Win7: Avast meldet Bedrohung durch URL:Mal

MarkusIn · 22.03.2015, 21:39

Hallo!

Ich habe mir am Donnerstag bei einem Download einen Schädling eingefangen, da ich übers WE weg war erst heute mein Posting.

Avast Antivirus meldet häufig Bedrohungen "URL:Mal" wegen des Aufrufs von Webseiten durch die Prozesse firefox.exe und in den Container verschobene Schädlinge aus dem Prozess explorer.exe

Malwarebytes finet zwar einiges und verschiebts in den Container, aber der Schädling bleibt dennoch da...

Hier meine Logfiles

Malwarebytes vom Tag der Infizierung:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 19.03.2015
Suchlauf-Zeit: 21:23:26
Logdatei: mbam20140319.txt
Administrator: Ja

Version: 2.01.4.1018
Malware Datenbank: v2015.03.19.07
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7
CPU: x64
Dateisystem: NTFS
Benutzer: Markus

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 526870
Verstrichene Zeit: 43 Min, 24 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 4
PUP.Optional.Multiplug, HKU\S-1-5-21-3718451879-3267344302-3340637226-1000_Classes\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}, In Quarantäne, [ea79ca7d4149c76ff4e879a909fa19e7], 
PUP.Optional.Multiplug, HKU\S-1-5-21-3718451879-3267344302-3340637226-1000_Classes\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}, In Quarantäne, [ea79ca7d4149c76ff4e879a909fa19e7], 
PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{4820778D-AB0D-6D18-C316-52A6A0E1D507}, In Quarantäne, [aab96bdc2e5c2f0777860cc3d33054ac], 
PUP.Optional.EZDownloader.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0F44DC3A-6E62-4961-A14B-95323C512F9B}_is1, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 2
PUP.Optional.CoolSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://websearch.coolsearches.info/?pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85, Gut: (www.google.com), Schlecht: (hxxp://websearch.coolsearches.info/?pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85),Ersetzt,[273ca2a5b2d8f73f3238d11141c49967]
PUP.Optional.CoolSearches.A, HKU\S-1-5-21-3718451879-3267344302-3340637226-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://websearch.coolsearches.info/?pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85, Gut: (www.google.com), Schlecht: (hxxp://websearch.coolsearches.info/?pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85),Ersetzt,[31320b3c15753501e88302e0b5502ad6]

Ordner: 3
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.Multiplug, C:\Program Files (x86)\youtubeadblocker, In Quarantäne, [7ce7ab9c503a270fe0baf0838d7650b0], 
PUP.Optional.EZDownloader, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZDownloader, In Quarantäne, [bda6083fe3a75fd7e3a19afadc27ce32], 

Dateien: 17
PUP.Optional.Multiplug, C:\Users\Markus\AppData\Local\Temp\9C30\temp\SWA-Augsburg.rar(1).exe, In Quarantäne, [ea79ca7d4149c76ff4e879a909fa19e7], 
PUP.Optional.EZDownloader.A, C:\Users\Markus\AppData\Local\Temp\9C30\temp\EzDownloader_setup.exe, In Quarantäne, [eb78d6718bff61d5ff1b27f9aa5658a8], 
PUP.Optional.MultiPlug.A, C:\Users\Markus\AppData\Local\Temp\9C30\temp\hpds_setup.exe, In Quarantäne, [263daf985d2d0d29d0f980cdf30f3bc5], 
PUP.Optional.WebSearch.A, C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\17gchymk.default\searchplugins\WebSearch.xml, In Quarantäne, [283bf156b3d73600cc0d1ed89b68b44c], 
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader\EZDownloader.Core.dll, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader\EZDownloader.exe, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader\EZDownloader.exe.config, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader\EZDownloader.Extension.dll, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader\EZDownloader.Spider.dll, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader\ICSharpCode.SharpZipLib.dll, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader\Interop.SHDocVw.dll, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader\TabStrip.dll, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader\unins000.dat, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.EZDownloader.A, C:\Program Files (x86)\EZDownloader\unins000.exe, In Quarantäne, [9fc44ef9afdb1323a2eb5f1225de45bb], 
PUP.Optional.EZDownloader, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZDownloader\EZDownloader.lnk, In Quarantäne, [bda6083fe3a75fd7e3a19afadc27ce32], 
PUP.Optional.CoolSearches.A, C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\17gchymk.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://websearch.coolsearches.info/?pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85");), Ersetzt,[6cf74cfb7614a3938c2744e54db904fc]
PUP.Optional.CoolSearches.A, C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\17gchymk.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://websearch.coolsearches.info/?pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85&l=1&q=");), Ersetzt,[d48faa9d0e7cad8995202cfdbe48de22]

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

und vom heutigen Tag:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 22.03.2015
Suchlauf-Zeit: 19:40:39
Logdatei: mbam20140322.txt
Administrator: Nein

Version: 2.01.4.1018
Malware Datenbank: v2015.03.22.05
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7
CPU: x64
Dateisystem: NTFS
Benutzer: Markus normal

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 394017
Verstrichene Zeit: 26 Min, 21 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 11
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\CLSID\{e64966ff-80bb-42d0-b1d3-7383043b5b91}, , [7b1256f2bfcb56e0ff5b112741c16d93], 
PUP.Optional.Multiplug, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{E64966FF-80BB-42D0-B1D3-7383043B5B91}, , [7b1256f2bfcb56e0ff5b112741c16d93], 
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\Pe64966ff_80bb_42d0_b1d3_7383043b5b91_.Pe64966ff_80bb_42d0_b1d3_7383043b5b91_, , [7b1256f2bfcb56e0ff5b112741c16d93], 
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\Pe64966ff_80bb_42d0_b1d3_7383043b5b91_.Pe64966ff_80bb_42d0_b1d3_7383043b5b91_.9, , [7b1256f2bfcb56e0ff5b112741c16d93], 
PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Pe64966ff_80bb_42d0_b1d3_7383043b5b91_.Pe64966ff_80bb_42d0_b1d3_7383043b5b91_, , [7b1256f2bfcb56e0ff5b112741c16d93], 
PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Pe64966ff_80bb_42d0_b1d3_7383043b5b91_.Pe64966ff_80bb_42d0_b1d3_7383043b5b91_.9, , [7b1256f2bfcb56e0ff5b112741c16d93], 
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\WOW6432NODE\Pe64966ff_80bb_42d0_b1d3_7383043b5b91_.Pe64966ff_80bb_42d0_b1d3_7383043b5b91_, , [7b1256f2bfcb56e0ff5b112741c16d93], 
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\WOW6432NODE\Pe64966ff_80bb_42d0_b1d3_7383043b5b91_.Pe64966ff_80bb_42d0_b1d3_7383043b5b91_.9, , [7b1256f2bfcb56e0ff5b112741c16d93], 
PUP.Optional.Multiplug, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{E64966FF-80BB-42D0-B1D3-7383043B5B91}, , [7b1256f2bfcb56e0ff5b112741c16d93], 
PUP.Optional.Multiplug, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{E64966FF-80BB-42D0-B1D3-7383043B5B91}, , [7b1256f2bfcb56e0ff5b112741c16d93], 
PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\CLSID\{E64966FF-80BB-42D0-B1D3-7383043B5B91}\INPROCSERVER32, , [7b1256f2bfcb56e0ff5b112741c16d93], 

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 1
PUP.Optional.Multiplug, C:\Program Files (x86)\SAlePluos\PWt3L5fVM0Ttou.x64.dll, , [7b1256f2bfcb56e0ff5b112741c16d93], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

FRST:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Markus (administrator) on DELL-MARKUS on 22-03-2015 20:29:50
Running from C:\Users\Markus normal\Downloads
Loaded Profiles: Markus & Markus normal (Available profiles: Markus & Markus normal & Antje)
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Spotify Ltd) C:\Users\Markus normal\AppData\Roaming\Spotify\SpotifyWebHelper.exe
() C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
() C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8158240 2009-10-06] (Realtek Semiconductor)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [462712 2012-03-09] ()
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2009-09-30] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-05-17] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM\...\RunOnce: [*WerKernelReporting] => C:\Windows\SYSTEM32\WerFault.exe [415232 2009-07-14] (Microsoft Corporation)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2015-03-17] (Malwarebytes Corporation)
HKLM-x32\...\RunOnce: [20150107] => C:\Program Files\AVAST Software\Avast\setup\emupdate\bd4100c8-5ea3-4646-a811-66803dfc6dcc.exe [183232 2015-03-17] (AVAST Software)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3718451879-3267344302-3340637226-1000\...\RunOnce: [Install Spybot - Search & Destroy] => "C:\Zwischenablage\Kursbuch 2014\VGF Fichtelgebirge\spybot-2.4.exe"
HKU\S-1-5-21-3718451879-3267344302-3340637226-1000\...\MountPoints2: I - I:\pushinst.exe
HKU\S-1-5-21-3718451879-3267344302-3340637226-1000\...\MountPoints2: {120ec3a8-91d2-11e0-9e82-806e6f6e6963} - D:\Setup.exe
HKU\S-1-5-21-3718451879-3267344302-3340637226-1000\...\MountPoints2: {9799e649-91d2-11e0-b9f5-d6c915e512fa} - I:\pushinst.exe
HKU\S-1-5-21-3718451879-3267344302-3340637226-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\traffic.scr [2646016 2008-05-08] (Gödény)
HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844144 2013-02-13] (Samsung)
HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\...\Run: [Spotify Web Helper] => C:\Users\Markus normal\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1964088 2015-03-19] (Spotify Ltd)
HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [2874048 2015-02-19] (Valve Corporation)
HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\...\Run: [Spotify] => C:\Users\Markus normal\AppData\Roaming\Spotify\Spotify.exe [6701624 2015-03-19] (Spotify Ltd)
HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [477696 2009-07-14] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Program Files (x86)\Digital Line Detect\DLG.exe (Avanquest Software )
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA3100 Setup-Assistent.lnk
ShortcutTarget: NETGEAR WNA3100 Setup-Assistent.lnk -> C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe ()
Startup: C:\Users\Antje\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe (No File)
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OBS.rar.lnk
ShortcutTarget: OBS.rar.lnk -> C:\ProgramData\{b266e951-bba3-7576-b266-6e951bbaa546}\OBS.rar.exe ()
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OMSI Addon Manager.lnk
ShortcutTarget: OMSI Addon Manager.lnk -> C:\OMSI Addon Manager\OMSI Addon Manager.exe (Jan Kiesewalter)
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SWA-Augsburg.rar(1).lnk
ShortcutTarget: SWA-Augsburg.rar(1).lnk -> C:\ProgramData\{345c49c3-095d-ad04-345c-c49c3095270c}\SWA-Augsburg.rar(1).exe ()
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SWA-Augsburg.rar.lnk
ShortcutTarget: SWA-Augsburg.rar.lnk -> C:\ProgramData\{a8f1fcfc-9999-6020-a8f1-1fcfc999f3f2}\SWA-Augsburg.rar.exe ()
Startup: C:\Users\Markus normal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [1TortoiseNormal] -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [2TortoiseModified] -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [3TortoiseConflict] -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [4TortoiseLocked] -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [5TortoiseReadOnly] -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [6TortoiseDeleted] -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [7TortoiseAdded] -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [8TortoiseIgnored] -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [9TortoiseUnversioned] -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File
ShellIconOverlayIdentifiers-x32: [1TortoiseNormal] -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [2TortoiseModified] -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [3TortoiseConflict] -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [4TortoiseLocked] -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [5TortoiseReadOnly] -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [6TortoiseDeleted] -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [7TortoiseAdded] -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [8TortoiseIgnored] -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [9TortoiseUnversioned] -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
BootExecute: autocheck autochk * sdnclean64.exeaswBoot.exe /M:10b8e3454 /wow /dir:"C:\Program Files\AVAST Software\Avast"
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-3718451879-3267344302-3340637226-1000] => localhost:8080
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-3718451879-3267344302-3340637226-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-3718451879-3267344302-3340637226-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKU\S-1-5-21-3718451879-3267344302-3340637226-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKLM-x32 -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.coolsearches.info/?l=1&q={searchTerms}&pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85
SearchScopes: HKLM-x32 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.coolsearches.info/?l=1&q={searchTerms}&pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85
SearchScopes: HKU\S-1-5-21-3718451879-3267344302-3340637226-1000 -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.coolsearches.info/?l=1&q={searchTerms}&pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85
SearchScopes: HKU\S-1-5-21-3718451879-3267344302-3340637226-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKU\S-1-5-21-3718451879-3267344302-3340637226-1000 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.coolsearches.info/?l=1&q={searchTerms}&pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-12-20] (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-12-20] (AVAST Software)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-06-19] (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\17gchymk.default
FF DefaultSearchEngine: WebSearch
FF DefaultSearchEngine,S: WebSearch
FF DefaultSearchUrl: hxxp://websearch.coolsearches.info/?pid=2832&r=2015/03/19&hid=7950613740199815002&lg=EN&cc=DE&unqvl=85&l=1&q=
FF SearchEngineOrder.1: WebSearch
FF SearchEngineOrder.1,S: WebSearch
FF SelectedSearchEngine: WebSearch
FF SelectedSearchEngine,S: WebSearch
FF SearchEngineOrder.1,S: WebSearch
FF DefaultSearchEngine,S: WebSearch
FF SelectedSearchEngine,S: WebSearch
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-05] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-06-19] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-06-19] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\cgpcfg.dll [2008-08-16] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll [2008-08-16] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll [2008-08-16] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll [2008-08-16] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ctxmui.dll [2008-08-16] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\icafile.dll [2008-08-16] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\icalogon.dll [2008-08-16] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\msvcm80.dll [2008-05-21] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\msvcp80.dll [2008-05-21] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\msvcr80.dll [2008-05-21] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll [2008-08-16] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\sslsdk_b.dll [2008-06-05] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll [2008-08-16] (Citrix Systems, Inc.)
FF Extension: YoutubeAdblocker - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\17gchymk.default\Extensions\iou1oazgx@iojoae-.edu [2014-01-15]
FF Extension: SNT - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\17gchymk.default\Extensions\jeecvqxj@gaoaeaoe.net [2014-01-15]
FF Extension: BlOckTheAdApp - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\17gchymk.default\Extensions\wc_oy@kprlyioao.org [2014-03-04]
FF Extension: ggreatsavEr - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\17gchymk.default\Extensions\yauiya@gdhh.org [2014-01-15]
FF Extension: Ask Toolbar - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\17gchymk.default\Extensions\toolbar_SGT2-V7@apn.ask.com.xpi [2014-01-02]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-03-22]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-06-08]
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ggreatsavEr) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjlkcjombehlagangnhhegfnicinenem [2014-01-15]
CHR Extension: (YoutubeAdblocker) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckiklcfkiceddhlobjmibkfabmjcfhjg [2014-01-15]
CHR Extension: (YTBookkMarrk) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\elbedljklcjiepmpafidlpnpkeihoopg [2014-01-15]
CHR Extension: (i2Symbol  Emoticons Smileys Symbols) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\gponajbpomilcmbmfoipobkikeopjjhp [2014-01-15]
CHR Extension: (SNT) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\likoflfhaikdebmkmohmcoopnagaippk [2014-01-15]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-20]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-04-15]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-20] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-20] (Avast Software)
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
R2 WSWNA3100; C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [285152 2010-08-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-20] ()
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [28504 2012-03-07] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-20] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-20] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-20] ()
S3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [79872 2009-06-10] (AVM GmbH)
S3 FXUSBASE; C:\Windows\System32\DRIVERS\fxusbase.sys [694272 2009-06-10] (AVM Berlin)
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37456 2011-03-28] (Paragon Software Group)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-03-19] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 NPF; C:\Windows\System32\DRIVERS\npf.sys [47632 2010-02-03] (CACE Technologies, Inc.)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-06-27] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-06-27] (RapidSolution Software AG)
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [53840 2011-03-28] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [528464 2011-03-28] (Paragon)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-20] (Avast Software)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-22 20:29 - 2015-03-22 20:30 - 00025632 _____ () C:\Users\Markus normal\Downloads\FRST.txt
2015-03-22 20:29 - 2015-03-22 20:29 - 00000000 ____D () C:\FRST
2015-03-22 20:28 - 2015-03-22 20:28 - 02095616 _____ (Farbar) C:\Users\Markus normal\Downloads\FRST64.exe
2015-03-22 20:28 - 2015-03-22 20:28 - 00000474 _____ () C:\Users\Markus normal\Downloads\defogger_disable.log
2015-03-22 20:28 - 2015-03-22 20:28 - 00000000 _____ () C:\Users\Markus\defogger_reenable
2015-03-22 20:27 - 2015-03-22 20:27 - 00050477 _____ () C:\Users\Markus normal\Downloads\Defogger(1).exe
2015-03-22 20:21 - 2015-03-22 20:21 - 00005812 _____ () C:\Users\Markus normal\Desktop\mbam20140319.txt
2015-03-22 20:20 - 2015-03-22 20:20 - 00000197 _____ () C:\Windows\system32\2015-03-22-19-20-42.013-AvastVBoxSVC.exe-2224.log
2015-03-22 20:09 - 2015-03-22 20:09 - 00003094 _____ () C:\Users\Markus normal\Desktop\mbam20140322.txt
2015-03-22 20:00 - 2015-03-22 20:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-22 19:48 - 2015-03-22 19:48 - 00050477 _____ () C:\Users\Markus normal\Downloads\Defogger.exe
2015-03-22 19:21 - 2015-03-22 19:21 - 00000197 _____ () C:\Windows\system32\2015-03-22-18-21-08.052-AvastVBoxSVC.exe-2584.log
2015-03-19 23:10 - 2015-03-19 23:10 - 00000000 ____D () C:\Windows\system32\SPReview
2015-03-19 23:05 - 2015-03-19 23:05 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-03-19 23:05 - 2015-03-19 23:05 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-03-19 23:05 - 2015-03-19 23:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-03-19 23:05 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-03-19 23:00 - 2015-03-19 23:00 - 00000197 _____ () C:\Windows\system32\2015-03-19-22-00-10.020-AvastVBoxSVC.exe-880.log
2015-03-19 22:57 - 2015-03-19 22:57 - 00000085 _____ () C:\Windows\wininit.ini
2015-03-19 22:51 - 2015-03-19 22:51 - 00000000 ____D () C:\Users\Markus normal\Mozilla
2015-03-19 22:24 - 2015-03-19 22:24 - 00000197 _____ () C:\Windows\system32\2015-03-19-21-24-26.019-AvastVBoxSVC.exe-2548.log
2015-03-19 21:22 - 2015-03-19 22:13 - 00000000 ____D () C:\Users\Markus\AppData\Local\TSVNCache
2015-03-19 21:22 - 2015-03-19 21:22 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-19 21:22 - 2015-03-19 21:22 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-19 21:22 - 2015-03-19 21:22 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Subversion
2015-03-19 21:22 - 2015-03-19 21:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-19 21:22 - 2015-03-19 21:22 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-19 21:22 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-19 21:22 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-19 21:22 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-19 21:17 - 2015-03-19 21:18 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Markus normal\Downloads\mbam-setup-2.1.4.1018.exe
2015-03-19 21:04 - 2015-03-19 21:05 - 00000197 _____ () C:\Windows\system32\2015-03-19-20-04-55.058-AvastVBoxSVC.exe-856.log
2015-03-19 19:03 - 2015-03-19 19:03 - 00022663 _____ () C:\Users\Markus normal\AppData\Local\recently-used.xbel
2015-03-19 18:44 - 2015-03-19 18:44 - 00000000 ____D () C:\Windows\SysWOW64\X86
2015-03-19 18:44 - 2015-03-19 18:44 - 00000000 ____D () C:\Windows\SysWOW64\AMD64
2015-03-19 18:44 - 2015-03-19 18:44 - 00000000 ____D () C:\ProgramData\{8a113944-36b7-929b-8a11-1394436be510}
2015-03-19 18:43 - 2015-03-22 20:25 - 00000000 ____D () C:\Program Files (x86)\SAlePluos
2015-03-19 18:43 - 2015-03-19 18:43 - 00000000 ____D () C:\ProgramData\ngnpbjcobhndjlaocninehdopmdpdchn
2015-03-19 18:43 - 2015-03-19 18:43 - 00000000 ____D () C:\ProgramData\16254360091666330921
2015-03-19 18:42 - 2015-03-19 18:42 - 00000280 _____ () C:\Windows\system32\2015-03-19-17-42-37.037-aswFe.exe-10060.log
2015-03-19 18:41 - 2015-03-19 18:41 - 00000000 ____D () C:\ProgramData\{345c49c3-095d-ad04-345c-c49c3095270c}
2015-03-19 18:40 - 2015-03-19 18:41 - 00000280 _____ () C:\Windows\system32\2015-03-19-17-40-58.037-aswFe.exe-9556.log
2015-03-19 18:10 - 2015-03-19 18:10 - 00000000 ____D () C:\ProgramData\{a8f1fcfc-9999-6020-a8f1-1fcfc999f3f2}
2015-03-19 18:09 - 2015-03-19 18:09 - 00000280 _____ () C:\Windows\system32\2015-03-19-17-09-11.047-aswFe.exe-7860.log
2015-03-19 18:09 - 2015-03-19 18:09 - 00000000 ____D () C:\ProgramData\{594582c6-e874-6d26-5945-582c6e870b1b}
2015-03-19 18:06 - 2015-03-19 18:06 - 00000000 ____D () C:\ProgramData\{b266e951-bba3-7576-b266-6e951bbaa546}
2015-03-19 18:05 - 2015-03-19 18:05 - 00000280 _____ () C:\Windows\system32\2015-03-19-17-05-32.098-aswFe.exe-7596.log
2015-03-19 18:04 - 2015-03-19 18:04 - 00000000 ____D () C:\ProgramData\{deb9036d-8038-c68b-deb9-9036d8030db6}
2015-03-19 18:03 - 2015-03-19 18:03 - 00000280 _____ () C:\Windows\system32\2015-03-19-17-03-49.013-aswFe.exe-6160.log
2015-03-19 17:35 - 2015-03-19 17:35 - 00000197 _____ () C:\Windows\system32\2015-03-19-16-35-03.066-AvastVBoxSVC.exe-2756.log
2015-03-18 17:14 - 2015-03-18 17:14 - 00000197 _____ () C:\Windows\system32\2015-03-18-16-14-08.032-AvastVBoxSVC.exe-2512.log
2015-03-17 18:01 - 2015-03-17 18:01 - 00000197 _____ () C:\Windows\system32\2015-03-17-17-01-07.039-AvastVBoxSVC.exe-4808.log
2015-03-16 17:17 - 2015-03-16 17:17 - 00000197 _____ () C:\Windows\system32\2015-03-16-16-17-42.098-AvastVBoxSVC.exe-2968.log
2015-03-15 10:55 - 2015-03-15 10:56 - 00000197 _____ () C:\Windows\system32\2015-03-15-09-55-48.039-AvastVBoxSVC.exe-2480.log
2015-03-15 08:55 - 2015-03-15 08:55 - 00000197 _____ () C:\Windows\system32\2015-03-15-07-55-54.071-AvastVBoxSVC.exe-2956.log
2015-03-14 22:38 - 2015-03-14 22:40 - 00000000 ____D () C:\075fea15b4b24470b9c9f924f064559f
2015-03-14 10:14 - 2015-03-14 10:15 - 00000197 _____ () C:\Windows\system32\2015-03-14-09-14-27.084-AvastVBoxSVC.exe-2704.log
2015-03-13 16:51 - 2015-03-13 16:51 - 00000197 _____ () C:\Windows\system32\2015-03-13-15-51-02.090-AvastVBoxSVC.exe-3736.log
2015-03-12 22:34 - 2015-03-12 22:34 - 00000197 _____ () C:\Windows\system32\2015-03-12-21-34-42.052-AvastVBoxSVC.exe-4304.log
2015-03-12 17:20 - 2015-03-12 17:20 - 00000197 _____ () C:\Windows\system32\2015-03-12-16-20-28.042-AvastVBoxSVC.exe-2604.log
2015-03-11 17:35 - 2015-03-11 17:35 - 00000197 _____ () C:\Windows\system32\2015-03-11-16-35-25.056-AvastVBoxSVC.exe-4124.log
2015-03-10 17:30 - 2015-03-10 17:30 - 00000197 _____ () C:\Windows\system32\2015-03-10-16-30-03.030-AvastVBoxSVC.exe-3592.log
2015-03-09 20:37 - 2015-03-15 21:52 - 00000000 ____D () C:\Users\Markus normal\AppData\Local\CrashDumps
2015-03-09 17:47 - 2015-03-09 17:48 - 00000197 _____ () C:\Windows\system32\2015-03-09-16-47-41.024-AvastVBoxSVC.exe-3044.log
2015-03-08 20:33 - 2015-03-08 20:33 - 00000197 _____ () C:\Windows\system32\2015-03-08-19-33-43.061-AvastVBoxSVC.exe-4112.log
2015-03-08 17:34 - 2015-03-08 17:34 - 00000197 _____ () C:\Windows\system32\2015-03-08-16-34-35.002-AvastVBoxSVC.exe-1324.log
2015-03-08 10:47 - 2015-03-08 10:48 - 00000197 _____ () C:\Windows\system32\2015-03-08-09-47-53.074-AvastVBoxSVC.exe-2768.log
2015-03-07 18:52 - 2015-03-07 18:52 - 00000197 _____ () C:\Windows\system32\2015-03-07-17-52-53.037-AvastVBoxSVC.exe-3968.log
2015-03-07 11:05 - 2015-03-07 11:05 - 06208736 _____ (Tim Kosse) C:\Users\Markus normal\Downloads\FileZilla_3.10.2_win32-setup.exe
2015-03-07 08:04 - 2015-03-07 08:04 - 00000197 _____ () C:\Windows\system32\2015-03-07-07-04-27.051-AvastVBoxSVC.exe-2580.log
2015-03-06 20:07 - 2015-03-06 20:07 - 00000197 _____ () C:\Windows\system32\2015-03-06-19-07-40.052-AvastVBoxSVC.exe-4396.log
2015-03-06 15:10 - 2015-03-06 15:10 - 00000197 _____ () C:\Windows\system32\2015-03-06-14-10-36.008-AvastVBoxSVC.exe-2148.log
2015-03-05 17:34 - 2015-03-05 17:34 - 00000197 _____ () C:\Windows\system32\2015-03-05-16-34-04.096-AvastVBoxSVC.exe-1432.log
2015-03-04 18:08 - 2015-03-22 20:13 - 00000000 ____D () C:\Users\Markus normal\AppData\Local\TSVNCache
2015-03-04 18:05 - 2015-03-04 18:06 - 00000197 _____ () C:\Windows\system32\2015-03-04-17-05-58.080-AvastVBoxSVC.exe-3516.log
2015-03-03 22:35 - 2015-03-03 22:35 - 00000000 ____D () C:\Users\Markus normal\AppData\Roaming\Subversion
2015-03-03 22:34 - 2015-03-03 22:34 - 06569984 _____ () C:\Users\Markus normal\Downloads\LanguagePack_1.8.10.26129-x64-de.msi
2015-03-03 22:33 - 2015-03-03 22:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TortoiseSVN
2015-03-03 22:33 - 2015-03-03 22:33 - 00000000 ____D () C:\Program Files\TortoiseSVN
2015-03-03 22:33 - 2015-03-03 22:33 - 00000000 ____D () C:\Program Files\Common Files\TortoiseOverlays
2015-03-03 22:31 - 2015-03-03 22:31 - 19464192 _____ () C:\Users\Markus normal\Downloads\TortoiseSVN-1.8.10.26129-x64-svn-1.8.11.msi
2015-03-03 22:31 - 2015-03-03 22:31 - 15560704 _____ () C:\Users\Markus normal\Downloads\TortoiseSVN-1.8.10.26129-win32-svn-1.8.11.msi
2015-03-03 22:30 - 2015-03-03 22:30 - 05255168 _____ () C:\Users\Markus normal\Downloads\LanguagePack_1.8.10.26129-win32-de.msi
2015-03-03 18:50 - 2015-03-03 18:51 - 00000197 _____ () C:\Windows\system32\2015-03-03-17-50-54.027-AvastVBoxSVC.exe-688.log
2015-03-03 17:41 - 2015-03-03 17:41 - 00000197 _____ () C:\Windows\system32\2015-03-03-16-41-11.071-AvastVBoxSVC.exe-3948.log
2015-03-02 18:10 - 2015-03-02 18:10 - 00000197 _____ () C:\Windows\system32\2015-03-02-17-10-08.042-AvastVBoxSVC.exe-3876.log
2015-03-01 09:12 - 2015-03-01 09:12 - 00000197 _____ () C:\Windows\system32\2015-03-01-08-12-23.002-AvastVBoxSVC.exe-2708.log
2015-02-28 18:57 - 2015-02-28 18:57 - 00000197 _____ () C:\Windows\system32\2015-02-28-17-57-09.031-AvastVBoxSVC.exe-1572.log
2015-02-28 18:51 - 2015-02-28 18:52 - 00275392 _____ () C:\Windows\Minidump\022815-49031-01.dmp
2015-02-28 16:41 - 2015-02-28 16:41 - 00000197 _____ () C:\Windows\system32\2015-02-28-15-41-01.005-AvastVBoxSVC.exe-3668.log
2015-02-28 08:50 - 2015-02-28 08:50 - 00000197 _____ () C:\Windows\system32\2015-02-28-07-50-40.062-AvastVBoxSVC.exe-1408.log
2015-02-27 15:16 - 2015-02-27 15:16 - 00000197 _____ () C:\Windows\system32\2015-02-27-14-16-41.052-AvastVBoxSVC.exe-4148.log
2015-02-26 21:03 - 2015-02-26 21:03 - 00084580 _____ () C:\Users\Markus normal\Downloads\DIN(1)
2015-02-26 10:08 - 2015-02-26 10:08 - 00000197 _____ () C:\Windows\system32\2015-02-26-09-08-42.060-AvastVBoxSVC.exe-3316.log
2015-02-25 19:29 - 2015-02-25 19:29 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-25 19:28 - 2015-02-25 19:28 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Markus normal\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-25 19:09 - 2015-02-25 19:09 - 00000197 _____ () C:\Windows\system32\2015-02-25-18-09-51.083-AvastVBoxSVC.exe-3120.log
2015-02-24 20:29 - 2015-02-24 20:29 - 00000197 _____ () C:\Windows\system32\2015-02-24-19-29-15.093-AvastVBoxSVC.exe-3736.log
2015-02-23 19:42 - 2015-02-23 19:42 - 00000197 _____ () C:\Windows\system32\2015-02-23-18-42-10.031-AvastVBoxSVC.exe-3224.log
2015-02-22 17:30 - 2015-02-22 17:30 - 00000197 _____ () C:\Windows\system32\2015-02-22-16-30-56.008-AvastVBoxSVC.exe-2188.log
2015-02-22 14:34 - 2015-02-22 14:40 - 00016861 _____ () C:\Users\Markus normal\Documents\Geburtstag Markus-1.ods
2015-02-22 14:33 - 2015-02-22 14:33 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.1.1.lnk
2015-02-22 14:33 - 2015-02-22 14:33 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-02-22 14:33 - 2015-02-22 14:33 - 00000000 ____D () C:\Users\Markus normal\AppData\Roaming\OpenOffice
2015-02-22 14:33 - 2015-02-22 14:33 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2015-02-22 14:28 - 2015-02-22 14:28 - 00000000 ____D () C:\Users\Markus normal\Desktop\OpenOffice 4.1.1 (de) Installation Files
2015-02-22 14:27 - 2015-02-22 14:28 - 164858324 _____ () C:\Users\Markus normal\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2015-02-22 10:43 - 2015-02-22 10:43 - 00000197 _____ () C:\Windows\system32\2015-02-22-09-43-16.058-AvastVBoxSVC.exe-1400.log
2015-02-21 18:31 - 2015-02-21 18:31 - 00000197 _____ () C:\Windows\system32\2015-02-21-17-31-49.076-AvastVBoxSVC.exe-3160.log
2015-02-21 14:16 - 2015-02-21 14:16 - 00000197 _____ () C:\Windows\system32\2015-02-21-13-16-05.091-AvastVBoxSVC.exe-3672.log
2015-02-21 09:51 - 2015-02-21 09:51 - 00000197 _____ () C:\Windows\system32\2015-02-21-08-51-20.046-AvastVBoxSVC.exe-2452.log
2015-02-20 21:32 - 2015-02-20 21:32 - 00001410 _____ () C:\Users\Markus normal\Desktop\gimp-2.8.exe - Verknüpfung.lnk
2015-02-20 15:19 - 2015-02-20 15:19 - 00000197 _____ () C:\Windows\system32\2015-02-20-14-19-12.070-AvastVBoxSVC.exe-4024.log
2015-02-20 15:19 - 2015-02-20 15:19 - 00000000 ____D () C:\Users\Markus normal\AppData\Local\Steam

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-22 20:28 - 2011-06-08 14:27 - 00000000 ____D () C:\Users\Markus
2015-03-22 20:25 - 2009-07-14 05:45 - 00019312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-22 20:25 - 2009-07-14 05:45 - 00019312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-22 20:24 - 2011-06-13 10:18 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-22 20:21 - 2012-09-07 15:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-22 20:21 - 2011-06-08 14:27 - 01265247 _____ () C:\Windows\WindowsUpdate.log
2015-03-22 20:19 - 2013-08-26 21:45 - 00000000 ____D () C:\Users\Markus normal\AppData\Roaming\Spotify
2015-03-22 20:19 - 2013-08-26 21:45 - 00000000 ____D () C:\Users\Markus normal\AppData\Local\Spotify
2015-03-22 20:13 - 2014-01-04 13:46 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-22 20:12 - 2011-06-13 10:18 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-22 20:12 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-22 20:12 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-22 20:12 - 2009-07-14 05:51 - 00130947 _____ () C:\Windows\setupact.log
2015-03-22 20:10 - 2011-06-08 17:57 - 00003974 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{2C2132E5-CE85-4399-9D18-12B1DBA7CDBD}
2015-03-22 20:04 - 2012-04-29 10:46 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-22 19:19 - 2012-07-07 07:37 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-03-19 23:06 - 2014-06-11 20:13 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-03-19 23:05 - 2014-06-11 20:13 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-03-19 23:02 - 2011-08-10 18:47 - 00000000 ____D () C:\Zwischenablage
2015-03-19 22:58 - 2011-06-08 16:05 - 00315712 _____ () C:\Windows\PFRO.log
2015-03-19 22:52 - 2011-07-11 20:06 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-19 22:51 - 2011-06-08 16:06 - 00000000 ____D () C:\Users\Markus normal
2015-03-19 22:14 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Registration
2015-03-19 19:38 - 2013-12-20 21:04 - 00000099 _____ () C:\Users\Public\LMDebug.log
2015-03-19 19:04 - 2014-08-22 21:01 - 00000000 ____D () C:\Users\Markus normal\.gimp-2.8
2015-03-19 19:01 - 2014-08-22 21:08 - 00000000 ____D () C:\Users\Markus normal\AppData\Local\gtk-2.0
2015-03-19 18:06 - 2013-08-26 21:45 - 00001848 _____ () C:\Users\Markus normal\Desktop\Spotify.lnk
2015-03-19 18:06 - 2013-08-26 21:45 - 00001834 _____ () C:\Users\Markus normal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-03-16 22:15 - 2011-06-12 21:10 - 00000000 ____D () C:\Users\Markus normal\Documents\OMSI
2015-03-16 19:23 - 2011-06-12 21:08 - 00000000 ____D () C:\Users\Markus normal\Documents\Histoliga
2015-03-15 20:50 - 2011-06-08 19:53 - 00000000 ____D () C:\Users\Markus normal\AppData\Roaming\FileZilla
2015-03-15 13:41 - 2011-06-12 21:09 - 00000000 ____D () C:\Users\Markus normal\Documents\Fahrplangeschichte(n)
2015-03-14 19:34 - 2011-12-23 17:36 - 00000000 ____D () C:\Users\Markus normal\Documents\Eigene Scans
2015-03-13 18:36 - 2012-12-30 11:40 - 00000000 ____D () C:\Users\Markus normal\Documents\Modellbahn
2015-03-11 23:05 - 2011-06-08 17:36 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-10 19:21 - 2011-06-12 21:09 - 00000000 ____D () C:\Users\Markus normal\Documents\Kirchenarbeit
2015-03-07 11:06 - 2011-06-08 19:48 - 00002004 _____ () C:\Users\Public\Desktop\FileZilla Client.lnk
2015-03-07 11:06 - 2011-06-08 19:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2015-03-07 11:06 - 2011-06-08 19:48 - 00000000 ____D () C:\Program Files (x86)\FileZilla FTP Client
2015-03-06 15:53 - 2013-10-26 13:18 - 00009760 _____ () C:\Users\Markus normal\Documents\spotify_fehlend.xlsx
2015-03-02 20:00 - 2011-06-12 21:07 - 00000000 ____D () C:\Users\Markus normal\Documents\PGR
2015-02-28 18:55 - 2011-06-19 08:18 - 00081048 _____ () C:\Users\Antje\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-28 18:51 - 2011-06-13 12:54 - 00000000 ____D () C:\Windows\Minidump
2015-02-28 18:51 - 2011-06-13 12:53 - 1146569123 _____ () C:\Windows\MEMORY.DMP
2015-02-27 15:15 - 2011-06-08 16:06 - 00081048 _____ () C:\Users\Markus normal\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-27 15:11 - 2009-07-14 05:45 - 00341088 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-26 10:03 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\addins
2015-02-25 20:04 - 2014-01-15 22:17 - 00000000 ____D () C:\ProgramData\SNT
2015-02-25 20:04 - 2014-01-15 21:55 - 00000000 ____D () C:\ProgramData\GReiautsaveer
2015-02-24 03:17 - 2011-06-08 15:59 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-22 14:32 - 2011-07-22 18:51 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3

==================== Files in the root of some directories =======

2013-03-17 15:52 - 2013-03-17 15:52 - 0049518 _____ () C:\Program Files (x86)\autoruns.chm
2013-07-31 12:08 - 2013-07-31 12:08 - 0661184 _____ (Sysinternals - www.sysinternals.com) C:\Program Files (x86)\autoruns.exe
2013-07-31 12:08 - 2013-07-31 12:08 - 0579264 _____ (Sysinternals - www.sysinternals.com) C:\Program Files (x86)\autorunsc.exe
2006-07-28 08:32 - 2006-07-28 08:32 - 0007005 _____ () C:\Program Files (x86)\Eula.txt
2014-05-31 10:01 - 2014-05-31 10:02 - 3739157 _____ () C:\Program Files (x86)\Paint.NET.3.5.11.Install.zip
2012-12-25 19:01 - 2010-01-24 15:13 - 0152848 _____ (Microsoft Corporation) C:\Program Files (x86)\Common Files\Comdlg32.ocx
2014-01-15 22:17 - 2014-01-15 22:17 - 0000323 _____ () C:\Users\Markus\AppData\Roaming\LiveSupport.exe_log.txt
2014-01-15 22:17 - 2014-01-15 22:20 - 0000092 _____ () C:\Users\Markus\AppData\Roaming\regsvr32.exe_log.txt
2011-06-13 10:37 - 2011-06-13 10:37 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2011-12-23 16:39 - 2011-12-23 16:51 - 0000309 _____ () C:\ProgramData\hpzinstall.log
2013-09-04 17:53 - 2013-09-04 17:53 - 0001534 _____ () C:\ProgramData\ss.ini

Files to move or delete:
====================
C:\Users\Markus normal\FileZilla_3.8.0_win32-setup.exe


Some content of TEMP:
====================
C:\Users\Antje\AppData\Local\Temp\Checkupdate.exe
C:\Users\Antje\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Antje\AppData\Local\Temp\Foxit Updater.exe
C:\Users\Antje\AppData\Local\Temp\gcapi_dll.dll
C:\Users\Antje\AppData\Local\Temp\gtapi_signed.dll
C:\Users\Markus\AppData\Local\Temp\ose00000.exe
C:\Users\Markus normal\AppData\Local\Temp\Checkupdate.exe
C:\Users\Markus normal\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Markus normal\AppData\Local\Temp\gcapi_dll.dll
C:\Users\Markus normal\AppData\Local\Temp\gtapi_signed.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-15 12:20

==================== End Of Log ============================

und die zugehörige Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Markus at 2015-03-22 20:30:39
Running from C:\Users\Markus normal\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

5D08 (HKLM\...\{d1e17d14-cabc-4f6f-9f46-c7ecf813645e}.sdb) (Version:  - )
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Flash Player 10 ActiveX (HKLM-x32\...\{B7B3E9B3-FB14-4927-894B-E9124509AF5A}) (Version: 10.0.32.18 - Adobe Systems, Inc.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Aerosoft's - Aerosoft Launcher (HKLM-x32\...\{EE11CFFC-898C-4875-8A63-8B732A9AD43B}) (Version: 1.2.0.3 - Aerosoft)
Aerosoft's - Aerosoft Launcher (HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\...\{EE11CFFC-898C-4875-8A63-8B732A9AD43B}) (Version: 1.2.0.3 - Aerosoft)
aerosoft's - OMSI 2 - Drei Generationen (HKLM-x32\...\{C88376AA-BF64-40F4-9AD6-F8A18DA394F2}) (Version: 1.00 - aerosoft)
aerosoft's - OMSI 2 - Hamburg (HKLM-x32\...\{5BF6B590-F7F5-46B5-B5F4-B0CA93423AD6}) (Version: 2.01 - aerosoft)
aerosoft's - OMSI 2 - Stadtbus O305 (HKLM-x32\...\{AE36259F-2F4F-44FA-87B7-3D1792ADDCA2}) (Version: 1.10 - aerosoft)
ATI AVIVO64 Codecs (Version: 11.6.0.50517 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{14AF193A-EC13-3B3E-BFBF-D2C471F12718}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
Audacity 1.3.13 (Unicode) (HKLM-x32\...\Audacity 1.3 Beta (Unicode)_is1) (Version:  - Audacity Team)
Audials (HKLM-x32\...\{2F27EAE9-0245-444A-8698-9832AFC3F1F8}) (Version: 10.2.27600.0 - Audials AG)
Avast Free Antivirus (HKLM-x32\...\avast) (Version: 10.0.2208 - AVAST Software)
Benutzerhandbuch anzeigen (HKLM-x32\...\View User Guide) (Version: 3.60.02.0 - )
Blender (HKLM\...\Blender) (Version: 2.69 - Blender Foundation)
Broadcom NetXtreme-I Netlink Driver and Management Installer (HKLM\...\{982E1601-0DFC-4FD3-A427-AC6570697858}) (Version: 12.55.01 - Broadcom Corporation)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
CamStudio (HKLM-x32\...\CamStudio) (Version:  - )
Canon Inkjet Printer Driver Add-On Module (HKLM\...\CANONIJINBOXADDON100) (Version:  - )
ccc-core-static (x32 Version: 2010.0517.1742.29870 - Ihr Firmenname) Hidden
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.8.2631 - CDBurnerXP)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
Citrix XenApp Web Plugin (HKLM-x32\...\{EBFEEB3F-3E3B-4725-A4E0-376144CE4F76}) (Version: 11.0.0.5357 - Citrix Systems, Inc.)
CloudReading (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.0.31.1111 - Foxit Corporation)
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
Das Fussball Studio 8.5.1 (HKLM-x32\...\{F804CEB4-747E-46D5-B8AB-C56E3BAF27D9}_is1) (Version: 8.5.1 - vmLOGIC - Volker Mallmann)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
Digital Line Detect (HKLM-x32\...\{E646DCF0-5A68-11D5-B229-002078017FBF}) (Version: 1.21 - BVRP Software, Inc)
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Dropbox (HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
FileZilla Client 3.10.2 (HKLM-x32\...\FileZilla Client) (Version: 3.10.2 - Tim Kosse)
Fotostadt - Book Uploader 4 sfx (HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\...\2cd33dad6803a304) (Version: 1.1.3.0 - Fotostadt)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.1.1031 - Foxit Corporation)
Free RAR Extract Frog (HKLM-x32\...\Free RAR Extract Frog) (Version: 3.23 - Philipp Winterberg)
Free YouTube Download version 3.2.2.430 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.2.430 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.11.33.1005 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.33.1005 - DVDVideoSoft Ltd.)
FreeRIP MP3 Converter 4.4 (HKLM-x32\...\{501451DE-5808-4599-B544-8BD0915B6B24}_is1) (Version: 4.4 - GreenTree Applications SRL)
Garmin Trip and Waypoint Manager v4 (HKLM-x32\...\{67B9AF41-C0B9-4960-84D9-A61D23DE85D8}) (Version: 4.0.0.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Earth Pro (HKLM-x32\...\{44FC61F0-2F8A-11E3-8CAE-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
GPSBabel 1.4.2 (HKLM-x32\...\{1B8FE958-A304-4902-BF7A-4E2F0F5B7017}_is1) (Version:  - GPSBabel)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Scanjet G4000 Series (HKLM\...\{10297E58-2DFE-478B-9A1D-4B14E4E79CDF}) (Version: 13.0 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
hpg4000 (x32 Version: 13.0.0.0 - Ihr Firmenname) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Inkscape 0.48.1  (HKLM-x32\...\Inkscape) (Version: 0.48.1 - )
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.0.1006 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.30 - Irfan Skiljan)
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Java(TM) 6 Update 26 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216026FF}) (Version: 6.0.260 - Oracle)
JavaFX 2.1.0 (HKLM-x32\...\{1111706F-666A-4037-7777-210328764D10}) (Version: 2.1.0 - Oracle Corporation)
JMRI - Java Model Railroad Interface (HKLM-x32\...\JMRI) (Version: 3.10-r27895 - JMRI Community)
KMLManager (HKLM-x32\...\{3862C8AC-033E-4C89-8F44-3C8098D06446}) (Version: 1.0.0 - mchme)
LAME v3.98.3 for Audacity (HKLM-x32\...\LAME for Audacity_is1) (Version:  - )
Loksim3D (HKLM\...\Loksim3D_is1) (Version: 2.8.1 - Loksim3D)
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
MapCreator 2 (HKLM-x32\...\MapCreator 2) (Version: 2.0 - primap software)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 36.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 de)) (Version: 36.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird (3.1.11) (HKLM-x32\...\Mozilla Thunderbird (3.1.11)) (Version: 3.1.11 (de) - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser und SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Müller Foto (HKLM-x32\...\Müller Foto) (Version: 5.1.2 - CEWE COLOR AG u Co. OHG)
NETGEAR WNA3100 wireless USB 2.0 adapter (HKLM-x32\...\{C2425F91-1F7B-4037-9A05-9F290184798D}) (Version: 1.01.206 - NETGEAR)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
OMSI - Der Omnibussimulator (HKLM-x32\...\{9AE850A4-B89D-4875-A159-B1B64D717EFB}) (Version: 1.06 - aerosoft)
OMSI - Der Omnibussimulator (HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\...\{9AE850A4-B89D-4875-A159-B1B64D717EFB}) (Version: 1.00 - aerosoft)
OMSI - Stadtbus O305 (HKLM-x32\...\{3EF2A817-4ADC-46F7-8441-46DFCE158D72}) (Version: 1.00 - aerosoft)
OMSI 2 (HKLM-x32\...\Steam App 252530) (Version:  - MR-Software GbR)
OMSI Addon Manager Version 1.2.4 (HKLM-x32\...\{32B08666-1587-435D-988C-7958A04B218A}_is1) (Version: 1.2.4 - Jan Kiesewalter)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
OSM World Routable (HKLM-x32\...\OSM World Routable) (Version:  - )
Paint.NET v3.5.11 (HKLM\...\{72EF03F5-0507-4861-9A44-D99FD4C41418}) (Version: 3.61.0 - dotPDN LLC)
Paragon Backup & Recovery™ 2011 Free (HKLM-x32\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.4.2 - Frank Heindörfer, Philip Chinery)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PicGrab 2.8.0 (HKLM-x32\...\PicGrab_is1) (Version: 2.8.0 - Benjamin Mussler)
Pivot Stickfigure Animator (HKLM-x32\...\{BEAD39CD-901D-4267-8B8B-EAA83CB4B70D}) (Version: 2.2.5 - Peter Bone)
PixiePack Codec Pack (HKLM-x32\...\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}) (Version: 1.1.1200.0 - None)
Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: 5.1.6 - CEWE Stiftung u Co. KGaA)
psynetic® Gif-X 2.50 (HKLM-x32\...\psynetic® Gif-X) (Version: 2.50 - Robert Mundt)
PTraffic Pro 0.9.12 (HKLM-x32\...\{5408DEB6-F7A1-4475-8CE6-DAB45582BE63}_is1) (Version:  - Jörg Siebrands)
QIP 2012 4.0.7221 (HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\...\QIP 2012) (Version: 4.0.7221 - )
Radiotracker (HKLM-x32\...\{A8BB05BC-2C4A-4178-A819-64B8F5392960}) (Version: 6.2.13700.0 - RapidSolution Software AG)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5953 - Realtek Semiconductor Corp.)
SAlePluos (HKLM-x32\...\{B696F285-F54E-2524-58B1-E06A70ABE6BE}) (Version:  - )
Samsung C410 Series (HKLM-x32\...\Samsung C410 Series) (Version: 1.02 (11.07.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.03.23.00(03.05.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Wireless Setup (HKLM-x32\...\Easy Wireless Setup) (Version: 3.60.40.03 - Samsung Electronics Co., Ltd.)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.2.13021_10 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.5.2.13021_10 - Samsung Electronics Co., Ltd.) Hidden
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.18.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
SciPlore MindMapping (HKLM-x32\...\SciPlore MindMapping) (Version: Beta 7 - )
ShiftN 4.0 (HKLM-x32\...\ShiftN_is1) (Version: 4.0 - Marcus Hebel)
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.6.8442 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Spotify (HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\...\Spotify) (Version: 1.0.2.6.g9977a14b - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
StreamTransport version: 1.0.2.2171 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
TortoiseSVN 1.8.10.26129 (64 bit) (HKLM\...\{A9E679EC-8FD4-49D8-A5A5-ACE462515A9E}) (Version: 1.8.26129 - TortoiseSVN)
Trackplanner 1.1.12 (HKLM-x32\...\Trackplanner_is1) (Version:  - Georg Wächter)
Traffic Screensaver V4.9F (HKLM-x32\...\TrafficScreensaver_is1) (Version: 4.9F - TrafficSoft BT.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
whBOOK (HKLM-x32\...\{B44461E4-5BA9-11D7-B35A-00E07DB7DC50}) (Version: 5.0.0 - w+h GmbH)
Windows-Treiberpaket - Google, Inc. (WinUSB) AndroidUsbDeviceClass  (08/11/2009 2.0.0010.00002) (HKLM\...\9388C92339414DA34491DCD821912BAED240371D) (Version: 08/11/2009 2.0.0010.00002 - Google, Inc.)
WinHTTrack Website Copier 3.44-1 (x64) (HKLM\...\WinHTTrack Website Copier_is1) (Version: 3.44.1 - HTTrack)
WinTrack Demo Version 11.0 3D (HKLM-x32\...\wintrack11demo_is1) (Version: 11.0 3D - Ing.-Büro Schneider)
Xaldon WebSpider2 (HKLM-x32\...\WebSpider2) (Version:  - )
Zusi 2.4 (HKLM-x32\...\Zusi - Der Zugsimulator_is1) (Version: 2.4 - Carsten Hoelscher)
Zusi 3.0.5 (Demo) (HKLM-x32\...\www.zusi.de/zusi3/demo_is1) (Version: 3 - Carsten Hölscher)
Zusitool (HKLM-x32\...\ST6UNST #1) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1000_Classes\CLSID\{D45F043D-F17F-4e8a-8435-70971D9FA46D}\InprocServer32 -> C:\Program Files (x86)\Blender Foundation\Blender\BlendThumb64.dll ()
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3718451879-3267344302-3340637226-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus normal\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points  =========================

31-01-2015 22:35:54 Windows Update
01-02-2015 16:48:21 Windows Update
01-02-2015 22:48:15 Windows Update
02-02-2015 22:44:25 Windows Update
03-02-2015 23:01:54 Windows Update
04-02-2015 19:01:48 Windows Update
04-02-2015 22:46:03 Windows Update
05-02-2015 22:26:41 Windows Update
06-02-2015 21:37:58 Windows Update
07-02-2015 22:54:40 Windows Update
08-02-2015 14:48:38 Windows Update
08-02-2015 23:08:16 Windows Update
08-02-2015 23:50:17 Windows Update
09-02-2015 22:31:16 Windows Update
10-02-2015 23:02:13 Windows Update
11-02-2015 22:33:11 Windows Update
12-02-2015 23:16:50 Windows Update
15-02-2015 23:00:22 Windows Update
16-02-2015 22:43:01 Windows Update
17-02-2015 23:01:02 Windows Update
18-02-2015 22:38:45 Windows Update
19-02-2015 22:31:05 Windows Update
20-02-2015 22:19:59 Windows Update
21-02-2015 14:07:35 Windows Update
21-02-2015 14:38:37 Windows Update
21-02-2015 23:03:13 Windows Update
22-02-2015 14:29:34 OpenOffice 4.1.1 wird installiert
22-02-2015 14:40:25 Windows Update
22-02-2015 22:01:18 Windows Update
23-02-2015 22:50:36 Windows Update
24-02-2015 22:13:57 Windows Update
25-02-2015 22:29:33 Windows Update
26-02-2015 22:35:21 Windows Update
27-02-2015 22:03:20 Windows Update
28-02-2015 14:40:01 Windows Update
28-02-2015 22:02:00 Windows Update
01-03-2015 22:33:08 Windows Update
02-03-2015 23:01:43 Windows Update
03-03-2015 22:32:15 Installed TortoiseSVN 1.8.10.26129 (64 bit)
03-03-2015 22:34:26 "TortoiseSVN German" wird installiert
03-03-2015 22:39:17 Windows Update
04-03-2015 22:00:09 Windows Update
05-03-2015 19:22:27 Windows Update
06-03-2015 19:38:58 Windows Update
06-03-2015 22:34:04 Windows Update
07-03-2015 14:45:22 Windows Update
07-03-2015 22:51:14 Windows Update
08-03-2015 14:44:58 Windows Update
08-03-2015 20:23:44 Windows Update
08-03-2015 22:30:48 Windows Update
09-03-2015 22:18:27 Windows Update
11-03-2015 23:02:37 Windows Update
12-03-2015 19:13:17 Windows Update
12-03-2015 22:58:18 Windows Update
13-03-2015 22:52:49 Windows Update
14-03-2015 22:38:03 Windows Update
15-03-2015 22:56:53 Windows Update
16-03-2015 22:58:38 Windows Update
17-03-2015 22:52:53 Windows Update
18-03-2015 22:49:34 Windows Update
19-03-2015 19:39:39 Windows Update
19-03-2015 22:48:23 Removed Java(TM) 6 Update 20 (64-bit)
19-03-2015 22:50:55 Removed Java(TM) 6 Update 22
19-03-2015 23:08:47 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {26A6635E-0F61-4A29-A0FB-7B59BDD301B5} - System32\Tasks\{964747E9-3B9E-4242-BBC1-A5C7ED5B828D} => I:\PUSHINST.EXE
Task: {494B9CD5-91C3-40BF-920C-7062B151D2E6} - System32\Tasks\{2974FEC3-ED7D-4406-8316-78B2ACF4A172} => I:\PUSHINST.EXE
Task: {588C8474-5ACA-45A3-BC58-6EB28F0521A5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-07] (Google Inc.)
Task: {6443CE43-D564-4E1C-A092-BF158D8A10BB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {742CCA4F-FE15-4E7A-98D1-118E25B7072B} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {A0ED3388-5B4C-4268-9701-F7E796E94342} - System32\Tasks\{15676FA7-FCD4-4388-98D3-164570F6F79A} => I:\PUSHINST.EXE
Task: {C6B8EA72-C2E6-4610-BF92-3ED8376A70B9} - System32\Tasks\{6BCFB122-25D4-4C0B-B07A-BC3927CEF136} => I:\PUSHINST.EXE
Task: {D844AA79-694D-4B09-AA2A-55C7551132DA} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {DDBA0C92-92BA-4C1F-8B17-7B3B29B03620} - System32\Tasks\{976945F6-043A-43D3-868E-F1FD854FFB3D} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {E146DED6-89A6-49BF-97B7-71AD7D9D5E2A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-07] (Google Inc.)
Task: {E7965CD0-7554-47A2-9B7F-83414BC471AA} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-12-20] (AVAST Software)
Task: {EC183025-E614-42A8-A56B-62064E5278CE} - System32\Tasks\{8AA4BF2C-7015-4396-864F-419455BE06C6} => I:\PUSHINST.EXE
Task: {F75A60E0-699B-4BF9-A746-1C26636BA1A6} - System32\Tasks\{32AD5118-715D-49F3-894F-7DE26ED58E34} => pcalua.exe -a C:\Users\Markus\Downloads\avm_fritz!wlan_usb_stick_x64_build_100906.exe -d C:\Users\Markus\Downloads
Task: {FB903F84-DAEB-4B28-8558-7AD406E33D47} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2013-12-20 20:47 - 2013-05-06 07:07 - 00034304 _____ () C:\Windows\System32\sst8clm.dll
2014-12-17 21:31 - 2014-12-17 21:31 - 00076032 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll
2014-12-17 21:30 - 2014-12-17 21:30 - 00088832 _____ () C:\Program Files\TortoiseSVN\bin\libsasl.dll
2015-03-02 15:43 - 2015-03-02 15:43 - 00099288 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-03-09 09:58 - 2012-03-09 09:58 - 00462712 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2012-03-09 09:58 - 2012-03-09 09:58 - 00057208 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2011-06-08 17:04 - 2010-08-26 16:47 - 04577760 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
2011-06-08 17:04 - 2010-08-26 16:48 - 00285152 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe
2008-11-18 11:00 - 2008-11-18 11:00 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-05-17 16:40 - 2010-05-17 16:40 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-12-20 19:29 - 2014-12-20 19:29 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2014-12-20 19:29 - 2014-12-20 19:29 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2015-03-22 19:52 - 2015-03-22 19:52 - 02922496 _____ () C:\Program Files\AVAST Software\Avast\defs\15032200\algo.dll
2014-12-20 19:29 - 2014-12-20 19:29 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2011-06-08 17:04 - 2010-02-03 10:31 - 00282624 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvcLib.dll
2015-03-13 17:24 - 2015-03-13 17:24 - 38714440 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-03-19 23:05 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-03-19 23:05 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-03-19 23:05 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2011-06-08 17:04 - 2010-07-09 15:38 - 00331776 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WifiLib.dll
2014-12-17 20:53 - 2014-12-17 20:53 - 00065792 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub32.dll
2014-12-17 20:53 - 2014-12-17 20:53 - 00071936 _____ () C:\Program Files\TortoiseSVN\bin\libsasl32.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3718451879-3267344302-3340637226-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-3718451879-3267344302-3340637226-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Markus normal\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-3718451879-3267344302-3340637226-500 - Administrator - Disabled)
Antje (S-1-5-21-3718451879-3267344302-3340637226-1002 - Limited - Enabled) => C:\Users\Antje
Gast (S-1-5-21-3718451879-3267344302-3340637226-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3718451879-3267344302-3340637226-1004 - Limited - Enabled)
Markus (S-1-5-21-3718451879-3267344302-3340637226-1000 - Administrator - Enabled) => C:\Users\Markus
Markus normal (S-1-5-21-3718451879-3267344302-3340637226-1001 - Limited - Enabled) => C:\Users\Markus normal

==================== Faulty Device Manager Devices =============

Name: AVM ISDN CoNDIS WAN CAPI Driver #2
Description: AVM ISDN CoNDIS WAN CAPI Driver
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: AVM GmbH
Service: AVMCOWAN
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/22/2015 07:25:58 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "I:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (03/19/2015 09:07:10 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7600.16768 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 828

Startzeit: 01d0627f4eafc070

Endzeit: 20

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: 7ceff96b-ce73-11e4-8ae3-842b2bae19ee

Error: (03/15/2015 09:52:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: DecoderPro3.exe, Version: 6.0.200.2, Zeitstempel: 0x4bc3954b
Name des fehlerhaften Moduls: rxtxSerial.dll, Version: 0.0.0.0, Zeitstempel: 0x498a3547
Ausnahmecode: 0xc0000417
Fehleroffset: 0x000000000000bd94
ID des fehlerhaften Prozesses: 0x6ca4
Startzeit der fehlerhaften Anwendung: 0xDecoderPro3.exe0
Pfad der fehlerhaften Anwendung: DecoderPro3.exe1
Pfad des fehlerhaften Moduls: DecoderPro3.exe2
Berichtskennung: DecoderPro3.exe3

Error: (03/15/2015 07:00:02 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "I:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (03/12/2015 06:58:34 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Omsi.exe, Version 2.2.13.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1d20

Startzeit: 01d05ce7487cf4a0

Endzeit: 73

Anwendungspfad: C:\Program Files (x86)\Steam\steamapps\common\OMSI 2\Omsi.exe

Berichts-ID: 5638a241-c8e1-11e4-948e-842b2bae19ee

Error: (03/09/2015 08:37:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WNA3100.exe, Version: 1.1.3.22, Zeitstempel: 0x4c3d2df6
Name des fehlerhaften Moduls: WNA3100.exe, Version: 1.1.3.22, Zeitstempel: 0x4c3d2df6
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00043d63
ID des fehlerhaften Prozesses: 0x16b0
Startzeit der fehlerhaften Anwendung: 0xWNA3100.exe0
Pfad der fehlerhaften Anwendung: WNA3100.exe1
Pfad des fehlerhaften Moduls: WNA3100.exe2
Berichtskennung: WNA3100.exe3

Error: (03/08/2015 07:00:03 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "I:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (03/03/2015 10:33:56 PM) (Source: MsiInstaller) (EventID: 10005) (User: Dell-Markus)
Description: Produkt: "TortoiseSVN German" -- You are attempting to run the 32-bit installer on a 64-bit version of Windows. Please install the 64-bit version of the TortoiseSVN language pack instead.

Error: (03/03/2015 10:31:30 PM) (Source: MsiInstaller) (EventID: 10005) (User: Dell-Markus)
Description: Product: TortoiseSVN 1.8.10.26129 (32 bit) -- You are attempting to run the 32-bit installer on a 64-bit version of Windows. Please install the 64-bit version of TortoiseSVN instead.

Error: (03/03/2015 10:30:57 PM) (Source: MsiInstaller) (EventID: 10005) (User: Dell-Markus)
Description: Produkt: "TortoiseSVN German" -- TortoiseSVN is not installed. Please install TortoiseSVN before installing the language pack


System errors:
=============
Error: (03/22/2015 08:14:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/22/2015 08:14:06 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (03/22/2015 08:13:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/22/2015 08:13:26 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (03/22/2015 07:17:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/22/2015 07:17:35 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (03/22/2015 07:16:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/22/2015 07:16:55 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (03/19/2015 11:11:50 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8024200d fehlgeschlagen: Windows 7 Service Pack 1 für x64-basierte Systeme (KB976932)

Error: (03/19/2015 10:17:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053


Microsoft Office Sessions:
=========================
Error: (05/27/2013 08:44:06 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 2333 seconds with 300 seconds of active time.  This session ended with a crash.

Error: (05/27/2013 08:03:33 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 2533 seconds with 780 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5 CPU 650 @ 3.20GHz
Percentage of memory in use: 29%
Total physical RAM: 8119.08 MB
Available physical RAM: 5759.62 MB
Total Pagefile: 16236.29 MB
Available Pagefile: 13628.59 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1384.9 GB) (Free:907.73 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397.3 GB) (Disk ID: 38000000)
Partition 1: (Not Active) - (Size=118 MB) - (Type=DE)
Partition 2: (Active) - (Size=12.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1384.9 GB) - (Type=07 NTFS)

==================== End Of Log ============================

und noch die GMER

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-03-22 21:11:38
Windows 6.1.7600  x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST315003 rev.CC4G 1397,27GB
Running: Gmer-19357.exe; Driver: C:\Users\Markus\AppData\Local\Temp\kgldyaod.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2352] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint       000000007713000c 1 byte [C3]
.text  C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2352] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin  00000000771bf962 5 bytes JMP 000000017716d579
.text  C:\Program Files\AVAST Software\Avast\avastui.exe[2624] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter             00000000754cd03c 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[2632] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69      00000000770f1465 2 bytes [0F, 77]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[2632] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155     00000000770f14bb 2 bytes [0F, 77]
.text  ...                                                                                                                              * 2

---- EOF - GMER 2.1 ----

Vielen Dank schon mal für die Mühen vorab!

Markus

Win7: Avast meldet Bedrohung durch URL:Mal

Log-Analyse und Auswertung: Win7: Avast meldet Bedrohung durch URL:Mal

Win7: Avast meldet Bedrohung durch URL:Mal

Ähnliche Themen: Win7: Avast meldet Bedrohung durch URL:Mal