Positive Finds Add + Schrift verzerrt

RedHot1982 · 17.02.2015, 01:28

Hallo!

Ich habe letzte Woche irgendwie Positive Finds auf meinem Notebook installiert. Es gingen ständig Werbungen auf. Weiters ist mir aufgefallen, dass die Schrift im Google, Mails, teilweise Homepages verzerrt sind.

Die Positive Finds Add habe ich in Firefox und IE gelöscht (über Adds-Funktionen deaktiviert bzw. gelöscht). Leider dürfte ich noch immer ein Problem haben, da die Schriften in Mails nicht mehr so klar lesbar sind (Schriften wirken verzerrt - es erscheint, wie wenn es ein bisschen ausgefranzt ist).

Habe auch schon AdwCleaner installiert. Beim Löschen bleibt jedoch der Balken gleich nach dem Start stehen (bei ca. 10%) und es passiert nichts mehr.

Weiters kam nach Löschen des Positive Finds Add und nach Durchführung von Screenings mit Malwarebytes, dass nun ein unbekanntes Objekt vorhanden ist (PNP-Gerätesteuerung: ROOT\LEGACY_TUNEUPUTILITIESDRV\0000).

Danke für eure Hilfe!!!!

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:44 on 16/02/2015 (Markus)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-02-2015
Ran by Markus (administrator) on MARKUS-PC on 17-02-2015 00:06:18
Running from C:\Users\Markus\Desktop
Loaded Profiles: Markus (Available profiles: Markus & Beruf)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(OptionNV) C:\Program Files\telering\tele.ring Mobile Internet\GtDetectSc.exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(AVG Technologies) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(AVG Technologies) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(S3 Graphics Co., Ltd.) C:\Windows\System32\s3trayp.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
() C:\Windows\System32\ESB.EXE
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Chicony Electronics Co., Ltd.) C:\Windows\System32\DVAPTray.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe
(Geek Software GmbH) C:\Program Files\pdf24\pdf24.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(ArcSoft) C:\Program Files\ArcSoft\MediaConverter 3\Monitor.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realonemessagecenter.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 10.0\Reader\reader_sl.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcfgex.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4018176 2006-11-20] (Realtek Semiconductor)
HKLM\...\Run: [S3Trayp] => S3trayp.exe -chkautorun
HKLM\...\Run: [ESB] => C:\Windows\system32\ESB.EXE [266240 2006-05-29] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [869936 2007-05-24] (Synaptics, Inc.)
HKLM\...\Run: [LanguageShortcut] => C:\Program Files\HomeCinema\PowerDVD\Language\Language.exe [52256 2007-01-08] ()
HKLM\...\Run: [PaperPort PTD] => C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2007-10-11] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2007-10-11] (Nuance Communications, Inc.)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [DVAPTray] => C:\Windows\System32\DVAPTray.exe [188416 2009-10-30] (Chicony Electronics Co., Ltd.)
HKLM\...\Run: [PAC7302_Monitor] => C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [PDFPrint] => C:\Program Files\pdf24\pdf24.exe [191016 2014-05-14] (Geek Software GmbH)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG)
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {12d6d0f5-521e-11df-933d-0040d0e86c2a} - G:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {1c89ada2-4977-11df-a25c-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {5d86b4c8-e6df-11dd-854a-0015afd3cc7a} - F:\LaunchU3.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {6f152377-3e1f-11df-9976-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {717e6b46-e95f-11de-bf93-0015afd3cc7a} - F:\setup.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {750db5e0-4e36-11df-b467-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {90bbca4d-48f3-11e0-b8e4-0040d0e86c2a} - explorer.exe hxxp://www.drei.at/inside3
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {9b282eb9-49fb-11df-8789-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {9b282ec7-49fb-11df-8789-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a47e2a75-3da7-11df-b946-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a47e2a82-3da7-11df-b946-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a71f3ffc-4974-11df-a7ab-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {b4c891f2-1010-11df-abcb-0015afd3cc7a} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {d0c934e2-100a-11df-ad9e-0015afd3cc7a} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {dace676e-5937-11df-b566-0040d0e86c2a} - F:\AutoRun.exe
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [146432 2008-07-24] (Google)
AppInit_DLLs:  C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [146432 2008-07-24] (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Device Monitor.lnk
ShortcutTarget: Device Monitor.lnk -> C:\Program Files\ArcSoft\MediaConverter 3\Monitor.exe (ArcSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
SearchScopes: HKLM -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = 
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\.DEFAULT -> {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}
SearchScopes: HKU\S-1-5-21-349582430-969671104-3874210206-1000 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = 
BHO: Skype add-on (mastermind) -> {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-349582430-969671104-3874210206-1000 -> No Name - {A057A204-BACC-4D26-9990-79A187E2698E} -  No File
Toolbar: HKU\S-1-5-21-349582430-969671104-3874210206-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX OVS Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=14 -> C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF Plugin: @real.com/nppl3260;version=16.0.0.282 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-349582430-969671104-3874210206-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Markus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdbplug.dll (DNAML Pty Ltd)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF Extension: DownloadHelper - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-02-15]
FF Extension: ProxTube - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\ich@maltegoetz.de.xpi [2015-02-15]
FF Extension: Adblock Plus - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-15]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-09]
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011-01-16]
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011-01-16]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2012-12-18]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2010-12-08]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]
CHR HKLM\...\Chrome\Extension: [jmfkcklnlgedgbglfkkgedjfmejoahla] - C:\Program Files\AVG\AVG2012\Chrome\safesearch.crx [Not Found]
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2010-12-08]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.)
S3 FirebirdServerMAGIXInstance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed]
S3 GoogleDesktopManager; C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe [69120 2008-07-24] (Google) [File not signed]
R2 GtDetectSc; C:\Program Files\telering\tele.ring Mobile Internet\GtDetectSc.exe [196704 2007-12-18] (OptionNV) [File not signed]
S2 gupdate1ca10806b390478; C:\Program Files\Google\Update\GoogleUpdate.exe [107912 2014-10-26] (Google Inc.)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [620544 2008-11-11] (Nokia.) [File not signed]
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [2161976 2015-02-12] (AVG Technologies)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208152 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [154904 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [200984 2014-10-10] (AVG Technologies CZ, s.r.o.)
S3 BrSerIf; C:\Windows\System32\Drivers\BrSerIf.sys [52224 2006-12-12] (Brother Industries Ltd.) [File not signed]
S3 camfilt2; C:\Windows\System32\DRIVERS\camfilt2.sys [94720 2007-08-06] (Guillemot Corporation)
R3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc.              )
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36640 2009-10-09] () [File not signed]
S3 GT72NDISIPXP; C:\Windows\System32\DRIVERS\Gt51Ip.sys [106624 2008-02-18] (Option N.V.)
S3 GT72UBUS; C:\Windows\System32\DRIVERS\gt72ubus.sys [59648 2008-02-08] (Option N.V.)
S3 GTPTSER; C:\Windows\System32\DRIVERS\gtptser.sys [8064 2007-03-30] (Option N.V.)
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [103040 2009-06-15] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [458752 2007-11-08] (PixArt Imaging Inc.)
R3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [252416 2007-06-01] (Realtek Semiconductor Corporation                           )
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [90536 2008-05-27] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-05-27] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [122152 2008-05-27] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [115496 2008-05-27] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [25768 2008-05-27] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [111912 2008-05-27] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [117672 2008-05-27] (MCCI Corporation)
R3 S3GIGP; C:\Windows\System32\DRIVERS\VTGKModeDX32.sys [791040 2007-07-20] (S3 Graphics Co., Ltd.)
S3 SNPSTD3; C:\Windows\System32\DRIVERS\snpstd3.sys [10371072 2007-07-17] (Sonix Co. Ltd.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-07-21] (Duplex Secure Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2015-01-13] (TuneUp Software)
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 tcpipBM; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-17 00:06 - 2015-02-17 00:07 - 00024303 _____ () C:\Users\Markus\Desktop\FRST.txt
2015-02-17 00:05 - 2015-02-17 00:06 - 00000000 ____D () C:\FRST
2015-02-16 23:44 - 2015-02-16 23:44 - 00000634 _____ () C:\Users\Markus\Desktop\defogger_disable.log
2015-02-16 23:44 - 2015-02-16 23:44 - 00000020 _____ () C:\Users\Markus\defogger_reenable
2015-02-16 23:43 - 2015-02-16 23:43 - 00380416 _____ () C:\Users\Markus\Desktop\Gmer-19357.exe
2015-02-16 23:42 - 2015-02-16 23:42 - 01125888 _____ (Farbar) C:\Users\Markus\Desktop\FRST.exe
2015-02-16 23:41 - 2015-02-16 23:41 - 00050477 _____ () C:\Users\Markus\Desktop\Defogger.exe
2015-02-15 21:37 - 2015-02-15 21:37 - 00000000 ____D () C:\Users\Beruf\AppData\Roaming\AVG2015
2015-02-15 21:37 - 2015-02-15 21:37 - 00000000 ____D () C:\Users\Beruf\AppData\Local\Avg2015
2015-02-15 21:35 - 2015-02-15 21:35 - 00000000 ____D () C:\Users\Beruf\AppData\Local\Avg
2015-02-15 13:45 - 2015-02-15 13:45 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-15 13:45 - 2015-02-15 13:45 - 00000000 _____ () C:\Windows\setupact.log
2015-02-15 13:39 - 2015-02-15 13:39 - 00001857 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00001849 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00001845 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2015.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015
2015-02-15 13:38 - 2015-02-15 13:38 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\AVG
2015-02-15 13:32 - 2015-02-15 13:33 - 00000000 ____D () C:\Users\Markus\Desktop\Strategiebesprechung
2015-02-15 13:29 - 2015-02-15 13:29 - 00000000 ____D () C:\Users\Markus\AppData\Local\Avg
2015-02-15 13:26 - 2015-02-15 13:48 - 00000000 ____D () C:\ProgramData\AVG
2015-02-15 13:16 - 2015-02-15 13:16 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\AVG2015
2015-02-15 13:15 - 2015-02-15 13:15 - 00000822 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-02-15 13:15 - 2015-02-15 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-02-15 13:12 - 2015-02-15 13:15 - 00000000 ____D () C:\ProgramData\AVG2015
2015-02-15 13:10 - 2015-02-15 13:32 - 00000000 ____D () C:\Program Files\AVG
2015-02-15 13:09 - 2015-02-15 13:46 - 00000000 ____D () C:\Users\Markus\AppData\Local\Avg2015
2015-02-15 13:03 - 2015-02-15 13:03 - 00000000 ____D () C:\OETemp
2015-02-15 11:35 - 2015-02-15 21:28 - 00007556 _____ () C:\Windows\PFRO.log
2015-02-15 02:27 - 2015-02-15 02:27 - 00000000 ____D () C:\Programᡄ
2015-02-15 02:20 - 2011-06-21 11:24 - 00032768 _____ () C:\Windows\system32\Drivers\sp_rsdrv2.sys
2015-02-15 02:18 - 2015-02-12 17:39 - 00037176 _____ (AVG Technologies) C:\Windows\system32\TURegOpt.exe
2015-02-15 02:18 - 2015-02-12 17:39 - 00025912 _____ (AVG Technologies) C:\Windows\system32\authuitu.dll
2015-02-15 02:16 - 2015-02-15 02:16 - 02112512 _____ () C:\Users\Markus\Desktop\adwcleaner_4.110.exe
2015-02-15 00:34 - 2015-02-16 23:16 - 00000000 ____D () C:\AdwCleaner
2015-02-14 21:37 - 2015-02-16 23:54 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-14 21:36 - 2015-02-14 21:36 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-02-14 21:36 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-14 21:36 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-14 21:36 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-14 21:35 - 2015-02-14 21:35 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Chip Digital GmbH
2015-02-12 23:03 - 2015-02-12 22:57 - 00146432 _____ (Oracle Corporation) C:\Windows\system32\javacpl.cpl
2015-02-12 23:00 - 2015-02-12 22:57 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2015-02-12 23:00 - 2015-02-12 22:57 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2015-02-12 22:00 - 2015-01-09 01:20 - 02063360 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-12 22:00 - 2014-11-26 03:05 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-12 21:59 - 2015-01-13 02:39 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-12 21:55 - 2015-01-15 05:13 - 00440760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-12 21:50 - 2014-12-08 02:59 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-12 21:48 - 2015-02-03 12:55 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-02-12 21:48 - 2015-02-03 12:53 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 06004736 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 11084288 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 02006016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-12 21:48 - 2015-02-03 12:51 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-12 21:48 - 2015-02-03 12:49 - 00348160 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-12 21:48 - 2015-02-03 12:49 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-12 21:48 - 2015-02-03 11:13 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-12 21:48 - 2015-02-03 09:29 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-12 21:47 - 2015-02-03 12:52 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-02-12 21:47 - 2015-02-03 12:51 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-12 21:47 - 2015-02-03 12:49 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2015-02-12 21:47 - 2015-02-03 09:29 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-12 21:47 - 2015-02-03 09:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-02-12 21:47 - 2015-02-03 09:26 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-09 21:27 - 2015-02-15 13:15 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\TuneUp Software
2015-02-09 21:27 - 2015-02-09 21:27 - 00000000 ____D () C:\Users\Markus\AppData\Local\TuneUp Software
2015-02-09 21:21 - 2015-02-09 21:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\FreeVideoFlipAndRotate
2015-02-09 21:20 - 2015-02-09 21:37 - 00000000 ____D () C:\ProgramData\TuneUp Software
2015-02-09 21:20 - 2015-02-09 21:20 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\RHEng
2015-01-29 22:04 - 2015-02-14 22:31 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-01-22 23:35 - 2015-01-22 23:40 - 00014336 _____ () C:\Users\Markus\Desktop\Wok Grill.xls
2015-01-21 21:58 - 2015-01-21 21:58 - 140980086 _____ () C:\Users\Markus\Desktop\Video first production Pizzaschiffchen salami.mov

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 23:58 - 2009-09-06 21:47 - 01225263 _____ () C:\Windows\WindowsUpdate.log
2015-02-16 23:57 - 2008-10-18 11:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2015-02-16 23:54 - 2009-07-29 20:13 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-16 23:53 - 2009-04-04 20:40 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-02-16 23:49 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-16 23:49 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-16 23:49 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-16 23:45 - 2006-11-02 14:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-16 23:44 - 2008-10-18 11:21 - 00000000 ____D () C:\Users\Markus
2015-02-16 23:33 - 2012-07-25 19:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-16 23:11 - 2009-07-29 20:13 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-16 21:54 - 2012-06-07 12:03 - 00000000 ____D () C:\ProgramData\MFAData
2015-02-16 21:53 - 2012-06-21 21:13 - 00000398 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{69D37424-7323-4CD9-9909-D30D85007A62}.job
2015-02-15 21:37 - 2010-09-16 18:46 - 00000000 ____D () C:\Users\Beruf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2015-02-15 14:50 - 2008-10-27 20:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Skype
2015-02-15 14:49 - 2008-06-25 14:09 - 00000000 ____D () C:\Windows\Panther
2015-02-15 14:47 - 2013-11-10 17:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-15 13:42 - 2009-07-29 20:10 - 00001052 _____ () C:\Windows\Tasks\Google Software Updater.job
2015-02-15 12:02 - 2008-10-18 13:23 - 00000000 ____D () C:\Users\Markus\Documents\PRIVAT
2015-02-15 02:05 - 2008-06-26 05:39 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-02-15 01:48 - 2012-04-20 19:26 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\DVDVideoSoft
2015-02-15 00:56 - 2014-12-07 18:15 - 00000000 ____D () C:\Users\Markus\AppData\Local\RGMService
2015-02-14 23:50 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2015-02-14 23:13 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-02-12 23:06 - 2013-11-10 17:37 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-12 22:57 - 2014-11-13 19:25 - 00272296 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2015-02-12 22:45 - 2006-11-02 13:47 - 03707464 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 22:11 - 2013-08-18 19:37 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 22:01 - 2006-11-02 11:24 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-02-11 23:02 - 2008-11-19 10:30 - 00000000 ____D () C:\Users\Markus\AppData\Local\PokerStars
2015-02-11 22:37 - 2009-12-16 11:07 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\vlc
2015-02-09 21:43 - 2008-10-29 10:14 - 00069632 _____ () C:\Users\Markus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-09 21:18 - 2008-01-21 08:16 - 00006650 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-04 21:33 - 2012-07-25 19:07 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-02-04 21:33 - 2011-06-20 19:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-02-02 20:18 - 2012-11-07 22:49 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

==================== Files in the root of some directories =======

2009-07-21 21:23 - 2009-07-21 21:23 - 4182178 _____ (The Public) C:\Users\Markus\AppData\Roaming\Avisynth.exe
2009-07-21 21:23 - 2009-07-21 21:23 - 5243208 _____ (                                                            ) C:\Users\Markus\AppData\Roaming\AvsP.exe
2009-07-28 20:46 - 2011-01-16 19:49 - 0000166 _____ () C:\Users\Markus\AppData\Roaming\Default.PLS
2009-07-21 21:23 - 2009-07-21 21:25 - 4284535 _____ (ffdshow                                                     ) C:\Users\Markus\AppData\Roaming\ffdshow.exe
2010-09-28 22:36 - 2010-09-28 22:44 - 0176128 _____ () C:\Users\Markus\AppData\Roaming\fontdb.mdb
2009-07-21 21:23 - 2009-07-21 21:45 - 2040451 _____ (LIGHTNING UK!) C:\Users\Markus\AppData\Roaming\Imgburn.exe
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Piano Med
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Pianos and Keyboards
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Pick Bass
2009-07-21 21:23 - 2009-07-21 21:23 - 0642685 _____ (Xvid team                                                   ) C:\Users\Markus\AppData\Roaming\xvid.exe
2012-04-21 09:07 - 2012-06-20 23:07 - 0000680 _____ () C:\Users\Markus\AppData\Local\d3d9caps.dat
2008-10-29 10:14 - 2015-02-09 21:43 - 0069632 _____ () C:\Users\Markus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-12-15 11:12 - 2013-06-10 22:07 - 0823012 _____ () C:\Users\Markus\AppData\Local\Optimizer.txt
2012-10-11 21:09 - 2012-10-11 21:09 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2012-10-11 21:09 - 2013-03-24 18:27 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2012-10-11 21:09 - 2012-10-11 21:18 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Planets
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Plants
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Plug-In Settings
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Profiles
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Quartz Composer
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Receipts

Some content of TEMP:
====================
C:\Users\Beruf\AppData\Local\Temp\avgnt.exe
C:\Users\Beruf\AppData\Local\Temp\~convert1837889909121605377.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4109784010493011813.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4209830696876608383.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4485552456435490824.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4816294060936977035.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5129652577971428585.exe
C:\Users\Beruf\AppData\Local\Temp\~convert530476614210965046.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5388659676246649071.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5767244083265548046.exe
C:\Users\Beruf\AppData\Local\Temp\~convert6259682022611103149.exe
C:\Users\Beruf\AppData\Local\Temp\~convert7283267209106047323.exe
C:\Users\Beruf\AppData\Local\Temp\~convert8207960948104172192.exe
C:\Users\Beruf\AppData\Local\Temp\~convert8651104764550743687.exe
C:\Users\Markus\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Markus\AppData\Local\Temp\nofkkbaq.dll
C:\Users\Markus\AppData\Local\Temp\Quarantine.exe
C:\Users\Markus\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Markus\AppData\Local\Temp\sqlite3.dll
C:\Users\Markus\AppData\Local\Temp\TUUUninstallHelper.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-16 23:58

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-02-2015
Ran by Markus at 2015-02-17 00:08:22
Running from C:\Users\Markus\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AC3Filter (remove only) (HKLM\...\AC3Filter) (Version:  - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)
Adobe Community Help (HKLM\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.4.980 - Adobe Systems Incorporated.)
Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.0.6 - Adobe Systems Incorporated)
Adobe Dreamweaver CS5 (HKLM\...\{C79312BD-3E76-4474-A10C-1435D1856A4B}) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Professional CS5.5 (HKLM\...\{23E445D5-FD83-4C50-A211-EB26A2975317}) (Version: 11.5 - Adobe Systems Incorporated)
Adobe InDesign CS5 (HKLM\...\{F9766AC1-1461-1033-B862-DF8FE1C033BE}) (Version: 7.0 - Adobe Systems Incorporated)
Adobe Media Player (HKLM\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Photoshop 7.0 (HKLM\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{553255F3-78FD-40F1-A6F8-6882140265FE}) (Version: 1.2.1 - Apple Inc.)
ArcSoft MediaConverter 3 (HKLM\...\{EE27AA87-8593-4B8A-A595-29E289C5520F}) (Version: 3.1.8.81 - ArcSoft)
Avanquest update (HKLM\...\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}) (Version: 1.19 - Avanquest Software)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5645 - AVG Technologies)
AVG 2015 (Version: 15.0.4284 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5645 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (de-DE) (Version: 15.0.1001.393 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (HKLM\...\AVG PC TuneUp) (Version: 15.0.1001.393 - AVG Technologies)
AVG PC TuneUp 2015 (Version: 15.0.1001.393 - AVG Technologies) Hidden
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version:  - )
Canon MG2100 series Benutzerregistrierung (HKLM\...\Canon MG2100 series Benutzerregistrierung) (Version:  - )
Canon MG2100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2100_series) (Version:  - )
Canon MG2100 series On-screen Manual (HKLM\...\Canon MG2100 series On-screen Manual) (Version:  - )
Canon MP Navigator EX 5.0 (HKLM\...\MP Navigator EX 5.0) (Version:  - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM\...\CanonSolutionMenuEX) (Version:  - )
CCleaner (remove only) (HKLM\...\CCleaner) (Version:  - Piriform)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6021.5000 - Microsoft Corporation)
ConvertHelper 2.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version:  - DownloadHelper)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.1109a - CyberLink Corp.)
DataLogger (HKLM\...\ST6UNST #3) (Version:  - )
DHTML Menu Studio (HKLM\...\DHTML Menu Studio Standard Demo_is1) (Version: 5.0.0.150 - Xtreeme GmbH)
DL2005 (C:\Program Files\DL2005\) (HKLM\...\ST6UNST #2) (Version:  - )
DL2005 (HKLM\...\ST6UNST #1) (Version:  - )
DVAPTray (HKLM\...\{30D1B542-44E0-44F0-8A31-2A101CB626B5}) (Version: 1.0.0.7 - )
Easy Start Button (HKLM\...\ESB) (Version:  - )
ffdshow [rev 3026] [2009-07-05] (HKLM\...\ffdshow_is1) (Version: 1.0 - )
Firebird SQL Server - MAGIX Edition (HKLM\...\Firebird SQL Server D) (Version: 2.0.1.13 - MAGIX AG)
Google Desktop (HKLM\...\Google Desktop) (Version: - - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Google Updater (HKLM\...\Google Updater) (Version: 2.4.2432.1652 - Google Inc.)
Hercules Classic Silver Webcam (HKLM\...\{FD4FE0F7-91FC-43A2-9C3A-187553991FFF}) (Version: 2.8.0.0 - Hercules)
HOFER Bestellsoftware 4.13.0 (HKLM\...\HOFER Bestellsoftware) (Version: 4.13.0 - ORWO Net)
Hofer Foto Manager Free (HKLM\...\Hofer Foto Manager Free D) (Version: 3.4.0.466 - MAGIX AG)
Hofer Foto Service (HKLM\...\Hofer Foto Service D) (Version: 1.12.0.95 - MAGIX AG)
Hofer Fotobuch und Kalender Druck Service  (HKLM\...\Pixelspeed_LayouterH) (Version:  - )
Hofer Online Druck Service 3.0.6.0 (D) (HKLM\...\Hofer Online Druck Service D) (Version: 3.0.6.0 - MAGIX AG)
IrfanView (remove only) (HKLM\...\IrfanView) (Version:  - )
Japanese Fonts Support For Adobe Reader 8 (HKLM\...\{AC76BA86-7AD7-5760-0000-800000000003}) (Version: 8.0 - Adobe Systems)
Macromedia Extension Manager (HKLM\...\{A5BA14E0-7384-11D4-BAE7-00409631A2C8}) (Version: 1.5 - Macromedia)
Macromedia Fireworks MX 2004 (HKLM\...\{E583ED6F-BD99-4066-A420-C815BF692B69}) (Version: 7 - Macromedia)
Macromedia Flash MX (HKLM\...\{3BE480ED-E17A-431A-981C-5C2EDDBCD3BF}) (Version: 6 - Macromedia)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Matrox VFW Software Codecs, build 28  (HKLM\...\Matrox VFW Software Codecs) (Version:  - )
MDI viewer 0.1 (HKLM\...\MDI (Microsoft Office Document Image) Viewer_is1) (Version: 0.1 - )
MediaShow (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version: 3.0.4325 - CyberLink Corporation)
MEDION Fotos auf CD Hofer (HKLM\...\MEDION Fotos auf CD Hofer D) (Version: 6.0.2.0 - MAGIX AG)
Medion GoPal Assistant 4.03.006 (HKLM\...\Medion GoPal Assistant) (Version: 4.3.6.0 - Medion)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Web Embedding Fonts Tool (III) (HKLM\...\WEFT) (Version:  - )
Mobile Partner (HKLM\...\Mobile Partner) (Version: 11.300.05.00.152 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 35.0.1 (x86 de) (HKLM\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
Nikon File Uploader 2 (HKLM\...\{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}) (Version: 2.0.2 - Nikon)
Nikon Message Center 2 (HKLM\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.0.1 - Nikon)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}) (Version: 8.47.7.0 - Nokia)
PDF Settings CS5 (Version: 10.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 6.4.1 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PhotoNow! (HKLM\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.0.4310 - CyberLink Corp.)
Picture Control Utility (HKLM\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.1 - Nikon)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2209a - CyberLink Corp.)
PowerDirector (Version: 6.5.2209a - CyberLink Corp.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.3118.0 - CyberLink Corporation)
PowerProducer (HKLM\...\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 4.2.2219 - CyberLink Corp.)
Prolific USB-Serial Comm Port Driver (HKLM\...\{EEC010D0-1252-4E1D-BAD9-F1B8F414535C}) (Version: 1.0.0.3 - Prolific Electronics Industries co.,ltd)
QuickShare (HKLM\...\{11D4FAA0-A577-4FA8-B24E-D24283D861D1}) (Version: 11.24.60.15709 - Linkury Inc.) <==== ATTENTION
QuickTime (HKLM\...\{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}) (Version: 7.66.71.0 - Apple Inc.)
RealDownloader (Version: 1.3.0 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM\...\RealPlayer 16.0) (Version: 16.0.0 - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5464 - )
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.94 (HKLM\...\Revo Uninstaller) (Version: 1.94 - VS Revo Group)
ScanSoft PaperPort 11 (HKLM\...\{FA0E44BC-3731-42D5-BA98-E99DD5D70A83}) (Version: 11.1.0000 - Nuance Communications, Inc.)
SDP Downloader (HKLM\...\{B547CB8D-549A-436E-97B5-E79F911B11E2}) (Version: 2.3.0 - SDP Multimedia)
Skype web features (HKLM\...\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3971 - Skype Technologies S.A.)
Skype™ 4.1 (HKLM\...\{D103C4BA-F905-437A-8049-DB24763BBE36}) (Version: 4.1.179 - Skype Technologies S.A.)
SPAMfighter (Version: 7.6.104 - Spamfighter ApS) Hidden
StreamTransport version: 1.0.2.2171 (HKLM\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 9.2.7.0 - Synaptics)
tele.ring Mobile Internet  (HKLM\...\{E665E293-442E-4B34-B515-1412F9921B8C}_x) (Version: 2.6.0.384 - Option nv)
tele.ring Mobile Internet (Version: 2.6.0.384 - Option nv) Hidden
Telescope Driver (HKLM\...\{B2920232-19DA-44FC-835F-68E427EAE2CE}) (Version: 10.30.09 - PixArt)
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.340 - TuneUp Software) Hidden
Unity Web Player (HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
VCRedistSetup (Version: 1.0.0 - Nero AG) Hidden
VIA Display Vista Driver 7.14.14.0019 (HKLM\...\VIA Chrome9 HC IGP Family Windows Vista Display) (Version:  - )
ViewNX 2 (HKLM\...\{DDD62492-32A7-412B-8AF1-2CF032AD42E3}) (Version: 2.0.2 - Nikon)
Vista Buttons (HKLM\...\Vista Buttons) (Version:  - )
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 1.0.3 (HKLM\...\VLC media player) (Version: 1.0.3 - VideoLAN Team)
Windows Movie Maker 2.6 (HKLM\...\{B3DAF54F-DB25-4586-9EF1-96D24BB14088}) (Version: 2.6.4040.0 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinMerge 2.14.0 (HKLM\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Markus\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{9E385F0A-0BA2-430C-96AA-4399C5E40F6C}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{DCA74850-096D-40CD-BB81-17034E51ACB6}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)

==================== Restore Points  =========================

15-01-2015 22:01:55 Windows Update
09-02-2015 21:37:57 Revo Uninstaller's restore point - TuneUp Utilities 2014
09-02-2015 21:39:37 TuneUp Utilities 2014 wird entfernt
09-02-2015 22:21:42 TuneUp Utilities 2014 (de-DE) wird entfernt
11-02-2015 23:01:59 Revo Uninstaller's restore point - PokerStars
12-02-2015 21:47:39 Windows Update
14-02-2015 18:20:20 Windows Update
14-02-2015 19:12:42 Revo Uninstaller's restore point - Positive Finds
14-02-2015 20:30:57 Windows-Modulinstallation
14-02-2015 20:53:57 Windows-Modulinstallation
14-02-2015 21:25:18 Windows Update
14-02-2015 21:27:23 Windows Update
14-02-2015 21:28:51 Windows Update
14-02-2015 22:19:07 Revo Uninstaller's restore point - Cliqz
14-02-2015 22:24:53 Revo Uninstaller's restore point - Mozilla Firefox 35.0.1 (x86 de)
14-02-2015 22:27:05 Revo Uninstaller's restore point - Mozilla Firefox 35.0.1 (x86 de)
15-02-2015 01:44:06 Revo Uninstaller's restore point - Free Video Flip and Rotate version 1.0.9.128
15-02-2015 02:02:05 Removed Java 8 Update 31
15-02-2015 02:09:15 Revo Uninstaller's restore point - SPAMfighter
15-02-2015 02:19:28 Revo Uninstaller's restore point - TuneUp Utilities 2014
15-02-2015 11:42:03 Windows Update
15-02-2015 12:37:39 Revo Uninstaller's restore point - Spyware Terminator 2015
15-02-2015 12:50:05 Revo Uninstaller's restore point - Unknown Device Identifier 8.02
15-02-2015 12:52:35 Revo Uninstaller's restore point - Avira Free Antivirus
15-02-2015 13:02:59 Revo Uninstaller's restore point - Avira
15-02-2015 13:10:20 Installed AVG 2015
15-02-2015 13:11:10 Installed AVG 2015
15-02-2015 13:29:11 AVG PC TuneUp 2015 wird installiert

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2010-09-13 10:59 - 00000084 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1 activate.adobe.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {09471F20-FD55-424B-B232-22A8CB9DC56A} - System32\Tasks\SSBkgdUpdate => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {14846EF2-E82B-4CDC-BD45-9346356AC093} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2658DD86-9544-4AE6-B39B-9721808D75D3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {26B95428-CF05-44B7-AD40-0952428CE304} - \RealPlayer (32-bit)  No Task File <==== ATTENTION
Task: {274852B8-7817-48D8-9F28-EE411B7533EB} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {2A7EEA82-47D3-438D-8D67-23C614EA6698} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {2B615096-2F25-4E67-BDB0-43600AC27D72} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {647382CB-357D-41F2-ABF9-96E0DAE8093B} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {6F58BCD1-5997-4E6F-A747-F34783FCD821} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-10-05] (Google)
Task: {865349A1-A41D-42AF-BF8B-611CA59F6C66} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {BB45DE64-9F84-4ADD-82B3-18E2CBA41F0E} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {C8ED3C47-480E-449E-9F92-EB8355B58B74} - System32\Tasks\{44BB347D-5325-4066-889A-0D3485C6D0C3} => pcalua.exe -a C:\Users\Markus\Downloads\Programme\Setups\RealPlayer11GOLD_de.exe -d C:\Users\Markus\Downloads\Programme\Setups
Task: {CAC99C03-182F-4267-A42B-9241EA8CA1DE} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {CDA52374-F8C6-41F3-8F88-E6ABDFE6558D} - System32\Tasks\4808 => Wscript.exe C:\Users\Markus\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {D2DA80A2-B768-468A-9A41-91B1049E36F3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {DF755FFE-5AF1-4FC8-A997-F0A108E15C02} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {ED48265D-3C70-4564-96FC-2933644DF1CE} - \GoforFilesUpdate No Task File <==== ATTENTION
Task: {FEBCEBF5-82C0-4939-B2AB-992D840CEC29} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Google Software Updater.job => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{69D37424-7323-4CD9-9909-D30D85007A62}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) ==============

2012-05-05 13:23 - 2011-02-07 08:56 - 00138192 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
2012-11-29 20:31 - 2012-11-29 20:31 - 00038608 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2008-06-26 05:36 - 2007-01-09 10:25 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2015-02-12 17:39 - 2015-02-12 17:39 - 00604984 _____ () C:\Program Files\AVG\AVG PC TuneUp\avgreplibx.dll
2015-02-12 17:39 - 2015-02-12 17:39 - 00728888 _____ () C:\Program Files\AVG\AVG PC TuneUp\tulngx.dll
2008-06-25 13:36 - 2006-05-29 12:40 - 00266240 _____ () C:\Windows\System32\ESB.EXE
2015-01-29 22:05 - 2015-01-29 22:05 - 03925104 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-349582430-969671104-3874210206-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\img24.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk => C:\Windows\pss\Adobe Gamma Loader.exe.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk => C:\Windows\pss\Adobe Gamma Loader.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^tele.ring Mobile Internet.lnk => C:\Windows\pss\tele.ring Mobile Internet.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS5.5ServiceManager => "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: AdobeCS5ServiceManager => "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: ArcSoft Connection Service => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
MSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
MSCONFIG\startupreg: DivX Download Manager => "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe -s
MSCONFIG\startupreg: PDFPrint => C:\Program Files\pdf24\pdf24.exe

==================== Accounts: =============================

Administrator (S-1-5-21-349582430-969671104-3874210206-500 - Administrator - Disabled)
Beruf (S-1-5-21-349582430-969671104-3874210206-1002 - Administrator - Enabled) => C:\Users\Beruf
Gast (S-1-5-21-349582430-969671104-3874210206-501 - Limited - Disabled)
Markus (S-1-5-21-349582430-969671104-3874210206-1000 - Administrator - Enabled) => C:\Users\Markus

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/16/2015 11:58:04 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (02/16/2015 11:58:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (02/16/2015 11:24:20 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm adwcleaner_4.110.exe, Version 4.1.1.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 12e0
Anfangszeit: 01d04a3590200ef4
Zeitpunkt der Beendigung: 15

Error: (02/15/2015 09:58:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (02/15/2015 09:58:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (02/15/2015 09:37:28 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (02/15/2015 01:02:51 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {1aa35571-3775-4356-9b66-fa4328dbc176}

Error: (02/15/2015 01:01:22 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (02/15/2015 00:52:36 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddWin32ServiceFiles: Unable to back up image of service Spyware Terminator 2015 Realtime Shield Service since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (02/15/2015 00:52:34 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {db51d1f7-6927-424b-b78a-3f5c84e0814b}


System errors:
=============
Error: (02/16/2015 11:54:05 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86

Error: (02/16/2015 11:52:54 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (02/16/2015 11:50:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Gatewaydienst auf Anwendungsebene%%1053

Error: (02/16/2015 11:50:12 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Gatewaydienst auf Anwendungsebene

Error: (02/16/2015 11:50:03 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: tcpipBM

Error: (02/16/2015 11:50:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (02/16/2015 09:51:44 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86

Error: (02/16/2015 09:51:07 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner Fehler ist im Speicher-Manager aufgetreten.

Error: (02/16/2015 09:50:48 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: tcpipBM

Error: (02/16/2015 09:50:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058


Microsoft Office Sessions:
=========================
Error: (02/16/2015 11:58:04 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (02/16/2015 11:58:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (02/16/2015 11:24:20 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: adwcleaner_4.110.exe4.1.1.012e001d04a3590200ef415

Error: (02/15/2015 09:58:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (02/15/2015 09:58:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (02/15/2015 09:37:28 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (02/15/2015 01:02:51 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005

Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {1aa35571-3775-4356-9b66-fa4328dbc176}

Error: (02/15/2015 01:01:22 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (02/15/2015 00:52:36 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddWin32ServiceFiles: Unable to back up image of service Spyware Terminator 2015 Realtime Shield Service since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (02/15/2015 00:52:34 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005

Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {db51d1f7-6927-424b-b78a-3f5c84e0814b}


CodeIntegrity Errors:
===================================
  Date: 2015-02-17 00:07:52.459
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 00:07:51.146
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 00:07:49.865
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 00:07:48.568
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 00:06:43.349
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 00:06:42.177
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 00:06:40.974
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 00:06:39.756
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 00:06:38.412
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 00:06:36.677
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Genuine Intel(R) CPU T1500 @ 1.86GHz
Percentage of memory in use: 56%
Total physical RAM: 2813.4 MB
Available physical RAM: 1222.35 MB
Total Pagefile: 5869.32 MB
Available Pagefile: 4207.73 MB
Total Virtual: 2047.88 MB
Available Virtual: 1898.95 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:204.99 GB) (Free:49.62 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:27.88 GB) (Free:21.06 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: B641FCBA)
Partition 1: (Active) - (Size=205 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=27.9 GB) - (Type=0C)

==================== End Of Log ============================

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-17 01:08:44
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD2500BEVS-00UST0 rev.01.01A01 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\Markus\AppData\Local\Temp\pxdiypoc.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                                         ZwNotifyChangeKey [0x8FAD76E0]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                                         ZwNotifyChangeMultipleKeys [0x8FAD7800]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                                         ZwOpenProcess [0x8FAD7010]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                                         ZwOpenThread [0x8FAD74D0]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                                         ZwSuspendProcess [0x8FAD7300]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                                         ZwSuspendThread [0x8FAD73E0]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                                         ZwTerminateProcess [0x8FAD7120]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                                         ZwTerminateThread [0x8FAD7210]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                                         ZwWriteVirtualMemory [0x8FAD75E0]

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!KeSetEvent + 3BD                                                                                        82AB4A08 8 Bytes  [E0, 76, AD, 8F, 00, 78, AD, ...]
.text           ntkrnlpa.exe!KeSetEvent + 3F1                                                                                        82AB4A3C 4 Bytes  [10, 70, AD, 8F]
.text           ntkrnlpa.exe!KeSetEvent + 40D                                                                                        82AB4A58 4 Bytes  [D0, 74, AD, 8F] {SAL BYTE [EBP+EBP*4-0x71], 0x1}
.text           ntkrnlpa.exe!KeSetEvent + 611                                                                                        82AB4C5C 8 Bytes  [00, 73, AD, 8F, E0, 73, AD, ...]
.text           ntkrnlpa.exe!KeSetEvent + 621                                                                                        82AB4C6C 8 Bytes  [20, 71, AD, 8F, 10, 72, AD, ...]
.text           ...                                                                                                                  

---- User code sections - GMER 2.1 ----

.text           C:\Windows\system32\Dwm.exe[1368] ntdll.dll!NtWriteVirtualMemory                                                     774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           C:\Windows\System32\ESB.EXE[1484] ntdll.dll!NtWriteVirtualMemory                                                     774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           c:\program files\real\realplayer\update\RealOneMessageCenter.exe[1968] ntdll.dll!NtWriteVirtualMemory                774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           c:\program files\real\realplayer\update\RealOneMessageCenter.exe[1968] kernel32.dll!SetUnhandledExceptionFilter      7563A9BD 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text           C:\Windows\system32\taskeng.exe[2680] ntdll.dll!NtWriteVirtualMemory                                                 774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           C:\Windows\system32\taskeng.exe[3344] ntdll.dll!NtWriteVirtualMemory                                                 774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           C:\Windows\Explorer.EXE[3364] ntdll.dll!NtWriteVirtualMemory                                                         774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           C:\Windows\system32\svchost.exe[3596] ntdll.dll!NtWriteVirtualMemory                                                 774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           C:\Windows\System32\mobsync.exe[3700] ntdll.dll!NtWriteVirtualMemory                                                 774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           ...                                                                                                                  
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!LdrLoadDll                                              77479378 5 Bytes  JMP 6B231F42 C:\Program Files\Mozilla Firefox\mozglue.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtCreateFile                                            774B4264 5 Bytes  JMP 600E9AE0 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtFlushBuffersFile                                      774B4764 5 Bytes  JMP 600CC434 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtQueryFullAttributesFile                               774B4C94 5 Bytes  JMP 600CC150 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtReadFile                                              774B4EC4 5 Bytes  JMP 600CC330 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtReadFileScatter                                       774B4ED4 5 Bytes  JMP 60AEF60F C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtWriteFile                                             774B54D4 5 Bytes  JMP 600EA9F0 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtWriteFileGather                                       774B54E4 5 Bytes  JMP 60AEF5BE C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtWriteVirtualMemory                                    774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] kernel32.dll!HeapSetInformation + 26                              7563A9B8 7 Bytes  JMP 600E63D0 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] kernel32.dll!LockResource + C                                     75656BD3 7 Bytes  JMP 60A14AA0 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] kernel32.dll!VirtualAllocEx + 54                                  7565B030 7 Bytes  JMP 60A14AC3 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] USER32.dll!GetWindowInfo                                          7694428E 5 Bytes  JMP 6090B991 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4340] GDI32.dll!SetStretchBltMode + 256                                 74FA745C 7 Bytes  JMP 60A14A21 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe[4364] ntdll.dll!NtWriteVirtualMemory                    774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           C:\Windows\system32\ctfmon.exe[4488] ntdll.dll!NtWriteVirtualMemory                                                  774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4788] ntdll.dll!NtWriteVirtualMemory                                   774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe[4824] ntdll.dll!NtWriteVirtualMemory                                774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           C:\Windows\system32\SearchProtocolHost.exe[4892] ntdll.dll!NtWriteVirtualMemory                                      774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text           ...                                                                                                                  
.text           c:\program files\real\realplayer\Update\realsched.exe[5620] kernel32.dll!SetUnhandledExceptionFilter                 7563A9BD 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text           C:\Program Files\ArcSoft\MediaConverter 3\Monitor.exe[5660] ntdll.dll!NtWriteVirtualMemory                           774B5504 5 Bytes  JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                              Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                              Wdf01000.sys
AttachedDevice  \Driver\tdx \Device\Tcp                                                                                              avgtdix.sys
AttachedDevice  \Driver\tdx \Device\Udp                                                                                              avgtdix.sys
AttachedDevice  \Driver\tdx \Device\RawIp                                                                                            avgtdix.sys
AttachedDevice  \FileSystem\fastfat \Fat                                                                                             fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-349582430-969671104-3874210206-1000@RefCount  4
Reg             HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StreamLog@CurrentStreamLog                         409
Reg             HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@f!s!\30!\30!f!`!{!s!r!t!t!s!d!\30!s!d!            19583823

---- EOF - GMER 2.1 ----

schrauber · 17.02.2015, 05:58

Hi,

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

QuickShare
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches Frst log bitte.

RedHot1982 · 17.02.2015, 09:33

Hallo!

Wenn ich die u.a. Programme bereits installiert habe, kann ich diese gleich verwenden oder soll ich sie deinstallieren und nochmals neu installieren.

Am Abend werde ich die Aufgaben durchführen und die jrt.txt hochladen.

Mfg

schrauber · 17.02.2015, 17:52

Richtig installiert kann davon nur MBAM sein, das einfach updaten.

RedHot1982 · 18.02.2015, 00:32

Hi!

Wie lange sollte der Löschvorgang beim AdwCleaner ca. Dauern?
Es kommt der blaue Balken und es steht "Lösche Ordner ...".

Nach 30 Minuten noch immer unverändert.

Danke für die Hilfe!

Hallo!

Anbei die Ergebnisse der Scans:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org


Update, 17.02.2015 00:34:35, SYSTEM, MARKUS-PC, Scheduler, Failed, Unable to access update server, 
Protection, 17.02.2015 20:02:27, SYSTEM, MARKUS-PC, Protection, Malware Protection, Starting, 
Protection, 17.02.2015 20:02:27, SYSTEM, MARKUS-PC, Protection, Malware Protection, Started, 
Protection, 17.02.2015 20:02:27, SYSTEM, MARKUS-PC, Protection, Malicious Website Protection, Starting, 
Protection, 17.02.2015 20:05:21, SYSTEM, MARKUS-PC, Protection, Malicious Website Protection, Started, 
Update, 17.02.2015 20:28:56, SYSTEM, MARKUS-PC, Manual, Malware Database, 2015.2.16.9, 2015.2.17.9, 
Protection, 17.02.2015 20:28:56, SYSTEM, MARKUS-PC, Protection, Refresh, Starting, 
Protection, 17.02.2015 20:28:56, SYSTEM, MARKUS-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 17.02.2015 20:28:56, SYSTEM, MARKUS-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 17.02.2015 20:29:46, SYSTEM, MARKUS-PC, Protection, Refresh, Success, 
Protection, 17.02.2015 20:29:46, SYSTEM, MARKUS-PC, Protection, Malicious Website Protection, Starting, 
Protection, 17.02.2015 20:29:55, SYSTEM, MARKUS-PC, Protection, Malicious Website Protection, Started, 

(end)

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v4.110 - Bericht erstellt 17/02/2015 um 21:28:04
# Aktualisiert 05/02/2015 von Xplode
# Datenbank : 2015-02-14.2 [Server]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (x86)
# Benutzername : Markus - MARKUS-PC
# Gestarted von : C:\Users\Markus\Desktop\AdwCleaner_4.110.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Markus\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Markus\AppData\Local\RGMService
Ordner Gelöscht : C:\Users\Markus\AppData\LocalLow\AVG Security Toolbar
Ordner Gelöscht : C:\Users\Markus\AppData\Roaming\RHEng
Ordner Gelöscht : C:\Users\Markus\AppData\Roaming\ProgSense
Datei Gelöscht : C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\foxydeal.sqlite
Datei Gelöscht : C:\Program Files\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.EasyHideBtn
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.EasyHideBtn.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.Localizer
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.Localizer.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighter
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighter.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighterStatistics
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.NameHighlighterStatistics.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SkypeIEHelper
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SkypeIEHelper.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SNameProxy
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.SNameProxy.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{937936AF-28CA-4973-B8AE-F250406149A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7854F00C-DC77-477E-A10E-603F48442D3B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Schlüssel Gelöscht : HKCU\Software\IGearSettings
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\Fighters
Schlüssel Gelöscht : HKCU\Software\ProgSense
Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Tarma Installer
Schlüssel Gelöscht : HKLM\SOFTWARE\Fighters
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Positive Finds
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

***** [ Internetbrowser ] *****

-\\ Internet Explorer v8.0.6001.19600


-\\ Mozilla Firefox v35.0.1 (x86 de)


*************************

AdwCleaner[R0].txt - [7975 Bytes] - [15/02/2015 00:34:35]
AdwCleaner[R1].txt - [7540 Bytes] - [15/02/2015 00:53:00]
AdwCleaner[R2].txt - [7657 Bytes] - [15/02/2015 01:02:34]
AdwCleaner[R3].txt - [7774 Bytes] - [15/02/2015 01:24:09]
AdwCleaner[R4].txt - [7634 Bytes] - [15/02/2015 01:55:10]
AdwCleaner[R5].txt - [7400 Bytes] - [15/02/2015 02:17:07]
AdwCleaner[R6].txt - [7277 Bytes] - [16/02/2015 23:11:59]
AdwCleaner[R7].txt - [7226 Bytes] - [17/02/2015 21:05:21]
AdwCleaner[R8].txt - [7343 Bytes] - [17/02/2015 21:23:38]
AdwCleaner[S0].txt - [1117 Bytes] - [15/02/2015 00:47:29]
AdwCleaner[S1].txt - [446 Bytes] - [15/02/2015 00:58:46]
AdwCleaner[S2].txt - [446 Bytes] - [15/02/2015 01:05:19]
AdwCleaner[S3].txt - [446 Bytes] - [15/02/2015 01:32:42]
AdwCleaner[S4].txt - [793 Bytes] - [15/02/2015 01:58:01]
AdwCleaner[S5].txt - [442 Bytes] - [16/02/2015 23:16:00]
AdwCleaner[S6].txt - [399 Bytes] - [17/02/2015 21:09:55]
AdwCleaner[S7].txt - [7231 Bytes] - [17/02/2015 21:28:04]

########## EOF - C:\AdwCleaner\AdwCleaner[S7].txt - [7290  Bytes] ##########

--- --- ---

JRT Logfile:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Markus on 18.02.2015 at  0:06:03,00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.02.2015 at  0:19:18,24
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

--- --- ---

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-02-2015
Ran by Markus (administrator) on MARKUS-PC on 18-02-2015 00:19:54
Running from C:\Users\Markus\Desktop
Loaded Profiles: Markus (Available profiles: Markus & Beruf)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(OptionNV) C:\Program Files\telering\tele.ring Mobile Internet\GtDetectSc.exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(AVG Technologies) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(AVG Technologies) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(S3 Graphics Co., Ltd.) C:\Windows\System32\s3trayp.exe
() C:\Windows\System32\ESB.EXE
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Chicony Electronics Co., Ltd.) C:\Windows\System32\DVAPTray.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe
(Geek Software GmbH) C:\Program Files\pdf24\pdf24.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(ArcSoft) C:\Program Files\ArcSoft\MediaConverter 3\Monitor.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4018176 2006-11-20] (Realtek Semiconductor)
HKLM\...\Run: [S3Trayp] => S3trayp.exe -chkautorun
HKLM\...\Run: [ESB] => C:\Windows\system32\ESB.EXE [266240 2006-05-29] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [869936 2007-05-24] (Synaptics, Inc.)
HKLM\...\Run: [LanguageShortcut] => C:\Program Files\HomeCinema\PowerDVD\Language\Language.exe [52256 2007-01-08] ()
HKLM\...\Run: [PaperPort PTD] => C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2007-10-11] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2007-10-11] (Nuance Communications, Inc.)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [DVAPTray] => C:\Windows\System32\DVAPTray.exe [188416 2009-10-30] (Chicony Electronics Co., Ltd.)
HKLM\...\Run: [PAC7302_Monitor] => C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [PDFPrint] => C:\Program Files\pdf24\pdf24.exe [191016 2014-05-14] (Geek Software GmbH)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG)
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {12d6d0f5-521e-11df-933d-0040d0e86c2a} - G:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {1c89ada2-4977-11df-a25c-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {5d86b4c8-e6df-11dd-854a-0015afd3cc7a} - F:\LaunchU3.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {6f152377-3e1f-11df-9976-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {717e6b46-e95f-11de-bf93-0015afd3cc7a} - F:\setup.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {750db5e0-4e36-11df-b467-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {90bbca4d-48f3-11e0-b8e4-0040d0e86c2a} - explorer.exe hxxp://www.drei.at/inside3
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {9b282eb9-49fb-11df-8789-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {9b282ec7-49fb-11df-8789-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a47e2a75-3da7-11df-b946-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a47e2a82-3da7-11df-b946-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a71f3ffc-4974-11df-a7ab-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {b4c891f2-1010-11df-abcb-0015afd3cc7a} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {d0c934e2-100a-11df-ad9e-0015afd3cc7a} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {dace676e-5937-11df-b566-0040d0e86c2a} - F:\AutoRun.exe
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [146432 2008-07-24] (Google)
AppInit_DLLs:  C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [146432 2008-07-24] (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Device Monitor.lnk
ShortcutTarget: Device Monitor.lnk -> C:\Program Files\ArcSoft\MediaConverter 3\Monitor.exe (ArcSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\.DEFAULT -> {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Skype add-on (mastermind) -> {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-349582430-969671104-3874210206-1000 -> No Name - {A057A204-BACC-4D26-9990-79A187E2698E} -  No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX OVS Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=14 -> C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF Plugin: @real.com/nppl3260;version=16.0.0.282 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-349582430-969671104-3874210206-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Markus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdbplug.dll (DNAML Pty Ltd)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)
FF Extension: DownloadHelper - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-02-15]
FF Extension: ProxTube - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\ich@maltegoetz.de.xpi [2015-02-15]
FF Extension: Adblock Plus - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-15]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-09]
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011-01-16]
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011-01-16]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2012-12-18]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2010-12-08]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]
CHR HKLM\...\Chrome\Extension: [jmfkcklnlgedgbglfkkgedjfmejoahla] - C:\Program Files\AVG\AVG2012\Chrome\safesearch.crx [Not Found]
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2010-12-08]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.)
S3 FirebirdServerMAGIXInstance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed]
S3 GoogleDesktopManager; C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe [69120 2008-07-24] (Google) [File not signed]
R2 GtDetectSc; C:\Program Files\telering\tele.ring Mobile Internet\GtDetectSc.exe [196704 2007-12-18] (OptionNV) [File not signed]
S2 gupdate1ca10806b390478; C:\Program Files\Google\Update\GoogleUpdate.exe [107912 2014-10-26] (Google Inc.)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [620544 2008-11-11] (Nokia.) [File not signed]
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [2161976 2015-02-12] (AVG Technologies)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208152 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [154904 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [200984 2014-10-10] (AVG Technologies CZ, s.r.o.)
S3 BrSerIf; C:\Windows\System32\Drivers\BrSerIf.sys [52224 2006-12-12] (Brother Industries Ltd.) [File not signed]
S3 camfilt2; C:\Windows\System32\DRIVERS\camfilt2.sys [94720 2007-08-06] (Guillemot Corporation)
R3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc.              )
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36640 2009-10-09] () [File not signed]
S3 GT72NDISIPXP; C:\Windows\System32\DRIVERS\Gt51Ip.sys [106624 2008-02-18] (Option N.V.)
S3 GT72UBUS; C:\Windows\System32\DRIVERS\gt72ubus.sys [59648 2008-02-08] (Option N.V.)
S3 GTPTSER; C:\Windows\System32\DRIVERS\gtptser.sys [8064 2007-03-30] (Option N.V.)
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [103040 2009-06-15] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-17] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [458752 2007-11-08] (PixArt Imaging Inc.)
R3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [252416 2007-06-01] (Realtek Semiconductor Corporation                           )
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [90536 2008-05-27] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-05-27] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [122152 2008-05-27] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [115496 2008-05-27] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [25768 2008-05-27] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [111912 2008-05-27] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [117672 2008-05-27] (MCCI Corporation)
R3 S3GIGP; C:\Windows\System32\DRIVERS\VTGKModeDX32.sys [791040 2007-07-20] (S3 Graphics Co., Ltd.)
S3 SNPSTD3; C:\Windows\System32\DRIVERS\snpstd3.sys [10371072 2007-07-17] (Sonix Co. Ltd.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-07-21] (Duplex Secure Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2015-01-13] (TuneUp Software)
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 tcpipBM; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-18 00:19 - 2015-02-18 00:20 - 00023401 _____ () C:\Users\Markus\Desktop\FRST.txt
2015-02-18 00:19 - 2015-02-18 00:19 - 00000635 _____ () C:\Users\Markus\Desktop\JRT.txt
2015-02-18 00:04 - 2015-02-18 00:04 - 01388274 _____ (Thisisu) C:\Users\Markus\Desktop\JRT.exe
2015-02-18 00:00 - 2015-02-18 00:00 - 00007370 _____ () C:\Users\Markus\Desktop\AdwCleaner[S7].txt
2015-02-17 21:03 - 2015-02-17 21:03 - 02112512 _____ () C:\Users\Markus\Desktop\AdwCleaner_4.110.exe
2015-02-17 21:02 - 2015-02-17 21:02 - 00001256 _____ () C:\Users\Markus\Desktop\mbam.txt
2015-02-17 20:21 - 2015-02-18 00:13 - 00000000 ____D () C:\Users\Markus\Desktop\Screening
2015-02-17 20:21 - 2015-02-17 20:21 - 00001021 _____ () C:\Users\Markus\Desktop\Revo Uninstaller.lnk
2015-02-17 00:05 - 2015-02-18 00:20 - 00000000 ____D () C:\FRST
2015-02-16 23:44 - 2015-02-16 23:44 - 00000020 _____ () C:\Users\Markus\defogger_reenable
2015-02-16 23:43 - 2015-02-16 23:43 - 00380416 _____ () C:\Users\Markus\Desktop\Gmer-19357.exe
2015-02-16 23:42 - 2015-02-16 23:42 - 01125888 _____ (Farbar) C:\Users\Markus\Desktop\FRST.exe
2015-02-16 23:41 - 2015-02-16 23:41 - 00050477 _____ () C:\Users\Markus\Desktop\Defogger.exe
2015-02-15 21:37 - 2015-02-15 21:37 - 00000000 ____D () C:\Users\Beruf\AppData\Roaming\AVG2015
2015-02-15 21:37 - 2015-02-15 21:37 - 00000000 ____D () C:\Users\Beruf\AppData\Local\Avg2015
2015-02-15 21:35 - 2015-02-15 21:35 - 00000000 ____D () C:\Users\Beruf\AppData\Local\Avg
2015-02-15 13:45 - 2015-02-15 13:45 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-15 13:45 - 2015-02-15 13:45 - 00000000 _____ () C:\Windows\setupact.log
2015-02-15 13:39 - 2015-02-15 13:39 - 00001857 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00001849 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00001845 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2015.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015
2015-02-15 13:38 - 2015-02-15 13:38 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\AVG
2015-02-15 13:29 - 2015-02-15 13:29 - 00000000 ____D () C:\Users\Markus\AppData\Local\Avg
2015-02-15 13:26 - 2015-02-15 13:48 - 00000000 ____D () C:\ProgramData\AVG
2015-02-15 13:16 - 2015-02-15 13:16 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\AVG2015
2015-02-15 13:15 - 2015-02-15 13:15 - 00000822 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-02-15 13:15 - 2015-02-15 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-02-15 13:12 - 2015-02-15 13:15 - 00000000 ____D () C:\ProgramData\AVG2015
2015-02-15 13:10 - 2015-02-15 13:32 - 00000000 ____D () C:\Program Files\AVG
2015-02-15 13:09 - 2015-02-15 13:46 - 00000000 ____D () C:\Users\Markus\AppData\Local\Avg2015
2015-02-15 13:03 - 2015-02-15 13:03 - 00000000 ____D () C:\OETemp
2015-02-15 11:35 - 2015-02-15 21:28 - 00007556 _____ () C:\Windows\PFRO.log
2015-02-15 02:27 - 2015-02-15 02:27 - 00000000 ____D () C:\Programᡄ
2015-02-15 02:20 - 2011-06-21 11:24 - 00032768 _____ () C:\Windows\system32\Drivers\sp_rsdrv2.sys
2015-02-15 02:18 - 2015-02-12 17:39 - 00037176 _____ (AVG Technologies) C:\Windows\system32\TURegOpt.exe
2015-02-15 02:18 - 2015-02-12 17:39 - 00025912 _____ (AVG Technologies) C:\Windows\system32\authuitu.dll
2015-02-15 00:34 - 2015-02-17 23:16 - 00000000 ____D () C:\AdwCleaner
2015-02-14 21:37 - 2015-02-17 23:58 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-14 21:36 - 2015-02-14 21:36 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-02-14 21:36 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-14 21:36 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-14 21:36 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-14 21:35 - 2015-02-14 21:35 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Chip Digital GmbH
2015-02-12 23:03 - 2015-02-12 22:57 - 00146432 _____ (Oracle Corporation) C:\Windows\system32\javacpl.cpl
2015-02-12 23:00 - 2015-02-12 22:57 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2015-02-12 23:00 - 2015-02-12 22:57 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2015-02-12 22:00 - 2015-01-09 01:20 - 02063360 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-12 22:00 - 2014-11-26 03:05 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-12 21:59 - 2015-01-13 02:39 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-12 21:55 - 2015-01-15 05:13 - 00440760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-12 21:50 - 2014-12-08 02:59 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-12 21:48 - 2015-02-03 12:55 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-02-12 21:48 - 2015-02-03 12:53 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 06004736 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 11084288 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 02006016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-12 21:48 - 2015-02-03 12:51 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-12 21:48 - 2015-02-03 12:49 - 00348160 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-12 21:48 - 2015-02-03 12:49 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-12 21:48 - 2015-02-03 11:13 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-12 21:48 - 2015-02-03 09:29 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-12 21:47 - 2015-02-03 12:52 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-02-12 21:47 - 2015-02-03 12:51 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-12 21:47 - 2015-02-03 12:49 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2015-02-12 21:47 - 2015-02-03 09:29 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-12 21:47 - 2015-02-03 09:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-02-12 21:47 - 2015-02-03 09:26 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-09 21:27 - 2015-02-15 13:15 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\TuneUp Software
2015-02-09 21:27 - 2015-02-09 21:27 - 00000000 ____D () C:\Users\Markus\AppData\Local\TuneUp Software
2015-02-09 21:21 - 2015-02-09 21:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\FreeVideoFlipAndRotate
2015-02-09 21:20 - 2015-02-09 21:37 - 00000000 ____D () C:\ProgramData\TuneUp Software
2015-01-29 22:04 - 2015-02-14 22:31 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-01-22 23:35 - 2015-01-22 23:40 - 00014336 _____ () C:\Users\Markus\Desktop\Wok Grill.xls
2015-01-21 21:58 - 2015-01-21 21:58 - 140980086 _____ () C:\Users\Markus\Desktop\Video first production Pizzaschiffchen salami.mov

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-18 00:11 - 2009-07-29 20:13 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-18 00:06 - 2009-09-06 21:47 - 01256600 _____ () C:\Windows\WindowsUpdate.log
2015-02-17 23:59 - 2008-10-18 11:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2015-02-17 23:58 - 2009-07-29 20:13 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-17 23:52 - 2009-04-04 20:40 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-02-17 23:51 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-17 23:51 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-17 23:51 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-17 23:48 - 2006-11-02 14:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-17 23:33 - 2012-07-25 19:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-17 22:34 - 2012-06-21 21:13 - 00000398 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{69D37424-7323-4CD9-9909-D30D85007A62}.job
2015-02-17 20:21 - 2009-11-13 12:49 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-02-17 20:07 - 2012-06-07 12:03 - 00000000 ____D () C:\ProgramData\MFAData
2015-02-16 23:44 - 2008-10-18 11:21 - 00000000 ____D () C:\Users\Markus
2015-02-15 21:37 - 2010-09-16 18:46 - 00000000 ____D () C:\Users\Beruf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2015-02-15 14:50 - 2008-10-27 20:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Skype
2015-02-15 14:49 - 2008-06-25 14:09 - 00000000 ____D () C:\Windows\Panther
2015-02-15 14:47 - 2013-11-10 17:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-15 13:42 - 2009-07-29 20:10 - 00001052 _____ () C:\Windows\Tasks\Google Software Updater.job
2015-02-15 12:02 - 2008-10-18 13:23 - 00000000 ____D () C:\Users\Markus\Documents\PRIVAT
2015-02-15 02:05 - 2008-06-26 05:39 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-02-15 01:48 - 2012-04-20 19:26 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\DVDVideoSoft
2015-02-14 23:50 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2015-02-14 23:13 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-02-12 23:06 - 2013-11-10 17:37 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-12 22:57 - 2014-11-13 19:25 - 00272296 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2015-02-12 22:45 - 2006-11-02 13:47 - 03707464 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 22:11 - 2013-08-18 19:37 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 22:01 - 2006-11-02 11:24 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-02-11 23:02 - 2008-11-19 10:30 - 00000000 ____D () C:\Users\Markus\AppData\Local\PokerStars
2015-02-11 22:37 - 2009-12-16 11:07 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\vlc
2015-02-09 21:43 - 2008-10-29 10:14 - 00069632 _____ () C:\Users\Markus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-09 21:18 - 2008-01-21 08:16 - 00006650 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-04 21:33 - 2012-07-25 19:07 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-02-04 21:33 - 2011-06-20 19:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-02-02 20:18 - 2012-11-07 22:49 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

==================== Files in the root of some directories =======

2009-07-21 21:23 - 2009-07-21 21:23 - 4182178 _____ (The Public) C:\Users\Markus\AppData\Roaming\Avisynth.exe
2009-07-21 21:23 - 2009-07-21 21:23 - 5243208 _____ (                                                            ) C:\Users\Markus\AppData\Roaming\AvsP.exe
2009-07-28 20:46 - 2011-01-16 19:49 - 0000166 _____ () C:\Users\Markus\AppData\Roaming\Default.PLS
2009-07-21 21:23 - 2009-07-21 21:25 - 4284535 _____ (ffdshow                                                     ) C:\Users\Markus\AppData\Roaming\ffdshow.exe
2010-09-28 22:36 - 2010-09-28 22:44 - 0176128 _____ () C:\Users\Markus\AppData\Roaming\fontdb.mdb
2009-07-21 21:23 - 2009-07-21 21:45 - 2040451 _____ (LIGHTNING UK!) C:\Users\Markus\AppData\Roaming\Imgburn.exe
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Piano Med
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Pianos and Keyboards
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Pick Bass
2009-07-21 21:23 - 2009-07-21 21:23 - 0642685 _____ (Xvid team                                                   ) C:\Users\Markus\AppData\Roaming\xvid.exe
2012-04-21 09:07 - 2012-06-20 23:07 - 0000680 _____ () C:\Users\Markus\AppData\Local\d3d9caps.dat
2008-10-29 10:14 - 2015-02-09 21:43 - 0069632 _____ () C:\Users\Markus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-12-15 11:12 - 2013-06-10 22:07 - 0823012 _____ () C:\Users\Markus\AppData\Local\Optimizer.txt
2012-10-11 21:09 - 2012-10-11 21:09 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2012-10-11 21:09 - 2013-03-24 18:27 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2012-10-11 21:09 - 2012-10-11 21:18 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Planets
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Plants
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Plug-In Settings
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Profiles
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Quartz Composer
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Receipts

Some content of TEMP:
====================
C:\Users\Beruf\AppData\Local\Temp\avgnt.exe
C:\Users\Beruf\AppData\Local\Temp\~convert1837889909121605377.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4109784010493011813.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4209830696876608383.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4485552456435490824.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4816294060936977035.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5129652577971428585.exe
C:\Users\Beruf\AppData\Local\Temp\~convert530476614210965046.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5388659676246649071.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5767244083265548046.exe
C:\Users\Beruf\AppData\Local\Temp\~convert6259682022611103149.exe
C:\Users\Beruf\AppData\Local\Temp\~convert7283267209106047323.exe
C:\Users\Beruf\AppData\Local\Temp\~convert8207960948104172192.exe
C:\Users\Beruf\AppData\Local\Temp\~convert8651104764550743687.exe
C:\Users\Markus\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Markus\AppData\Local\Temp\nofkkbaq.dll
C:\Users\Markus\AppData\Local\Temp\Quarantine.exe
C:\Users\Markus\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Markus\AppData\Local\Temp\sqlite3.dll
C:\Users\Markus\AppData\Local\Temp\TUUUninstallHelper.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-18 00:07

==================== End Of Log ============================

--- --- ---

--- --- ---

FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-02-2015
Ran by Markus at 2015-02-18 00:21:34
Running from C:\Users\Markus\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AC3Filter (remove only) (HKLM\...\AC3Filter) (Version:  - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)
Adobe Community Help (HKLM\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.4.980 - Adobe Systems Incorporated.)
Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.0.6 - Adobe Systems Incorporated)
Adobe Dreamweaver CS5 (HKLM\...\{C79312BD-3E76-4474-A10C-1435D1856A4B}) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Professional CS5.5 (HKLM\...\{23E445D5-FD83-4C50-A211-EB26A2975317}) (Version: 11.5 - Adobe Systems Incorporated)
Adobe InDesign CS5 (HKLM\...\{F9766AC1-1461-1033-B862-DF8FE1C033BE}) (Version: 7.0 - Adobe Systems Incorporated)
Adobe Media Player (HKLM\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Photoshop 7.0 (HKLM\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{553255F3-78FD-40F1-A6F8-6882140265FE}) (Version: 1.2.1 - Apple Inc.)
ArcSoft MediaConverter 3 (HKLM\...\{EE27AA87-8593-4B8A-A595-29E289C5520F}) (Version: 3.1.8.81 - ArcSoft)
Avanquest update (HKLM\...\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}) (Version: 1.19 - Avanquest Software)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5645 - AVG Technologies)
AVG 2015 (Version: 15.0.4284 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5645 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (de-DE) (Version: 15.0.1001.393 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (HKLM\...\AVG PC TuneUp) (Version: 15.0.1001.393 - AVG Technologies)
AVG PC TuneUp 2015 (Version: 15.0.1001.393 - AVG Technologies) Hidden
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version:  - )
Canon MG2100 series Benutzerregistrierung (HKLM\...\Canon MG2100 series Benutzerregistrierung) (Version:  - )
Canon MG2100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2100_series) (Version:  - )
Canon MG2100 series On-screen Manual (HKLM\...\Canon MG2100 series On-screen Manual) (Version:  - )
Canon MP Navigator EX 5.0 (HKLM\...\MP Navigator EX 5.0) (Version:  - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM\...\CanonSolutionMenuEX) (Version:  - )
CCleaner (remove only) (HKLM\...\CCleaner) (Version:  - Piriform)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6021.5000 - Microsoft Corporation)
ConvertHelper 2.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version:  - DownloadHelper)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.1109a - CyberLink Corp.)
DataLogger (HKLM\...\ST6UNST #3) (Version:  - )
DHTML Menu Studio (HKLM\...\DHTML Menu Studio Standard Demo_is1) (Version: 5.0.0.150 - Xtreeme GmbH)
DL2005 (C:\Program Files\DL2005\) (HKLM\...\ST6UNST #2) (Version:  - )
DL2005 (HKLM\...\ST6UNST #1) (Version:  - )
DVAPTray (HKLM\...\{30D1B542-44E0-44F0-8A31-2A101CB626B5}) (Version: 1.0.0.7 - )
Easy Start Button (HKLM\...\ESB) (Version:  - )
ffdshow [rev 3026] [2009-07-05] (HKLM\...\ffdshow_is1) (Version: 1.0 - )
Firebird SQL Server - MAGIX Edition (HKLM\...\Firebird SQL Server D) (Version: 2.0.1.13 - MAGIX AG)
Google Desktop (HKLM\...\Google Desktop) (Version: - - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Google Updater (HKLM\...\Google Updater) (Version: 2.4.2432.1652 - Google Inc.)
Hercules Classic Silver Webcam (HKLM\...\{FD4FE0F7-91FC-43A2-9C3A-187553991FFF}) (Version: 2.8.0.0 - Hercules)
HOFER Bestellsoftware 4.13.0 (HKLM\...\HOFER Bestellsoftware) (Version: 4.13.0 - ORWO Net)
Hofer Foto Manager Free (HKLM\...\Hofer Foto Manager Free D) (Version: 3.4.0.466 - MAGIX AG)
Hofer Foto Service (HKLM\...\Hofer Foto Service D) (Version: 1.12.0.95 - MAGIX AG)
Hofer Fotobuch und Kalender Druck Service  (HKLM\...\Pixelspeed_LayouterH) (Version:  - )
Hofer Online Druck Service 3.0.6.0 (D) (HKLM\...\Hofer Online Druck Service D) (Version: 3.0.6.0 - MAGIX AG)
IrfanView (remove only) (HKLM\...\IrfanView) (Version:  - )
Japanese Fonts Support For Adobe Reader 8 (HKLM\...\{AC76BA86-7AD7-5760-0000-800000000003}) (Version: 8.0 - Adobe Systems)
Macromedia Extension Manager (HKLM\...\{A5BA14E0-7384-11D4-BAE7-00409631A2C8}) (Version: 1.5 - Macromedia)
Macromedia Fireworks MX 2004 (HKLM\...\{E583ED6F-BD99-4066-A420-C815BF692B69}) (Version: 7 - Macromedia)
Macromedia Flash MX (HKLM\...\{3BE480ED-E17A-431A-981C-5C2EDDBCD3BF}) (Version: 6 - Macromedia)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Matrox VFW Software Codecs, build 28  (HKLM\...\Matrox VFW Software Codecs) (Version:  - )
MDI viewer 0.1 (HKLM\...\MDI (Microsoft Office Document Image) Viewer_is1) (Version: 0.1 - )
MediaShow (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version: 3.0.4325 - CyberLink Corporation)
MEDION Fotos auf CD Hofer (HKLM\...\MEDION Fotos auf CD Hofer D) (Version: 6.0.2.0 - MAGIX AG)
Medion GoPal Assistant 4.03.006 (HKLM\...\Medion GoPal Assistant) (Version: 4.3.6.0 - Medion)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Web Embedding Fonts Tool (III) (HKLM\...\WEFT) (Version:  - )
Mobile Partner (HKLM\...\Mobile Partner) (Version: 11.300.05.00.152 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 35.0.1 (x86 de) (HKLM\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
Nikon File Uploader 2 (HKLM\...\{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}) (Version: 2.0.2 - Nikon)
Nikon Message Center 2 (HKLM\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.0.1 - Nikon)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}) (Version: 8.47.7.0 - Nokia)
PDF Settings CS5 (Version: 10.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 6.4.1 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PhotoNow! (HKLM\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.0.4310 - CyberLink Corp.)
Picture Control Utility (HKLM\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.1 - Nikon)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2209a - CyberLink Corp.)
PowerDirector (Version: 6.5.2209a - CyberLink Corp.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.3118.0 - CyberLink Corporation)
PowerProducer (HKLM\...\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 4.2.2219 - CyberLink Corp.)
Prolific USB-Serial Comm Port Driver (HKLM\...\{EEC010D0-1252-4E1D-BAD9-F1B8F414535C}) (Version: 1.0.0.3 - Prolific Electronics Industries co.,ltd)
QuickTime (HKLM\...\{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}) (Version: 7.66.71.0 - Apple Inc.)
RealDownloader (Version: 1.3.0 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM\...\RealPlayer 16.0) (Version: 16.0.0 - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5464 - )
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
ScanSoft PaperPort 11 (HKLM\...\{FA0E44BC-3731-42D5-BA98-E99DD5D70A83}) (Version: 11.1.0000 - Nuance Communications, Inc.)
SDP Downloader (HKLM\...\{B547CB8D-549A-436E-97B5-E79F911B11E2}) (Version: 2.3.0 - SDP Multimedia)
Skype web features (HKLM\...\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3971 - Skype Technologies S.A.)
Skype™ 4.1 (HKLM\...\{D103C4BA-F905-437A-8049-DB24763BBE36}) (Version: 4.1.179 - Skype Technologies S.A.)
SPAMfighter (Version: 7.6.104 - Spamfighter ApS) Hidden
StreamTransport version: 1.0.2.2171 (HKLM\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 9.2.7.0 - Synaptics)
tele.ring Mobile Internet  (HKLM\...\{E665E293-442E-4B34-B515-1412F9921B8C}_x) (Version: 2.6.0.384 - Option nv)
tele.ring Mobile Internet (Version: 2.6.0.384 - Option nv) Hidden
Telescope Driver (HKLM\...\{B2920232-19DA-44FC-835F-68E427EAE2CE}) (Version: 10.30.09 - PixArt)
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.340 - TuneUp Software) Hidden
Unity Web Player (HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
VCRedistSetup (Version: 1.0.0 - Nero AG) Hidden
VIA Display Vista Driver 7.14.14.0019 (HKLM\...\VIA Chrome9 HC IGP Family Windows Vista Display) (Version:  - )
ViewNX 2 (HKLM\...\{DDD62492-32A7-412B-8AF1-2CF032AD42E3}) (Version: 2.0.2 - Nikon)
Vista Buttons (HKLM\...\Vista Buttons) (Version:  - )
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 1.0.3 (HKLM\...\VLC media player) (Version: 1.0.3 - VideoLAN Team)
Windows Movie Maker 2.6 (HKLM\...\{B3DAF54F-DB25-4586-9EF1-96D24BB14088}) (Version: 2.6.4040.0 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinMerge 2.14.0 (HKLM\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Markus\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{9E385F0A-0BA2-430C-96AA-4399C5E40F6C}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{DCA74850-096D-40CD-BB81-17034E51ACB6}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)

==================== Restore Points  =========================

15-01-2015 22:01:55 Windows Update
09-02-2015 21:37:57 Revo Uninstaller's restore point - TuneUp Utilities 2014
09-02-2015 21:39:37 TuneUp Utilities 2014 wird entfernt
09-02-2015 22:21:42 TuneUp Utilities 2014 (de-DE) wird entfernt
11-02-2015 23:01:59 Revo Uninstaller's restore point - PokerStars
12-02-2015 21:47:39 Windows Update
14-02-2015 18:20:20 Windows Update
14-02-2015 19:12:42 Revo Uninstaller's restore point - Positive Finds
14-02-2015 20:30:57 Windows-Modulinstallation
14-02-2015 20:53:57 Windows-Modulinstallation
14-02-2015 21:25:18 Windows Update
14-02-2015 21:27:23 Windows Update
14-02-2015 21:28:51 Windows Update
14-02-2015 22:19:07 Revo Uninstaller's restore point - Cliqz
14-02-2015 22:24:53 Revo Uninstaller's restore point - Mozilla Firefox 35.0.1 (x86 de)
14-02-2015 22:27:05 Revo Uninstaller's restore point - Mozilla Firefox 35.0.1 (x86 de)
15-02-2015 01:44:06 Revo Uninstaller's restore point - Free Video Flip and Rotate version 1.0.9.128
15-02-2015 02:02:05 Removed Java 8 Update 31
15-02-2015 02:09:15 Revo Uninstaller's restore point - SPAMfighter
15-02-2015 02:19:28 Revo Uninstaller's restore point - TuneUp Utilities 2014
15-02-2015 11:42:03 Windows Update
15-02-2015 12:37:39 Revo Uninstaller's restore point - Spyware Terminator 2015
15-02-2015 12:50:05 Revo Uninstaller's restore point - Unknown Device Identifier 8.02
15-02-2015 12:52:35 Revo Uninstaller's restore point - Avira Free Antivirus
15-02-2015 13:02:59 Revo Uninstaller's restore point - Avira
15-02-2015 13:10:20 Installed AVG 2015
15-02-2015 13:11:10 Installed AVG 2015
15-02-2015 13:29:11 AVG PC TuneUp 2015 wird installiert
17-02-2015 20:25:18 Revo Uninstaller's restore point - QuickShare

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2010-09-13 10:59 - 00000084 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1 activate.adobe.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {09471F20-FD55-424B-B232-22A8CB9DC56A} - System32\Tasks\SSBkgdUpdate => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {14846EF2-E82B-4CDC-BD45-9346356AC093} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2658DD86-9544-4AE6-B39B-9721808D75D3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {26B95428-CF05-44B7-AD40-0952428CE304} - \RealPlayer (32-bit)  No Task File <==== ATTENTION
Task: {274852B8-7817-48D8-9F28-EE411B7533EB} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {2A7EEA82-47D3-438D-8D67-23C614EA6698} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {2B615096-2F25-4E67-BDB0-43600AC27D72} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {647382CB-357D-41F2-ABF9-96E0DAE8093B} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {6F58BCD1-5997-4E6F-A747-F34783FCD821} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-10-05] (Google)
Task: {72ECFFA9-864E-4F56-8032-4E192B5F5847} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\AVG\AVG PC TuneUp\OneClick.exe [2015-02-12] (AVG Technologies)
Task: {865349A1-A41D-42AF-BF8B-611CA59F6C66} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {BB45DE64-9F84-4ADD-82B3-18E2CBA41F0E} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {C8ED3C47-480E-449E-9F92-EB8355B58B74} - System32\Tasks\{44BB347D-5325-4066-889A-0D3485C6D0C3} => pcalua.exe -a C:\Users\Markus\Downloads\Programme\Setups\RealPlayer11GOLD_de.exe -d C:\Users\Markus\Downloads\Programme\Setups
Task: {CAC99C03-182F-4267-A42B-9241EA8CA1DE} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {CDA52374-F8C6-41F3-8F88-E6ABDFE6558D} - System32\Tasks\4808 => Wscript.exe C:\Users\Markus\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {D2DA80A2-B768-468A-9A41-91B1049E36F3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {DF755FFE-5AF1-4FC8-A997-F0A108E15C02} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {ED48265D-3C70-4564-96FC-2933644DF1CE} - \GoforFilesUpdate No Task File <==== ATTENTION
Task: {FEBCEBF5-82C0-4939-B2AB-992D840CEC29} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Google Software Updater.job => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{69D37424-7323-4CD9-9909-D30D85007A62}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) ==============

2012-05-05 13:23 - 2011-02-07 08:56 - 00138192 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
2012-11-29 20:31 - 2012-11-29 20:31 - 00038608 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2008-06-26 05:36 - 2007-01-09 10:25 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2015-02-12 17:39 - 2015-02-12 17:39 - 00604984 _____ () C:\Program Files\AVG\AVG PC TuneUp\avgreplibx.dll
2015-02-12 17:39 - 2015-02-12 17:39 - 00728888 _____ () C:\Program Files\AVG\AVG PC TuneUp\tulngx.dll
2008-06-25 13:36 - 2006-05-29 12:40 - 00266240 _____ () C:\Windows\System32\ESB.EXE
2008-11-07 11:31 - 2007-09-20 18:34 - 00129024 _____ () C:\Program Files\WinRAR\rarext.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-349582430-969671104-3874210206-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\img24.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk => C:\Windows\pss\Adobe Gamma Loader.exe.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk => C:\Windows\pss\Adobe Gamma Loader.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^tele.ring Mobile Internet.lnk => C:\Windows\pss\tele.ring Mobile Internet.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS5.5ServiceManager => "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: AdobeCS5ServiceManager => "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: ArcSoft Connection Service => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
MSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
MSCONFIG\startupreg: DivX Download Manager => "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe -s
MSCONFIG\startupreg: PDFPrint => C:\Program Files\pdf24\pdf24.exe

==================== Accounts: =============================

Administrator (S-1-5-21-349582430-969671104-3874210206-500 - Administrator - Disabled)
Beruf (S-1-5-21-349582430-969671104-3874210206-1002 - Administrator - Enabled) => C:\Users\Beruf
Gast (S-1-5-21-349582430-969671104-3874210206-501 - Limited - Disabled)
Markus (S-1-5-21-349582430-969671104-3874210206-1000 - Administrator - Enabled) => C:\Users\Markus

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2015-02-18 00:21:20.990
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 00:21:19.662
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 00:21:18.522
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 00:21:17.334
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 00:21:15.912
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 00:21:14.803
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 00:21:13.662
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 00:21:12.522
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 00:20:25.975
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 00:20:24.787
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Genuine Intel(R) CPU T1500 @ 1.86GHz
Percentage of memory in use: 42%
Total physical RAM: 2813.4 MB
Available physical RAM: 1625.96 MB
Total Pagefile: 5871.32 MB
Available Pagefile: 4460.96 MB
Total Virtual: 2047.88 MB
Available Virtual: 1910.58 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:204.99 GB) (Free:46.82 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:27.88 GB) (Free:21.06 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: B641FCBA)
Partition 1: (Active) - (Size=205 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=27.9 GB) - (Type=0C)

==================== End Of Log ============================

--- --- ---

schrauber · 18.02.2015, 12:49

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

RedHot1982 · 19.02.2015, 04:06

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=e102538de5230e48b178f648b6f54d4e
# engine=22533
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-18 11:48:21
# local_time=2015-02-19 12:48:21 (+0100, Mitteleuropäische Zeit)
# country="Austria"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='AVG AntiVirus Free Edition 2015'
# compatibility_mode=1055 16777213 100 100 14868 111437285 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 84239490 261836029 0 0
# scanned=292729
# found=10
# cleaned=0
# scan_time=13504
sh=47B19AB97028D8925579BED54EFEE88C8107D6B6 ft=1 fh=34f71966959b3eb8 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Markus\AppData\Local\Temp\DMR\dmr_72.exe"
sh=7C15DA5A80F24F0383C992CFB03CF68E95A464B1 ft=1 fh=be427aaf403ae2ff vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Markus\Desktop\Alte Firefox-Daten\fetcln27.default\extensions\{c1e3dc86-7c77-4676-980c-ef1bdbc3ef3c}\components\SmartbarFireFoxRemotePlugin_22.dll"
sh=95544372D9D68E8AFAE5E9DA8B07C14CE5406ABB ft=1 fh=dd489ec711c15129 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Markus\Desktop\Alte Firefox-Daten\fetcln27.default\extensions\{c1e3dc86-7c77-4676-980c-ef1bdbc3ef3c}\components\SmartbarFireFoxRemotePlugin_23.dll"
sh=BA8871127FB23B24A8963B6A5992DED58259E590 ft=1 fh=65df87dcc97c6ea8 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Markus\Desktop\Alte Firefox-Daten\fetcln27.default\extensions\{c1e3dc86-7c77-4676-980c-ef1bdbc3ef3c}\components\SmartbarFireFoxRemotePlugin_24.dll"
sh=C88DAF3FB5D3FEC090233FF251F7F0CFC73EF4CD ft=1 fh=b74c7f4df627386b vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Markus\Desktop\Alte Firefox-Daten\fetcln27.default\extensions\{c1e3dc86-7c77-4676-980c-ef1bdbc3ef3c}\components\SmartbarFireFoxRemotePlugin_25.dll"
sh=4B9D59EFA89F628628CE74083961743D56E460C7 ft=1 fh=8e9074b2b2075a48 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Markus\Desktop\Alte Firefox-Daten\fetcln27.default\extensions\{c1e3dc86-7c77-4676-980c-ef1bdbc3ef3c}\components\SmartbarFireFoxRemotePlugin_26.dll"
sh=7290509DD9B7F8DCFA781334EBEFF3E5D4C58C5C ft=1 fh=0aae782d31fb93bd vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Markus\Desktop\Alte Firefox-Daten\fetcln27.default\extensions\{c1e3dc86-7c77-4676-980c-ef1bdbc3ef3c}\components\SmartbarFireFoxRemotePlugin_27.dll"
sh=D2E74523225A00950AB158B9CBD9F0D3DBFF9186 ft=1 fh=de524adb0adebd81 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Markus\Downloads\Programme\Setups\SoftonicDownloader_fuer_windows-movie-maker.exe"
sh=063DA8C7D57744E21A192D74891CD265B0315679 ft=1 fh=b69f832c8b902c60 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Markus\Downloads\Programme\Setups\vlc-1.0.3-win32.exe"
sh=F5F47E0A2A9CB44FDBB4ADDF9BBCE16B562C5928 ft=1 fh=5dc30240df32cc2f vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.96  
 Windows Vista Service Pack 2 x86 (UAC is enabled)  
 Internet Explorer 8 Out of date! 
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:`````````````` 
AVG AntiVirus Free Edition 2015   
 Antivirus out of date!  
`````````Anti-malware/Other Utilities Check:````````` 
 AVG PC TuneUp 2015  
 AVG PC TuneUp 2015 (de-DE) 
 AVG PC TuneUp 2015  
 TuneUp Utilities 2014 (de-DE)  
 CCleaner (remove only)   
  Java 64-bit 8 Update 31  
 Adobe Flash Player 	16.0.0.305  
 Adobe Reader 8 Adobe Reader out of Date! 
 Mozilla Firefox (35.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 AVG avgwdsvc.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-02-2015 01
Ran by Markus (administrator) on MARKUS-PC on 19-02-2015 03:42:33
Running from C:\Users\Markus\Desktop
Loaded Profiles: Markus &  (Available profiles: Markus & Beruf)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(OptionNV) C:\Program Files\telering\tele.ring Mobile Internet\GtDetectSc.exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(AVG Technologies) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(AVG Technologies) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(S3 Graphics Co., Ltd.) C:\Windows\System32\s3trayp.exe
() C:\Windows\System32\ESB.EXE
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Chicony Electronics Co., Ltd.) C:\Windows\System32\DVAPTray.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe
(Geek Software GmbH) C:\Program Files\pdf24\pdf24.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(ArcSoft) C:\Program Files\ArcSoft\MediaConverter 3\Monitor.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4018176 2006-11-20] (Realtek Semiconductor)
HKLM\...\Run: [S3Trayp] => S3trayp.exe -chkautorun
HKLM\...\Run: [ESB] => C:\Windows\system32\ESB.EXE [266240 2006-05-29] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [869936 2007-05-24] (Synaptics, Inc.)
HKLM\...\Run: [LanguageShortcut] => C:\Program Files\HomeCinema\PowerDVD\Language\Language.exe [52256 2007-01-08] ()
HKLM\...\Run: [PaperPort PTD] => C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2007-10-11] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2007-10-11] (Nuance Communications, Inc.)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [DVAPTray] => C:\Windows\System32\DVAPTray.exe [188416 2009-10-30] (Chicony Electronics Co., Ltd.)
HKLM\...\Run: [PAC7302_Monitor] => C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [PDFPrint] => C:\Program Files\pdf24\pdf24.exe [191016 2014-05-14] (Geek Software GmbH)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG)
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {12d6d0f5-521e-11df-933d-0040d0e86c2a} - G:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {1c89ada2-4977-11df-a25c-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {5d86b4c8-e6df-11dd-854a-0015afd3cc7a} - F:\LaunchU3.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {6f152377-3e1f-11df-9976-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {717e6b46-e95f-11de-bf93-0015afd3cc7a} - F:\setup.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {750db5e0-4e36-11df-b467-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {90bbca4d-48f3-11e0-b8e4-0040d0e86c2a} - explorer.exe hxxp://www.drei.at/inside3
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {9b282eb9-49fb-11df-8789-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {9b282ec7-49fb-11df-8789-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a47e2a75-3da7-11df-b946-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a47e2a82-3da7-11df-b946-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a71f3ffc-4974-11df-a7ab-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {b4c891f2-1010-11df-abcb-0015afd3cc7a} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {d0c934e2-100a-11df-ad9e-0015afd3cc7a} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {dace676e-5937-11df-b566-0040d0e86c2a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG)
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {12d6d0f5-521e-11df-933d-0040d0e86c2a} - G:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {1c89ada2-4977-11df-a25c-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {5d86b4c8-e6df-11dd-854a-0015afd3cc7a} - F:\LaunchU3.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {6f152377-3e1f-11df-9976-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {717e6b46-e95f-11de-bf93-0015afd3cc7a} - F:\setup.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {750db5e0-4e36-11df-b467-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {90bbca4d-48f3-11e0-b8e4-0040d0e86c2a} - explorer.exe hxxp://www.drei.at/inside3
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {9b282eb9-49fb-11df-8789-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {9b282ec7-49fb-11df-8789-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a47e2a75-3da7-11df-b946-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a47e2a82-3da7-11df-b946-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a71f3ffc-4974-11df-a7ab-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {b4c891f2-1010-11df-abcb-0015afd3cc7a} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {d0c934e2-100a-11df-ad9e-0015afd3cc7a} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {dace676e-5937-11df-b566-0040d0e86c2a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [146432 2008-07-24] (Google)
AppInit_DLLs:  C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [146432 2008-07-24] (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Device Monitor.lnk
ShortcutTarget: Device Monitor.lnk -> C:\Program Files\ArcSoft\MediaConverter 3\Monitor.exe (ArcSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
HKU\S-1-5-21-349582430-969671104-3874210206-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com/
HKU\S-1-5-21-349582430-969671104-3874210206-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\.DEFAULT -> {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-349582430-969671104-3874210206-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = 
SearchScopes: HKU\S-1-5-21-349582430-969671104-3874210206-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = 
SearchScopes: HKU\S-1-5-21-349582430-969671104-3874210206-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={56FA237A-9843-44C9-90E6-888DA78A06FA}&mid=cf61d1f322c3ce972317206259976fe0-e4ec8cd77fddfeb78897cae6260a9433323eee57&lang=de&ds=AVG&pr=fr&d=2012-06-07 13:38:59&v=13.2.0.5&sap=dsp&q={searchTerms}
BHO: Skype add-on (mastermind) -> {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-349582430-969671104-3874210206-1000 -> No Name - {A057A204-BACC-4D26-9990-79A187E2698E} -  No File
Toolbar: HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {A057A204-BACC-4D26-9990-79A187E2698E} -  No File
Toolbar: HKU\S-1-5-21-349582430-969671104-3874210206-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX OVS Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=14 -> C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF Plugin: @real.com/nppl3260;version=16.0.0.282 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-349582430-969671104-3874210206-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Markus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Markus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdbplug.dll (DNAML Pty Ltd)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)
FF Extension: DownloadHelper - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-02-15]
FF Extension: ProxTube - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\ich@maltegoetz.de.xpi [2015-02-15]
FF Extension: Adblock Plus - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-15]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-09]
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011-01-16]
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011-01-16]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2012-12-18]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2010-12-08]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]
CHR HKLM\...\Chrome\Extension: [jmfkcklnlgedgbglfkkgedjfmejoahla] - C:\Program Files\AVG\AVG2012\Chrome\safesearch.crx [Not Found]
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2010-12-08]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.)
S3 FirebirdServerMAGIXInstance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed]
S3 GoogleDesktopManager; C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe [69120 2008-07-24] (Google) [File not signed]
R2 GtDetectSc; C:\Program Files\telering\tele.ring Mobile Internet\GtDetectSc.exe [196704 2007-12-18] (OptionNV) [File not signed]
S2 gupdate1ca10806b390478; C:\Program Files\Google\Update\GoogleUpdate.exe [107912 2014-10-26] (Google Inc.)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [620544 2008-11-11] (Nokia.) [File not signed]
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [2161976 2015-02-12] (AVG Technologies)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208152 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [154904 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [200984 2014-10-10] (AVG Technologies CZ, s.r.o.)
S3 BrSerIf; C:\Windows\System32\Drivers\BrSerIf.sys [52224 2006-12-12] (Brother Industries Ltd.) [File not signed]
S3 camfilt2; C:\Windows\System32\DRIVERS\camfilt2.sys [94720 2007-08-06] (Guillemot Corporation)
R3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc.              )
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36640 2009-10-09] () [File not signed]
S3 GT72NDISIPXP; C:\Windows\System32\DRIVERS\Gt51Ip.sys [106624 2008-02-18] (Option N.V.)
S3 GT72UBUS; C:\Windows\System32\DRIVERS\gt72ubus.sys [59648 2008-02-08] (Option N.V.)
S3 GTPTSER; C:\Windows\System32\DRIVERS\gtptser.sys [8064 2007-03-30] (Option N.V.)
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [103040 2009-06-15] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-19] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [458752 2007-11-08] (PixArt Imaging Inc.)
R3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [252416 2007-06-01] (Realtek Semiconductor Corporation                           )
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [90536 2008-05-27] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-05-27] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [122152 2008-05-27] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [115496 2008-05-27] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [25768 2008-05-27] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [111912 2008-05-27] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [117672 2008-05-27] (MCCI Corporation)
R3 S3GIGP; C:\Windows\System32\DRIVERS\VTGKModeDX32.sys [791040 2007-07-20] (S3 Graphics Co., Ltd.)
S3 SNPSTD3; C:\Windows\System32\DRIVERS\snpstd3.sys [10371072 2007-07-17] (Sonix Co. Ltd.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-07-21] (Duplex Secure Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2015-01-13] (TuneUp Software)
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 tcpipBM; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-19 03:42 - 2015-02-19 03:44 - 00028858 _____ () C:\Users\Markus\Desktop\FRST.txt
2015-02-19 03:42 - 2015-02-19 03:42 - 00000000 ____D () C:\Users\Markus\Desktop\FRST-OlderVersion
2015-02-19 03:21 - 2015-02-19 03:21 - 00852594 _____ () C:\Users\Markus\Desktop\SecurityCheck.exe
2015-02-18 00:04 - 2015-02-18 00:04 - 01388274 _____ (Thisisu) C:\Users\Markus\Desktop\JRT.exe
2015-02-17 21:03 - 2015-02-17 21:03 - 02112512 _____ () C:\Users\Markus\Desktop\AdwCleaner_4.110.exe
2015-02-17 20:21 - 2015-02-18 00:33 - 00000000 ____D () C:\Users\Markus\Desktop\Screening
2015-02-17 20:21 - 2015-02-17 20:21 - 00001021 _____ () C:\Users\Markus\Desktop\Revo Uninstaller.lnk
2015-02-17 00:05 - 2015-02-19 03:42 - 00000000 ____D () C:\FRST
2015-02-16 23:44 - 2015-02-16 23:44 - 00000020 _____ () C:\Users\Markus\defogger_reenable
2015-02-16 23:43 - 2015-02-16 23:43 - 00380416 _____ () C:\Users\Markus\Desktop\Gmer-19357.exe
2015-02-16 23:42 - 2015-02-19 03:42 - 01126400 _____ (Farbar) C:\Users\Markus\Desktop\FRST.exe
2015-02-16 23:41 - 2015-02-16 23:41 - 00050477 _____ () C:\Users\Markus\Desktop\Defogger.exe
2015-02-15 21:37 - 2015-02-15 21:37 - 00000000 ____D () C:\Users\Beruf\AppData\Roaming\AVG2015
2015-02-15 21:37 - 2015-02-15 21:37 - 00000000 ____D () C:\Users\Beruf\AppData\Local\Avg2015
2015-02-15 21:35 - 2015-02-15 21:35 - 00000000 ____D () C:\Users\Beruf\AppData\Local\Avg
2015-02-15 13:45 - 2015-02-15 13:45 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-15 13:45 - 2015-02-15 13:45 - 00000000 _____ () C:\Windows\setupact.log
2015-02-15 13:39 - 2015-02-15 13:39 - 00001857 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00001849 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00001845 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2015.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015
2015-02-15 13:38 - 2015-02-15 13:38 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\AVG
2015-02-15 13:29 - 2015-02-15 13:29 - 00000000 ____D () C:\Users\Markus\AppData\Local\Avg
2015-02-15 13:26 - 2015-02-15 13:48 - 00000000 ____D () C:\ProgramData\AVG
2015-02-15 13:16 - 2015-02-15 13:16 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\AVG2015
2015-02-15 13:15 - 2015-02-15 13:15 - 00000822 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-02-15 13:15 - 2015-02-15 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-02-15 13:12 - 2015-02-15 13:15 - 00000000 ____D () C:\ProgramData\AVG2015
2015-02-15 13:10 - 2015-02-15 13:32 - 00000000 ____D () C:\Program Files\AVG
2015-02-15 13:09 - 2015-02-15 13:46 - 00000000 ____D () C:\Users\Markus\AppData\Local\Avg2015
2015-02-15 13:03 - 2015-02-15 13:03 - 00000000 ____D () C:\OETemp
2015-02-15 11:35 - 2015-02-15 21:28 - 00007556 _____ () C:\Windows\PFRO.log
2015-02-15 02:27 - 2015-02-15 02:27 - 00000000 ____D () C:\Programᡄ
2015-02-15 02:20 - 2011-06-21 11:24 - 00032768 _____ () C:\Windows\system32\Drivers\sp_rsdrv2.sys
2015-02-15 02:18 - 2015-02-12 17:39 - 00037176 _____ (AVG Technologies) C:\Windows\system32\TURegOpt.exe
2015-02-15 02:18 - 2015-02-12 17:39 - 00025912 _____ (AVG Technologies) C:\Windows\system32\authuitu.dll
2015-02-15 00:34 - 2015-02-17 23:16 - 00000000 ____D () C:\AdwCleaner
2015-02-14 21:37 - 2015-02-19 03:33 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-14 21:36 - 2015-02-14 21:36 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-02-14 21:36 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-14 21:36 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-14 21:36 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-14 21:35 - 2015-02-14 21:35 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Chip Digital GmbH
2015-02-12 23:03 - 2015-02-12 22:57 - 00146432 _____ (Oracle Corporation) C:\Windows\system32\javacpl.cpl
2015-02-12 23:00 - 2015-02-12 22:57 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2015-02-12 23:00 - 2015-02-12 22:57 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2015-02-12 22:00 - 2015-01-09 01:20 - 02063360 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-12 22:00 - 2014-11-26 03:05 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-12 21:59 - 2015-01-13 02:39 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-12 21:55 - 2015-01-15 05:13 - 00440760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-12 21:50 - 2014-12-08 02:59 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-12 21:48 - 2015-02-03 12:55 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-02-12 21:48 - 2015-02-03 12:53 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 06004736 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 11084288 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 02006016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-12 21:48 - 2015-02-03 12:51 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-12 21:48 - 2015-02-03 12:49 - 00348160 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-12 21:48 - 2015-02-03 12:49 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-12 21:48 - 2015-02-03 11:13 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-12 21:48 - 2015-02-03 09:29 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-12 21:47 - 2015-02-03 12:52 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-02-12 21:47 - 2015-02-03 12:51 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-12 21:47 - 2015-02-03 12:49 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2015-02-12 21:47 - 2015-02-03 09:29 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-12 21:47 - 2015-02-03 09:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-02-12 21:47 - 2015-02-03 09:26 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-09 21:27 - 2015-02-15 13:15 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\TuneUp Software
2015-02-09 21:27 - 2015-02-09 21:27 - 00000000 ____D () C:\Users\Markus\AppData\Local\TuneUp Software
2015-02-09 21:21 - 2015-02-09 21:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\FreeVideoFlipAndRotate
2015-02-09 21:20 - 2015-02-09 21:37 - 00000000 ____D () C:\ProgramData\TuneUp Software
2015-01-29 22:04 - 2015-02-14 22:31 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-01-22 23:35 - 2015-01-22 23:40 - 00014336 _____ () C:\Users\Markus\Desktop\Wok Grill.xls
2015-01-21 21:58 - 2015-01-21 21:58 - 140980086 _____ () C:\Users\Markus\Desktop\Video first production Pizzaschiffchen salami.mov

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-19 03:43 - 2012-06-21 21:13 - 00000398 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{69D37424-7323-4CD9-9909-D30D85007A62}.job
2015-02-19 03:33 - 2012-07-25 19:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-19 03:11 - 2009-07-29 20:13 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-19 03:00 - 2009-09-06 21:47 - 01278207 _____ () C:\Windows\WindowsUpdate.log
2015-02-19 02:34 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-19 02:34 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-19 01:11 - 2009-07-29 20:13 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-18 20:50 - 2008-10-18 11:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2015-02-18 20:40 - 2012-06-07 12:03 - 00000000 ____D () C:\ProgramData\MFAData
2015-02-18 20:35 - 2009-04-04 20:40 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-02-18 20:34 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-18 00:35 - 2006-11-02 14:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-17 20:21 - 2009-11-13 12:49 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-02-16 23:44 - 2008-10-18 11:21 - 00000000 ____D () C:\Users\Markus
2015-02-15 21:37 - 2010-09-16 18:46 - 00000000 ____D () C:\Users\Beruf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2015-02-15 14:50 - 2008-10-27 20:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Skype
2015-02-15 14:49 - 2008-06-25 14:09 - 00000000 ____D () C:\Windows\Panther
2015-02-15 14:47 - 2013-11-10 17:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-15 13:42 - 2009-07-29 20:10 - 00001052 _____ () C:\Windows\Tasks\Google Software Updater.job
2015-02-15 12:02 - 2008-10-18 13:23 - 00000000 ____D () C:\Users\Markus\Documents\PRIVAT
2015-02-15 02:05 - 2008-06-26 05:39 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-02-15 01:48 - 2012-04-20 19:26 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\DVDVideoSoft
2015-02-14 23:50 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2015-02-14 23:13 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-02-12 23:06 - 2013-11-10 17:37 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-12 22:57 - 2014-11-13 19:25 - 00272296 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2015-02-12 22:45 - 2006-11-02 13:47 - 03707464 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 22:11 - 2013-08-18 19:37 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 22:01 - 2006-11-02 11:24 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-02-11 23:02 - 2008-11-19 10:30 - 00000000 ____D () C:\Users\Markus\AppData\Local\PokerStars
2015-02-11 22:37 - 2009-12-16 11:07 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\vlc
2015-02-09 21:43 - 2008-10-29 10:14 - 00069632 _____ () C:\Users\Markus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-09 21:18 - 2008-01-21 08:16 - 00006650 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-04 21:33 - 2012-07-25 19:07 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-02-04 21:33 - 2011-06-20 19:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-02-02 20:18 - 2012-11-07 22:49 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

==================== Files in the root of some directories =======

2009-07-21 21:23 - 2009-07-21 21:23 - 4182178 _____ (The Public) C:\Users\Markus\AppData\Roaming\Avisynth.exe
2009-07-21 21:23 - 2009-07-21 21:23 - 5243208 _____ (                                                            ) C:\Users\Markus\AppData\Roaming\AvsP.exe
2009-07-28 20:46 - 2011-01-16 19:49 - 0000166 _____ () C:\Users\Markus\AppData\Roaming\Default.PLS
2009-07-21 21:23 - 2009-07-21 21:25 - 4284535 _____ (ffdshow                                                     ) C:\Users\Markus\AppData\Roaming\ffdshow.exe
2010-09-28 22:36 - 2010-09-28 22:44 - 0176128 _____ () C:\Users\Markus\AppData\Roaming\fontdb.mdb
2009-07-21 21:23 - 2009-07-21 21:45 - 2040451 _____ (LIGHTNING UK!) C:\Users\Markus\AppData\Roaming\Imgburn.exe
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Piano Med
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Pianos and Keyboards
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Pick Bass
2009-07-21 21:23 - 2009-07-21 21:23 - 0642685 _____ (Xvid team                                                   ) C:\Users\Markus\AppData\Roaming\xvid.exe
2012-04-21 09:07 - 2012-06-20 23:07 - 0000680 _____ () C:\Users\Markus\AppData\Local\d3d9caps.dat
2008-10-29 10:14 - 2015-02-09 21:43 - 0069632 _____ () C:\Users\Markus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-12-15 11:12 - 2013-06-10 22:07 - 0823012 _____ () C:\Users\Markus\AppData\Local\Optimizer.txt
2012-10-11 21:09 - 2012-10-11 21:09 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2012-10-11 21:09 - 2013-03-24 18:27 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2012-10-11 21:09 - 2012-10-11 21:18 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Planets
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Plants
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Plug-In Settings
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Profiles
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Quartz Composer
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Receipts

Some content of TEMP:
====================
C:\Users\Beruf\AppData\Local\Temp\avgnt.exe
C:\Users\Beruf\AppData\Local\Temp\~convert1837889909121605377.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4109784010493011813.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4209830696876608383.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4485552456435490824.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4816294060936977035.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5129652577971428585.exe
C:\Users\Beruf\AppData\Local\Temp\~convert530476614210965046.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5388659676246649071.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5767244083265548046.exe
C:\Users\Beruf\AppData\Local\Temp\~convert6259682022611103149.exe
C:\Users\Beruf\AppData\Local\Temp\~convert7283267209106047323.exe
C:\Users\Beruf\AppData\Local\Temp\~convert8207960948104172192.exe
C:\Users\Beruf\AppData\Local\Temp\~convert8651104764550743687.exe
C:\Users\Markus\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Markus\AppData\Local\Temp\nofkkbaq.dll
C:\Users\Markus\AppData\Local\Temp\Quarantine.exe
C:\Users\Markus\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Markus\AppData\Local\Temp\sqlite3.dll
C:\Users\Markus\AppData\Local\Temp\TUUUninstallHelper.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-18 20:49

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 18-02-2015 01
Ran by Markus at 2015-02-19 03:45:23
Running from C:\Users\Markus\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AC3Filter (remove only) (HKLM\...\AC3Filter) (Version:  - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)
Adobe Community Help (HKLM\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.4.980 - Adobe Systems Incorporated.)
Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.0.6 - Adobe Systems Incorporated)
Adobe Dreamweaver CS5 (HKLM\...\{C79312BD-3E76-4474-A10C-1435D1856A4B}) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Professional CS5.5 (HKLM\...\{23E445D5-FD83-4C50-A211-EB26A2975317}) (Version: 11.5 - Adobe Systems Incorporated)
Adobe InDesign CS5 (HKLM\...\{F9766AC1-1461-1033-B862-DF8FE1C033BE}) (Version: 7.0 - Adobe Systems Incorporated)
Adobe Media Player (HKLM\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Photoshop 7.0 (HKLM\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{553255F3-78FD-40F1-A6F8-6882140265FE}) (Version: 1.2.1 - Apple Inc.)
ArcSoft MediaConverter 3 (HKLM\...\{EE27AA87-8593-4B8A-A595-29E289C5520F}) (Version: 3.1.8.81 - ArcSoft)
Avanquest update (HKLM\...\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}) (Version: 1.19 - Avanquest Software)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5645 - AVG Technologies)
AVG 2015 (Version: 15.0.4284 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5645 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (de-DE) (Version: 15.0.1001.393 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (HKLM\...\AVG PC TuneUp) (Version: 15.0.1001.393 - AVG Technologies)
AVG PC TuneUp 2015 (Version: 15.0.1001.393 - AVG Technologies) Hidden
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version:  - )
Canon MG2100 series Benutzerregistrierung (HKLM\...\Canon MG2100 series Benutzerregistrierung) (Version:  - )
Canon MG2100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2100_series) (Version:  - )
Canon MG2100 series On-screen Manual (HKLM\...\Canon MG2100 series On-screen Manual) (Version:  - )
Canon MP Navigator EX 5.0 (HKLM\...\MP Navigator EX 5.0) (Version:  - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM\...\CanonSolutionMenuEX) (Version:  - )
CCleaner (remove only) (HKLM\...\CCleaner) (Version:  - Piriform)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6021.5000 - Microsoft Corporation)
ConvertHelper 2.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version:  - DownloadHelper)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.1109a - CyberLink Corp.)
DataLogger (HKLM\...\ST6UNST #3) (Version:  - )
DHTML Menu Studio (HKLM\...\DHTML Menu Studio Standard Demo_is1) (Version: 5.0.0.150 - Xtreeme GmbH)
DL2005 (C:\Program Files\DL2005\) (HKLM\...\ST6UNST #2) (Version:  - )
DL2005 (HKLM\...\ST6UNST #1) (Version:  - )
DVAPTray (HKLM\...\{30D1B542-44E0-44F0-8A31-2A101CB626B5}) (Version: 1.0.0.7 - )
Easy Start Button (HKLM\...\ESB) (Version:  - )
ffdshow [rev 3026] [2009-07-05] (HKLM\...\ffdshow_is1) (Version: 1.0 - )
Firebird SQL Server - MAGIX Edition (HKLM\...\Firebird SQL Server D) (Version: 2.0.1.13 - MAGIX AG)
Google Desktop (HKLM\...\Google Desktop) (Version: - - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Google Updater (HKLM\...\Google Updater) (Version: 2.4.2432.1652 - Google Inc.)
Hercules Classic Silver Webcam (HKLM\...\{FD4FE0F7-91FC-43A2-9C3A-187553991FFF}) (Version: 2.8.0.0 - Hercules)
HOFER Bestellsoftware 4.13.0 (HKLM\...\HOFER Bestellsoftware) (Version: 4.13.0 - ORWO Net)
Hofer Foto Manager Free (HKLM\...\Hofer Foto Manager Free D) (Version: 3.4.0.466 - MAGIX AG)
Hofer Foto Service (HKLM\...\Hofer Foto Service D) (Version: 1.12.0.95 - MAGIX AG)
Hofer Fotobuch und Kalender Druck Service  (HKLM\...\Pixelspeed_LayouterH) (Version:  - )
Hofer Online Druck Service 3.0.6.0 (D) (HKLM\...\Hofer Online Druck Service D) (Version: 3.0.6.0 - MAGIX AG)
IrfanView (remove only) (HKLM\...\IrfanView) (Version:  - )
Japanese Fonts Support For Adobe Reader 8 (HKLM\...\{AC76BA86-7AD7-5760-0000-800000000003}) (Version: 8.0 - Adobe Systems)
Macromedia Extension Manager (HKLM\...\{A5BA14E0-7384-11D4-BAE7-00409631A2C8}) (Version: 1.5 - Macromedia)
Macromedia Fireworks MX 2004 (HKLM\...\{E583ED6F-BD99-4066-A420-C815BF692B69}) (Version: 7 - Macromedia)
Macromedia Flash MX (HKLM\...\{3BE480ED-E17A-431A-981C-5C2EDDBCD3BF}) (Version: 6 - Macromedia)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Matrox VFW Software Codecs, build 28  (HKLM\...\Matrox VFW Software Codecs) (Version:  - )
MDI viewer 0.1 (HKLM\...\MDI (Microsoft Office Document Image) Viewer_is1) (Version: 0.1 - )
MediaShow (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version: 3.0.4325 - CyberLink Corporation)
MEDION Fotos auf CD Hofer (HKLM\...\MEDION Fotos auf CD Hofer D) (Version: 6.0.2.0 - MAGIX AG)
Medion GoPal Assistant 4.03.006 (HKLM\...\Medion GoPal Assistant) (Version: 4.3.6.0 - Medion)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Web Embedding Fonts Tool (III) (HKLM\...\WEFT) (Version:  - )
Mobile Partner (HKLM\...\Mobile Partner) (Version: 11.300.05.00.152 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 35.0.1 (x86 de) (HKLM\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
Nikon File Uploader 2 (HKLM\...\{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}) (Version: 2.0.2 - Nikon)
Nikon Message Center 2 (HKLM\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.0.1 - Nikon)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}) (Version: 8.47.7.0 - Nokia)
PDF Settings CS5 (Version: 10.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 6.4.1 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PhotoNow! (HKLM\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.0.4310 - CyberLink Corp.)
Picture Control Utility (HKLM\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.1 - Nikon)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2209a - CyberLink Corp.)
PowerDirector (Version: 6.5.2209a - CyberLink Corp.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.3118.0 - CyberLink Corporation)
PowerProducer (HKLM\...\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 4.2.2219 - CyberLink Corp.)
Prolific USB-Serial Comm Port Driver (HKLM\...\{EEC010D0-1252-4E1D-BAD9-F1B8F414535C}) (Version: 1.0.0.3 - Prolific Electronics Industries co.,ltd)
QuickTime (HKLM\...\{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}) (Version: 7.66.71.0 - Apple Inc.)
RealDownloader (Version: 1.3.0 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM\...\RealPlayer 16.0) (Version: 16.0.0 - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5464 - )
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
ScanSoft PaperPort 11 (HKLM\...\{FA0E44BC-3731-42D5-BA98-E99DD5D70A83}) (Version: 11.1.0000 - Nuance Communications, Inc.)
SDP Downloader (HKLM\...\{B547CB8D-549A-436E-97B5-E79F911B11E2}) (Version: 2.3.0 - SDP Multimedia)
Skype web features (HKLM\...\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3971 - Skype Technologies S.A.)
Skype™ 4.1 (HKLM\...\{D103C4BA-F905-437A-8049-DB24763BBE36}) (Version: 4.1.179 - Skype Technologies S.A.)
SPAMfighter (Version: 7.6.104 - Spamfighter ApS) Hidden
StreamTransport version: 1.0.2.2171 (HKLM\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 9.2.7.0 - Synaptics)
tele.ring Mobile Internet  (HKLM\...\{E665E293-442E-4B34-B515-1412F9921B8C}_x) (Version: 2.6.0.384 - Option nv)
tele.ring Mobile Internet (Version: 2.6.0.384 - Option nv) Hidden
Telescope Driver (HKLM\...\{B2920232-19DA-44FC-835F-68E427EAE2CE}) (Version: 10.30.09 - PixArt)
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.340 - TuneUp Software) Hidden
Unity Web Player (HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Unity Web Player (HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
VCRedistSetup (Version: 1.0.0 - Nero AG) Hidden
VIA Display Vista Driver 7.14.14.0019 (HKLM\...\VIA Chrome9 HC IGP Family Windows Vista Display) (Version:  - )
ViewNX 2 (HKLM\...\{DDD62492-32A7-412B-8AF1-2CF032AD42E3}) (Version: 2.0.2 - Nikon)
Vista Buttons (HKLM\...\Vista Buttons) (Version:  - )
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 1.0.3 (HKLM\...\VLC media player) (Version: 1.0.3 - VideoLAN Team)
Windows Movie Maker 2.6 (HKLM\...\{B3DAF54F-DB25-4586-9EF1-96D24BB14088}) (Version: 2.6.4040.0 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinMerge 2.14.0 (HKLM\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Markus\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{9E385F0A-0BA2-430C-96AA-4399C5E40F6C}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{DCA74850-096D-40CD-BB81-17034E51ACB6}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)

==================== Restore Points  =========================

15-01-2015 22:01:55 Windows Update
09-02-2015 21:37:57 Revo Uninstaller's restore point - TuneUp Utilities 2014
09-02-2015 21:39:37 TuneUp Utilities 2014 wird entfernt
09-02-2015 22:21:42 TuneUp Utilities 2014 (de-DE) wird entfernt
11-02-2015 23:01:59 Revo Uninstaller's restore point - PokerStars
12-02-2015 21:47:39 Windows Update
14-02-2015 18:20:20 Windows Update
14-02-2015 19:12:42 Revo Uninstaller's restore point - Positive Finds
14-02-2015 20:30:57 Windows-Modulinstallation
14-02-2015 20:53:57 Windows-Modulinstallation
14-02-2015 21:25:18 Windows Update
14-02-2015 21:27:23 Windows Update
14-02-2015 21:28:51 Windows Update
14-02-2015 22:19:07 Revo Uninstaller's restore point - Cliqz
14-02-2015 22:24:53 Revo Uninstaller's restore point - Mozilla Firefox 35.0.1 (x86 de)
14-02-2015 22:27:05 Revo Uninstaller's restore point - Mozilla Firefox 35.0.1 (x86 de)
15-02-2015 01:44:06 Revo Uninstaller's restore point - Free Video Flip and Rotate version 1.0.9.128
15-02-2015 02:02:05 Removed Java 8 Update 31
15-02-2015 02:09:15 Revo Uninstaller's restore point - SPAMfighter
15-02-2015 02:19:28 Revo Uninstaller's restore point - TuneUp Utilities 2014
15-02-2015 11:42:03 Windows Update
15-02-2015 12:37:39 Revo Uninstaller's restore point - Spyware Terminator 2015
15-02-2015 12:50:05 Revo Uninstaller's restore point - Unknown Device Identifier 8.02
15-02-2015 12:52:35 Revo Uninstaller's restore point - Avira Free Antivirus
15-02-2015 13:02:59 Revo Uninstaller's restore point - Avira
15-02-2015 13:10:20 Installed AVG 2015
15-02-2015 13:11:10 Installed AVG 2015
15-02-2015 13:29:11 AVG PC TuneUp 2015 wird installiert
17-02-2015 20:25:18 Revo Uninstaller's restore point - QuickShare

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2010-09-13 10:59 - 00000084 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1 activate.adobe.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {09471F20-FD55-424B-B232-22A8CB9DC56A} - System32\Tasks\SSBkgdUpdate => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {14846EF2-E82B-4CDC-BD45-9346356AC093} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2658DD86-9544-4AE6-B39B-9721808D75D3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {26B95428-CF05-44B7-AD40-0952428CE304} - \RealPlayer (32-bit)  No Task File <==== ATTENTION
Task: {274852B8-7817-48D8-9F28-EE411B7533EB} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {2A7EEA82-47D3-438D-8D67-23C614EA6698} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {2B615096-2F25-4E67-BDB0-43600AC27D72} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {647382CB-357D-41F2-ABF9-96E0DAE8093B} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {6F58BCD1-5997-4E6F-A747-F34783FCD821} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-10-05] (Google)
Task: {72ECFFA9-864E-4F56-8032-4E192B5F5847} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\AVG\AVG PC TuneUp\OneClick.exe [2015-02-12] (AVG Technologies)
Task: {865349A1-A41D-42AF-BF8B-611CA59F6C66} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {C8ED3C47-480E-449E-9F92-EB8355B58B74} - System32\Tasks\{44BB347D-5325-4066-889A-0D3485C6D0C3} => pcalua.exe -a C:\Users\Markus\Downloads\Programme\Setups\RealPlayer11GOLD_de.exe -d C:\Users\Markus\Downloads\Programme\Setups
Task: {CCD703E9-A2B2-4108-B868-CF9158978AA8} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {CDA52374-F8C6-41F3-8F88-E6ABDFE6558D} - System32\Tasks\4808 => Wscript.exe C:\Users\Markus\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {D2DA80A2-B768-468A-9A41-91B1049E36F3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {D6D9BCA2-2E85-4DD4-B7A4-0A58AD0383BD} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {DF755FFE-5AF1-4FC8-A997-F0A108E15C02} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {ED48265D-3C70-4564-96FC-2933644DF1CE} - \GoforFilesUpdate No Task File <==== ATTENTION
Task: {FEBCEBF5-82C0-4939-B2AB-992D840CEC29} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Google Software Updater.job => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{69D37424-7323-4CD9-9909-D30D85007A62}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) ==============

2012-05-05 13:23 - 2011-02-07 08:56 - 00138192 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
2012-11-29 20:31 - 2012-11-29 20:31 - 00038608 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2008-06-26 05:36 - 2007-01-09 10:25 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2015-02-12 17:39 - 2015-02-12 17:39 - 00604984 _____ () C:\Program Files\AVG\AVG PC TuneUp\avgreplibx.dll
2008-11-07 11:31 - 2007-09-20 18:34 - 00129024 _____ () C:\Program Files\WinRAR\rarext.dll
2015-02-12 17:39 - 2015-02-12 17:39 - 00728888 _____ () C:\Program Files\AVG\AVG PC TuneUp\tulngx.dll
2008-06-25 13:36 - 2006-05-29 12:40 - 00266240 _____ () C:\Windows\System32\ESB.EXE
2015-01-29 22:05 - 2015-01-29 22:05 - 03925104 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-12-03 19:06 - 2014-12-03 19:06 - 00057856 _____ () C:\Program Files\Adobe\Reader 10.0\Reader\Locale\de_de\brdlang32.DEU
2014-08-25 20:18 - 2014-12-11 20:44 - 09498624 _____ () C:\Users\Markus\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_rdlang32.deu
2012-07-27 21:51 - 2012-07-27 21:51 - 06549432 _____ () C:\Program Files\Adobe\Reader 10.0\Reader\authplay.dll
2014-08-25 20:18 - 2014-12-11 21:27 - 03066880 _____ () C:\Users\Markus\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_Annots.DEU
2014-12-03 19:06 - 2014-12-03 19:06 - 00305544 _____ () C:\Program Files\Adobe\Reader 10.0\Reader\sqlite.dll
2014-08-25 20:19 - 2014-12-11 21:28 - 00014336 _____ () C:\Users\Markus\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_Updater.DEU

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\img24.jpg
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\img24.jpg
HKU\S-1-5-21-349582430-969671104-3874210206-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\img24.jpg
HKU\S-1-5-21-349582430-969671104-3874210206-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\img24.jpg
HKU\S-1-5-21-349582430-969671104-3874210206-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\img24.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk => C:\Windows\pss\Adobe Gamma Loader.exe.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk => C:\Windows\pss\Adobe Gamma Loader.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^tele.ring Mobile Internet.lnk => C:\Windows\pss\tele.ring Mobile Internet.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS5.5ServiceManager => "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: AdobeCS5ServiceManager => "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: ArcSoft Connection Service => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
MSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
MSCONFIG\startupreg: DivX Download Manager => "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe -s
MSCONFIG\startupreg: PDFPrint => C:\Program Files\pdf24\pdf24.exe

==================== Accounts: =============================

Administrator (S-1-5-21-349582430-969671104-3874210206-500 - Administrator - Disabled)
Beruf (S-1-5-21-349582430-969671104-3874210206-1002 - Administrator - Enabled) => C:\Users\Beruf
Gast (S-1-5-21-349582430-969671104-3874210206-501 - Limited - Disabled)
Markus (S-1-5-21-349582430-969671104-3874210206-1000 - Administrator - Enabled) => C:\Users\Markus

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (02/18/2015 08:40:01 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86

Error: (02/18/2015 08:36:37 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: tcpipBM

Error: (02/18/2015 08:36:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (02/18/2015 08:35:57 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner Fehler ist im Speicher-Manager aufgetreten.

Error: (02/18/2015 08:35:01 PM) (Source: Dhcp) (EventID: 1002) (User: )
Description: Die IP-Adresslease 192.168.1.3 für die Netzwerkkarte mit der Netzwerkadresse 0015AFD3CC7A wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2015-02-19 03:45:02.904
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-19 03:45:01.023
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-19 03:44:59.439
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-19 03:44:58.139
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-19 03:44:56.902
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-19 03:44:55.216
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-19 03:44:53.875
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-19 03:44:52.579
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-19 03:44:50.871
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-19 03:44:49.342
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Genuine Intel(R) CPU T1500 @ 1.86GHz
Percentage of memory in use: 66%
Total physical RAM: 2813.4 MB
Available physical RAM: 943.89 MB
Total Pagefile: 5875.32 MB
Available Pagefile: 3481.24 MB
Total Virtual: 2047.88 MB
Available Virtual: 1914.59 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:204.99 GB) (Free:47.25 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:27.88 GB) (Free:21.06 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: B641FCBA)
Partition 1: (Active) - (Size=205 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=27.9 GB) - (Type=0C)

==================== End Of Log ============================

--- --- ---

Hallo Schrauber!

Mittels dem Scanner Eset wurden keine Daten gelöscht. Ist das so richtig oder hätten die defekten Dateien gelöscht werden sollen?

Die Fehler verzerrte Schrift bei Google und verzerrte Schrift bei Email sind noch immer.

Danke für die Hilfe, Schrauber!

[IMG]desktop/Bild 1.jpg[/IMG]

schrauber · 19.02.2015, 17:43

Email im Browser oder Mailprogramm?

RedHot1982 · 19.02.2015, 21:17

Emails in "Windows Mail".

Wie kann man Fotos hochladen, damit du sehen kannst, wie es aussieht?

Lg

schrauber · 20.02.2015, 10:42

Unten auf Erweitert klicken, dann auf Anhänge verwalten.

RedHot1982 · 20.02.2015, 21:15

Hallo!

Hier ein Foto vom Mail-Programm (die Schrift in der Mail ist verzerrt).
Die Schrift vom Suchergebnis von Google wirkt ausgefranzt.

RedHot1982 · 20.02.2015, 21:18

Hallo Schrauber!

Der Online-Scanner Eset hat ja ein paar Fehler gefunden.
Diese wurden jedoch von mir nicht gelöscht, da dies in der Anleitung auch nicht erwähnt wurde.

Soll der Scan nochmals durchgeführt werden und die Fehler gelöscht werden?

Danke für die Info!

schrauber · 21.02.2015, 14:09

Nee machen wir jetzt:

Download Ordner leeren.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Users\Markus\Desktop\Alte Firefox-Daten
Task: {26B95428-CF05-44B7-AD40-0952428CE304} - \RealPlayer (32-bit)  No Task File <==== ATTENTION

Task: {647382CB-357D-41F2-ABF9-96E0DAE8093B} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION

Task: {CDA52374-F8C6-41F3-8F88-E6ABDFE6558D} - System32\Tasks\4808 => Wscript.exe C:\Users\Markus\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION

Task: {ED48265D-3C70-4564-96FC-2933644DF1CE} - \GoforFilesUpdate No Task File <==== ATTENTION
Hosts:
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schau mal ob dieses Update bei dir installiert ist:
KB3013455 (MS15-010) causes font corruption - Microsoft Community

RedHot1982 · 21.02.2015, 15:10

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-02-2015 01
Ran by Markus at 2015-02-21 14:57:33 Run:1
Running from C:\Users\Markus\Desktop
Loaded Profiles: Markus (Available profiles: Markus & Beruf)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Users\Markus\Desktop\Alte Firefox-Daten
Task: {26B95428-CF05-44B7-AD40-0952428CE304} - \RealPlayer (32-bit)  No Task File <==== ATTENTION

Task: {647382CB-357D-41F2-ABF9-96E0DAE8093B} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION

Task: {CDA52374-F8C6-41F3-8F88-E6ABDFE6558D} - System32\Tasks\4808 => Wscript.exe C:\Users\Markus\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION

Task: {ED48265D-3C70-4564-96FC-2933644DF1CE} - \GoforFilesUpdate No Task File <==== ATTENTION
Hosts:
Emptytemp:
*****************

C:\Users\Markus\Desktop\Alte Firefox-Daten => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{26B95428-CF05-44B7-AD40-0952428CE304}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{26B95428-CF05-44B7-AD40-0952428CE304}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RealPlayer (32-bit) " => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{647382CB-357D-41F2-ABF9-96E0DAE8093B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{647382CB-357D-41F2-ABF9-96E0DAE8093B}" => Key deleted successfully.
C:\Windows\System32\Tasks\0 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CDA52374-F8C6-41F3-8F88-E6ABDFE6558D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CDA52374-F8C6-41F3-8F88-E6ABDFE6558D}" => Key deleted successfully.
C:\Windows\System32\Tasks\4808 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4808" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{ED48265D-3C70-4564-96FC-2933644DF1CE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ED48265D-3C70-4564-96FC-2933644DF1CE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoforFilesUpdate" => Key deleted successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 748.9 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 14:59:00 ====

RedHot1982 · 21.02.2015, 15:18

Hallo Schrauber!

Das Update ist installiert - siehe Bild.

Danke für die Hilfe!

17.02.2015, 17:52	#4
schrauber /// the machine /// TB-Ausbilder	Positive Finds Add + Schrift verzerrt Richtig installiert kann davon nur MBAM sein, das einfach updaten. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

19.02.2015, 17:43	#8
schrauber /// the machine /// TB-Ausbilder	Positive Finds Add + Schrift verzerrt Email im Browser oder Mailprogramm? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

20.02.2015, 10:42	#10
schrauber /// the machine /// TB-Ausbilder	Positive Finds Add + Schrift verzerrt Unten auf Erweitert klicken, dann auf Anhänge verwalten. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Positive Finds Add + Schrift verzerrt

Log-Analyse und Auswertung: Positive Finds Add + Schrift verzerrt