802-430F-A3D3-FD2C621AFC26}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{714A66CE-B7B3-4029-B345-56B2B4823079}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{71A43C79-BC43-419F-A304-061AA2E74846}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{79D12C76-06D9-431F-9A5A-82B93EA5083C}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{8380194E-073A-40D0-970F-A01988D27B5C}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{885BB46A-3F1E-44C3-A01B-A7D9260CC98B}\InprocServer32 -> C:\Windows\Downloaded Program Files\dwusplay.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{885BB46A-3F1E-44C3-A01B-A7D9260CC98B}\localserver32 -> C:\Windows\Downloaded Program Files\dwusplay.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{915C2CEB-216B-4B7C-89E4-9ED3512D58D9}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{92C5E738-7372-4CD6-BE57-15833624EBF3}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{9CAAD2EA-177B-4D07-871F-47255B5D30F3}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{9F659E80-34A5-40FD-9806-3115FF07CA5A}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{9F8B217D-3EF8-44FC-9079-5581D0943725}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{A08EDBE0-D6C1-4F98-95EE-F9DABE2F57B9}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{AAFFEBCF-CEAE-44D1-87BC-21DD59AB2951}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{B391A1DB-28C8-4506-A43C-5BD6051F16BA}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{B452070B-D0CF-4C30-9E0C-FD86A154746F}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{B956DB4C-E9D5-4BA6-98F2-B569F5E89EA2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{BDFBC8FB-4E9D-4118-8B82-0F3E21B47751}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{C266DD0E-ABF0-4D2D-BC80-442941767642}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{CF03108C-3EC6-4DA8-8A89-9414431EC87E}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{D6583D24-BAD0-4F9D-9C48-7CEE73E2CEFC}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{DA68042E-486F-4BA7-ADDB-891126B8BD31}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{DC62AB5B-4A63-4AF0-A623-2CB24B400BE2}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{E50C953D-311A-481B-8F8D-C55E65AF7417}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{E9880553-B8A7-4960-A668-95C68BED571E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{E9A93328-79D4-4AED-A778-146E7191F8BC}\localserver32 -> No File Path
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EA2DD391-0F60-42F7-9AA8-9576C907E6E3}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EA3398E8-18DB-4369-870F-73414EE55D79}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EDE36E93-52E9-48AE-97AE-EEF558558F1F}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{EF2D9BFD-E3B2-455F-A917-BA5826CEFD50}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F1522EC1-F84F-4CE2-A38C-F9384B0DFD41}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F2699F06-4BD8-46D5-AB11-D5626BA04574}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F3A9BCA1-7EE6-4E6C-B8DF-53D389F58457}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F74EBFCA-61B4-4A74-BE4B-BE91765747C1}\InprocServer32 -> C:\Program Files\Duden\Duden Korrektor\DudenKorrektor.dll (Expert System S.p.A.)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{F7DE72AB-464D-4ACF-94E1-56BBDEF284B6}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{FBF36969-88B5-4F2C-991E-DCB0BF28E5C0}\InprocServer32 -> C:\Windows\system32\MBControls.ocx (Maurizio Benvenuti)
CustomCLSID: HKU\S-1-5-21-3016044035-3929161208-4058345445-1001_Classes\CLSID\{FFF2D28F-E4EE-44D9-8104-8E71556757F6}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (InstallShield Software Corporation)

==================== Restore Points  =========================

30-12-2014 07:54:32 Windows Update
07-01-2015 07:20:21 Windows Update
07-01-2015 07:46:35 Windows Defender Checkpoint
07-01-2015 11:29:16 Wiederherstellungsvorgang
07-01-2015 11:42:29 Windows Update
14-01-2015 07:43:45 Windows Update
15-01-2015 06:54:35 Windows Update
24-01-2015 17:07:47 Windows Update
30-01-2015 09:00:05 Windows Update
03-02-2015 08:37:24 Windows Update
10-02-2015 08:12:49 Windows Update
12-02-2015 05:30:31 Windows Update
14-02-2015 10:09:27 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2013-08-21 12:40 - 00000859 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1 google-analytics.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1875271A-8676-49DF-9894-66D0505B7161} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2753FBBE-BACB-43F1-A631-3BC4879B3BC8} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-18] (Microsoft Corporation)
Task: {2D0DCF85-45A1-469D-9165-91B37640B2DA} - System32\Tasks\Google Updater and Installer => C:\Users\Weber\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {585FA34D-BE66-4461-AF82-DAC206D6923E} - System32\Tasks\{086172D4-FBB3-4729-93AC-6A2273A1B0FA} => pcalua.exe -a "D:\Tools\Sceneo Bonavista\Setup.exe" -d "D:\Tools\Sceneo Bonavista"
Task: {6CA539A4-788F-44D9-9522-8312689396B8} - System32\Tasks\DriverScanner => C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe
Task: {703A128E-0807-4BA6-B8C6-3D3084C0A6E6} - System32\Tasks\Auf Updates für Windows Live Toolbar prüfen => C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19] (Microsoft Corporation)
Task: {7FC6BE06-C75C-4D29-84E1-634AAC28E488} - System32\Tasks\InstallShield Software-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2004-08-09] (InstallShield Software Corporation)
Task: {89F61BE6-D7F0-4CB4-8C89-AEEB02463808} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: {8A2FE36C-D0A1-4C59-AD3A-1D1DD19EEF26} - System32\Tasks\{A90E64BD-7A52-4F33-A61C-A0C1F2F953A1} => pcalua.exe -a "C:\Program Files\Skype\Phone\unins000.exe"
Task: {8A8370F5-62E7-4E6C-96FA-02E621206FC1} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: {8EA2784B-0F2E-4362-82E4-A99F244D2C95} - System32\Tasks\ScanSoft Background Update => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {9065648E-49DC-44B1-AA82-82E6786D8163} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: {9C2B50F8-3287-4A85-B3C1-2E20E3001ED5} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-09-26] (Oracle Corporation)
Task: {AB4EB9C4-C0A1-4CF0-BE0A-ADE26396511A} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files\TuneUp Utilities 2012\OneClick.exe
Task: {ADEFF3A5-7527-4627-B298-81767BBCBA18} - System32\Tasks\{726E303F-48F1-4362-868B-EDAFAF73C7BC} => pcalua.exe -a C:\Users\Weber\Downloads\IE8-Setup-Full-32.exe -d "C:\Program Files\Mozilla Firefox"
Task: {B1CE57E0-2B7D-4ED1-8E1A-1BEE53272612} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\TuneUp Utilities 2014\OneClick.exe [2014-07-16] (TuneUp Software)
Task: {BDBA8386-1E26-496F-A844-24389AB05642} - System32\Tasks\{67EA85AE-106E-42B6-978A-F0089C443D6D} => pcalua.exe -a E:\setup.exe -d E:\ -c -c
Task: {C5B25D39-5D19-4670-95D0-96C03C034CE2} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files\TuneUp Utilities 2010\OneClick.exe
Task: {CE52EA52-1C94-43CF-99FB-F70B7E8AEED7} - System32\Tasks\McDefragTask => c:\program files\mcafee\mqc\QcConsol.exe
Task: {E60B7E04-BBEB-4118-A1A4-9824383AFEBD} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {E8F024A1-1D86-4970-9B91-D795C251953F} - System32\Tasks\{6780C582-76B7-4530-ADA1-39100633D8C8} => pcalua.exe -a E:\MInst.exe -d E:\
Task: {F861413A-3272-4934-B14F-2E1E3F8F5B3D} - System32\Tasks\McQcTask => c:\program files\mcafee\mqc\QcConsol.exe
Task: {FBEF25C0-67EE-4BB8-808E-C0550D52A53E} - System32\Tasks\{D57D6638-1901-41F8-BB20-DB2A5DABD0DF} => pcalua.exe -a C:\Users\Weber\Downloads\IE8-Setup-Full-32.exe -d "C:\Program Files\Mozilla Firefox"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job => C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files\TuneUp Utilities 2014\OneClick.exe

==================== Loaded Modules (whitelisted) ==============

2013-06-26 11:42 - 2013-06-26 11:42 - 00024064 _____ () C:\Windows\System32\ssa6mlm.dll
2013-06-26 11:42 - 2013-06-26 11:42 - 01021952 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\ssa6mdu.dll
2007-02-13 10:23 - 2006-12-19 22:23 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2013-03-03 10:12 - 2013-03-03 10:12 - 01053848 _____ () C:\Windows\System32\ieconfig_1und1_svc.exe
2007-02-12 10:30 - 2006-06-26 13:34 - 00098304 _____ () C:\Program Files\Sceneo\Bonavista\Services\PVR\tvtvRemote.dll
2009-09-24 13:48 - 2009-04-11 07:28 - 00368640 _____ () C:\Windows\system32\msjetoledb40.dll
2007-02-12 10:30 - 2004-04-23 15:01 - 00299008 _____ () C:\Windows\system32\midas.dll
2014-07-16 09:24 - 2014-07-16 09:24 - 00585528 _____ () C:\Program Files\TuneUp Utilities 2014\avgreplibx.dll
2012-03-09 09:58 - 2012-03-09 09:58 - 00350072 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2012-03-09 09:58 - 2012-03-09 09:58 - 00056696 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2015-01-27 09:21 - 2015-01-27 09:21 - 03925104 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3016044035-3929161208-4058345445-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\Wallpaper\img24.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^OnlineControl.lnk => C:\Windows\pss\OnlineControl.lnk.CommonStartup
MSCONFIG\startupreg: WEB.DE Update => C:\Program Files\WEB.DE\LiveUpdate\m2LUTray.exe

==================== Accounts: =============================

Administrator (S-1-5-21-3016044035-3929161208-4058345445-500 - Administrator - Disabled)
ASPNET (S-1-5-21-3016044035-3929161208-4058345445-1003 - Limited - Enabled)
Gast (S-1-5-21-3016044035-3929161208-4058345445-501 - Limited - Disabled)
Weber (S-1-5-21-3016044035-3929161208-4058345445-1001 - Administrator - Enabled) => C:\Users\Weber

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} [0x80110802] ist ein Fehler aufgetreten.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Ausführungskontext: Coordinator

Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80110802]


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Ausführungskontext: Coordinator

Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} [0x80110802] ist ein Fehler aufgetreten.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
   Überprüfen, ob das Volume vom Anbieter unterstützt wird
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Snapshotkontext: 16
   Ausführungskontext: Coordinator
   Anbieter-ID: {00000000-0000-0000-0000-000000000000}
   Volumename: C:\
   Ausführungskontext: Coordinator

Error: (02/16/2015 02:05:19 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80110802]


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
   Überprüfen, ob das Volume vom Anbieter unterstützt wird
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Snapshotkontext: 16
   Ausführungskontext: Coordinator
   Anbieter-ID: {00000000-0000-0000-0000-000000000000}
   Volumename: C:\
   Ausführungskontext: Coordinator

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\subscription.cpp6580070057

Error: (02/16/2015 02:03:06 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} [0x80110802] ist ein Fehler aufgetreten.


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Ausführungskontext: Coordinator

Error: (02/16/2015 02:03:06 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {790f2886-9889-4c99-8ef5-531add05d044} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80110802]


Vorgang:
   Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
   Volume einem Schattenkopiesatz hinzufügen

Kontext:
   Anbieter-ID: {262b716e-bb23-41b5-aaef-e2c15e767167}
   Klassen-ID: {790f2886-9889-4c99-8ef5-531add05d044}
   Snapshotkontext: 16
   Ausführungskontext: Coordinator


System errors:
=============
Error: (02/16/2015 09:36:14 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {74944725-B65F-4E37-8633-BD4DDE193921}

Error: (02/16/2015 07:42:09 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/15/2015 03:51:40 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/15/2015 10:09:31 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {74944725-B65F-4E37-8633-BD4DDE193921}

Error: (02/15/2015 08:01:36 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/14/2015 10:06:35 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/13/2015 06:19:24 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/13/2015 03:39:10 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/13/2015 07:09:51 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (02/12/2015 06:26:23 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt


Microsoft Office Sessions:
=========================
Error: (12/11/2014 08:02:24 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1704 seconds with 660 seconds of active time.  This session ended with a crash.

Error: (05/29/2014 06:50:34 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 4499 seconds with 600 seconds of active time.  This session ended with a crash.

Error: (05/18/2014 08:25:07 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 10 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (10/01/2009 06:40:17 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6504.5001, Microsoft Office Version: 12.0.6215.1000. This session lasted 754 seconds with 720 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2015-01-07 10:44:47.432
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 10:44:46.980
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 10:44:46.524
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 10:44:45.896
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 10:30:46.804
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 10:02:12.240
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 08:44:39.465
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 08:44:38.991
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 08:44:38.521
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-07 08:44:37.897
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
Percentage of memory in use: 59%
Total physical RAM: 2045.76 MB
Available physical RAM: 835.09 MB
Total Pagefile: 4342.78 MB
Available Pagefile: 2651.73 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.55 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:271.72 GB) (Free:182.23 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:26.34 GB) (Free:17.55 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: B4215544)
Partition 1: (Active) - (Size=271.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=26.4 GB) - (Type=OF Extended)

==================== End Of Log ============================

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Weber on 18.02.2015 at 12:08:32,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{F2AFA479-49FA-448B-A74D-2D364E7F7E37}



~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\DriverScanner



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Weber\AppData\Roaming\mozilla\firefox\profiles\h5gq9l5o.default\prefs.js

user_pref("avira.safe_search.search_was_active", "false");



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.02.2015 at 12:12:16,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Weber on 18.02.2015 at 12:08:32,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{F2AFA479-49FA-448B-A74D-2D364E7F7E37}

~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\DriverScanner

~~~ Folders

~~~ FireFox

Successfully deleted the following from C:\Users\Weber\AppData\Roaming\mozilla\firefox\profiles\h5gq9l5o.default\prefs.js

user_pref("avira.safe_search.search_was_active", "false");

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.02.2015 at 12:12:16,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[CODE]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Weber on 18.02.2015 at 12:08:32,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{F2AFA479-49FA-448B-A74D-2D364E7F7E37}

~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\DriverScanner

~~~ Folders

~~~ FireFox

Successfully deleted the following from C:\Users\Weber\AppData\Roaming\mozilla\firefox\profiles\h5gq9l5o.default\prefs.js

user_pref("avira.safe_search.search_was_active", "false");

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.02.2015 at 12:12:16,42

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Weber on 18.02.2015 at 12:08:32,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{F2AFA479-49FA-448B-A74D-2D364E7F7E37}



~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\DriverScanner



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Weber\AppData\Roaming\mozilla\firefox\profiles\h5gq9l5o.default\prefs.js

user_pref("avira.safe_search.search_was_active", "false");



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.02.2015 at 12:12:16,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[CODE]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Weber on 18.02.2015 at 12:08:32,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{F2AFA479-49FA-448B-A74D-2D364E7F7E37}

~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\DriverScanner

~~~ Folders

~~~ FireFox

Successfully deleted the following from C:\Users\Weber\AppData\Roaming\mozilla\firefox\profiles\h5gq9l5o.default\prefs.js

user_pref("avira.safe_search.search_was_active", "false");

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.02.2015 at 12:12:16,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hoffe es hat diesmal geklappt.
Gruß und gute Nacht Vogel35

schrauber · 19.02.2015, 09:57

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Vogel35 · 19.02.2015, 23:15

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=73976888a04e92479b370aadf280b63b
# engine=22554
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-19 09:41:55
# local_time=2015-02-19 10:41:55 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 13836 7564715 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 35216 261914843 0 0
# scanned=114451
# found=5
# cleaned=0
# scan_time=10709
sh=44A1ABE5AEE4B8301F067A28CCC78066A023DD66 ft=1 fh=4b30e3bf56b40dd9 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir"
sh=F3EC064BC091A7FA084D8DD0D983E81C7204346E ft=1 fh=3bf13cef836ab46b vn="Variante von Win32/Systweak.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SuperEasy Software\Driver Updater\supereasydu.exe.vir"
sh=5D89A3BCE9E69D58A901B5901DB47EFB1AF31B96 ft=1 fh=69d8ab7ca56cdf4e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Weber\Desktop\Downloads\AntiBrowserSpy 2015 - CHIP-Installer.exe"
sh=0564385BF0BBCA20F59F7D90D50412551D35B834 ft=1 fh=bbbdd0e8431df4e8 vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Weber\Desktop\Downloads\speedupmypc.exe"
sh=566095531FD328C3054D52C571431D0305103E40 ft=1 fh=0e5c76553bbccf7f vn="Variante von Win32/Systweak.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Weber\Desktop\Downloads\supereasy_driver_updater_1.1.1_7870.exe"

SecurityCheck folgt morgen.
Bis dann. Gruß Vogel

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=73976888a04e92479b370aadf280b63b
# engine=22554
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-19 09:41:55
# local_time=2015-02-19 10:41:55 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 13836 7564715 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 35216 261914843 0 0
# scanned=114451
# found=5
# cleaned=0
# scan_time=10709
sh=44A1ABE5AEE4B8301F067A28CCC78066A023DD66 ft=1 fh=4b30e3bf56b40dd9 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir"
sh=F3EC064BC091A7FA084D8DD0D983E81C7204346E ft=1 fh=3bf13cef836ab46b vn="Variante von Win32/Systweak.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SuperEasy Software\Driver Updater\supereasydu.exe.vir"
sh=5D89A3BCE9E69D58A901B5901DB47EFB1AF31B96 ft=1 fh=69d8ab7ca56cdf4e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Weber\Desktop\Downloads\AntiBrowserSpy 2015 - CHIP-Installer.exe"
sh=0564385BF0BBCA20F59F7D90D50412551D35B834 ft=1 fh=bbbdd0e8431df4e8 vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Weber\Desktop\Downloads\speedupmypc.exe"
sh=566095531FD328C3054D52C571431D0305103E40 ft=1 fh=0e5c76553bbccf7f vn="Variante von Win32/Systweak.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Weber\Desktop\Downloads\supereasy_driver_updater_1.1.1_7870.exe"

Ging schneller als ich dachte.
Probleme: ? erstmal nur müde.
Vielen Dank und Gute Nacht! Vogel35

schrauber · 20.02.2015, 14:06

Ich warte dann noch auf den Rest

Vogel35 · 20.02.2015, 19:23

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.96  
 Windows Vista Service Pack 2 x86 (UAC is enabled)  
 Internet Explorer 9  
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Out of date HijackThis  installed!
 HijackThis 2.0.2    
 TuneUp Utilities 2014   
 TuneUp Utilities 2014 (de-DE)  
 TuneUp Utilities 2014   
 Java 7 Update 71  
 Java version 32-bit out of Date! 
  Java 64-bit 8 Update 31  
 Adobe Reader 9 Adobe Reader out of Date! 
 Adobe Reader 10.1.13 Adobe Reader out of Date!  
 Mozilla Firefox (35.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

18.02.2015, 19:07	#8
schrauber /// the machine /// TB-Ausbilder	Avira findet APPL/Download.Gen+JOKE/BAD joke.DT Hast Du alle 3 Programme laufen lassen? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

18.02.2015, 19:28	#10
schrauber /// the machine /// TB-Ausbilder	Avira findet APPL/Download.Gen+JOKE/BAD joke.DT Weil die Logfiles von Malwarebytes und AdwCleaner fehlen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

20.02.2015, 14:06	#14
schrauber /// the machine /// TB-Ausbilder	Avira findet APPL/Download.Gen+JOKE/BAD joke.DT Ich warte dann noch auf den Rest __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Avira findet APPL/Download.Gen+JOKE/BAD joke.DT

Plagegeister aller Art und deren Bekämpfung: Avira findet APPL/Download.Gen+JOKE/BAD joke.DT