Nichts geht mehr auf meinem Laptop.
Habe es mit AdwCleaner und malewarebytes versucht und nichts gefunden.
Dann gab es folgende Meldung: resource:// firefox.abs.avira.com/html/blocled.html.
Dann habe ich firefox gelöscht und eine Systemwiederherstellung versucht. Ging nicht, weil "C: $ Extrend $ Realität $Txf " nicht extrahiert werden konnte.

Wenn ich jetzt den Internet Exporer starten will, schweigt mein Computer.
Bevor ich meinen Laptop jetzt an die Wand schmeiße, weil ich wohl alles, was man falsch machen kann, falsch gemacht habe, geht mein letzter Hilferuf über den Laptop meiner Frau an Sie

Bei Vorschlägen bitte berücksichtigen, dass ich möglichst einfache Anweisungen brauche

Danke

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

wie bekomme ich FRST 64-Bit vom Laptop meinerFRau auf meinen Laptop

Du hast keinen USB-Stick?
Oder geht nichtmal mehr FRST auf dem Problemrechner?

konnte das Programm auf ein USB STick laden und auf meinem PC starten.
ob das mit dem Anhang geklappt hat, kann ich nicht erkennen

Ich hab da extra dick und fett was zu CODE-Tags und Anhängen gepostet...

habe Quarantäne Liste von ADWCleaner gefunden:

ist jetzt alles angekommen,ich glaube ich habe Dein Pfeifen leider nicht gehört, oder doch?

Also dann nochmal

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

entschuldige, ich dachte das wäre eine Reklame

Additional scan result of Farbar 
1. FRST Addition:

Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Holger Carlson at 2015-04-08 15:05:37
Running from F:\
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Disabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Absolute Uninstaller 5.3.1.20 (HKLM-x32\...\Absolute Uninstaller) (Version: 5.3.1.20 - Glarysoft Ltd)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 17.0.0.124 - Adobe Systems Incorporated)
Adobe Digital Editions 4.0 (HKLM-x32\...\Adobe Digital Editions 4.0) (Version: 4.0.3 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Alle meine Adressen 1.20 (HKLM-x32\...\AllemeineAdressen) (Version:  - )
Amazon Kindle (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Amazon Kindle) (Version:  - Amazon)
Anti-Twin (Installation 14.02.2015) (HKLM-x32\...\Anti-Twin 2015-02-14 11.26.34) (Version:  - Joerg Rosenthal, Germany)
ASUS FancyStart (HKLM-x32\...\{2B81872B-A054-48DA-BE3B-FA5C164C303A}) (Version:  - )
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2215 - AVAST Software)
AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Buchliebhaber 9.1.0 (HKLM-x32\...\Buchliebhaber_is1) (Version:  - Matthies & Klock GmbH)
Glary Utilities 5.22 (HKLM-x32\...\Glary Utilities 5) (Version: 5.22.0.41 - Glarysoft Ltd)
GMX MediaCenter 1.5.2192.0 (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\GMX Application {sync-000021}) (Version: 1.5.2192.0 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung CE (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.1.0 - 1&1 Mail & Media GmbH)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
MD Adressbuch 2012 (HKLM-x32\...\MD Adressbuch 2012_is1) (Version:  - Stefan Göppert Softwareentwicklung)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MyDriveConnect 3.3.0.1756 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)
MyFreeCodec (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\MyFreeCodec) (Version:  - )
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)
SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version:  - )
Samsung Mobile Modem Device Software (HKLM\...\Samsung Mobile Modem Device) (Version:  - )
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version:  - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version:  - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version:  - )
SAMSUNG USB Mobile Device Software (HKLM\...\SAMSUNG USB Mobile Device) (Version:  - )
TomTom HOME (HKLM-x32\...\{BB05590A-6602-43F3-A400-77EA0976BC0A}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version:  - )
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinZip Driver Updater (HKLM-x32\...\{9854A5C4-5BE5-46E2-A989-352DD8B37E20}_is1) (Version: 1.0.648.16298 - WinZip Computing, S.L. (WinZip Computing))
Wondershare Video Editor(Build 4.8.0) (HKLM-x32\...\Wondershare Video Editor_is1) (Version:  - Wondershare Software)
XnView 2.25 (HKLM-x32\...\XnView_is1) (Version: 2.25 - Gougelet Pierre-e)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

08-04-2015 00:11:59 Wiederherstellungsvorgang
08-04-2015 10:17:37 Die Service Pack-Sicherungsdateien wurden entfernt.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-12-04 14:19 - 00000860 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {08B758AF-1A52-432B-8127-90EC4AA3A965} - System32\Tasks\{F2C2A228-7128-4269-BFD6-1BA7B353163D} => C:\Program Files (x86)\Matthies & Klock GmbH\Buchliebhaber\PR9\pdxrwn32.exe
Task: {098E8135-34F9-4A64-934D-CB129E5D2CDC} - \Google Updater and Installer No Task File <==== ATTENTION
Task: {0CE00D12-17CE-4495-BF65-180B9826F70C} - \{61A08136-196D-4297-89AD-D497D9417337} No Task File <==== ATTENTION
Task: {0D02835E-8E5B-471D-B8DD-C212A01D96EC} - \{D04405DF-9CCA-470D-B397-4843D8B97AF0} No Task File <==== ATTENTION
Task: {0D85BDAC-E5C7-468D-B749-BB89C6043C0C} - \{5287E865-8199-49E9-9791-D1D1C8255AD2} No Task File <==== ATTENTION
Task: {11951C30-7772-4873-A9C8-E7D79EC20876} - \{D8737E18-1D23-477D-AAC7-5336054949A5} No Task File <==== ATTENTION
Task: {13F363A7-DAF8-481E-B4FE-FE9B141B5AA3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {25201061-4215-47D1-9AD4-34EA219B3820} - System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F} => pcalua.exe -a E:\setup.exe -d E:\
Task: {28C6FF84-FF3C-482A-9DE2-C1E1A727942B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-06] (Adobe Systems Incorporated)
Task: {290FA810-6486-498B-959B-EF77EE05DD0F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)
Task: {2B0BE8B0-825F-4CBB-8C4D-91671BCB9A6A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2FC8335C-FA90-4CEE-A686-C6B49483A403} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {3210E7F8-FB59-421F-B199-67709A46C787} - \{A6277D21-0A69-4926-8537-03083BD82DC4} No Task File <==== ATTENTION
Task: {334ED6C7-1F98-49AE-8A05-3E3B9A21315B} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {358F7EC5-6965-40B1-864E-007E2DF9341F} - System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)
Task: {38A8F2A8-F514-4C70-A1BB-A5D46267F1FB} - \{F46C64DF-4E00-4451-B8AB-B1BD2B03A5D6} No Task File <==== ATTENTION
Task: {38ADF97D-C025-44B4-8A28-255AF09F87BD} - \{9623FEA8-9F14-41C1-B13F-5E2F1DDF2973} No Task File <==== ATTENTION
Task: {38F64A5C-9D9B-402B-A2B5-B669F928CBC9} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2015-03-30] (Glarysoft Ltd)
Task: {3B3ABEC6-C5C7-4317-98AA-0E6A0A2CCF4B} - \{9DB39282-3B31-400F-9105-DE5FB32A8625} No Task File <==== ATTENTION
Task: {3D5A7F1A-A836-46DC-9849-9F87B83A84A3} - System32\Tasks\ASPG => C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe [2009-06-29] (ASUS)
Task: {3DFA3AE3-36A5-43EE-86FD-5CFEE82FD09E} - \{010EC50E-DEBC-4DDF-818F-D8FD586C6441} No Task File <==== ATTENTION
Task: {40210CAF-8AA2-4DD1-BDF5-BB204B73FB6C} - System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)
Task: {413B067F-3B28-4DF2-8F92-254BE963B97C} - System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)
Task: {41E4A974-3CB9-486E-B66F-D3F72922F49D} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-05-28] (ATK)
Task: {442B4BA7-EBD3-4530-973F-E7CC01346952} - \{BA46EF16-D5AD-455B-A934-5EFCEB3A4388} No Task File <==== ATTENTION
Task: {44B27208-7DF9-417C-85BA-311F6EE0FE37} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17] (ASUS)
Task: {46897D9B-08E1-407A-86D2-588D7ABBE189} - \{BE03A807-43D0-45D8-9633-BA1E5A2BF85C} No Task File <==== ATTENTION
Task: {47F29D00-B56D-4D0B-A245-F110AC103BA3} - \{DCE86621-269D-478F-9FAC-AF30D2697486} No Task File <==== ATTENTION
Task: {4A29309C-5F1C-4521-B5A3-74342AD4D434} - System32\Tasks\avastBCLRestartS-1-5-21-171592873-1656066399-1947005370-1000 => Chrome.exe 
Task: {4ABBB83F-8527-455B-839D-0E31E9921ABF} - \{414946E3-07AA-4AF3-BB0D-E22440C7BAAE} No Task File <==== ATTENTION
Task: {4DB12196-A5A6-455A-A31E-8A8F9CDA048F} - \{00D6677F-309E-4218-BCA8-4C50017C8BFD} No Task File <==== ATTENTION
Task: {4E55F6B2-D76F-46DA-85CA-851B04EA102C} - System32\Tasks\4805 => Wscript.exe C:\Users\HOLGER~1\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {536019A5-4DF9-4D2A-AB12-D4F97B46565A} - \{3542F023-1538-411B-9E77-ACAF5E3DCF29} No Task File <==== ATTENTION
Task: {570F0731-82FB-4801-9764-13133948D30D} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {61DA3565-D65E-4727-A79B-CFF46B7C83D0} - \{515B0C8B-D302-490D-B011-1690D5CB8DA8} No Task File <==== ATTENTION
Task: {67253C4B-AA19-4D28-A2C4-ACB82A1E8FB3} - \{8715223C-93FC-489B-A4F9-497C1B06356D} No Task File <==== ATTENTION
Task: {689876BF-828C-4CAC-B3C8-96B7A34B374C} - \{E27BA60A-F9D1-4950-AADD-E4C8BB8E3AE7} No Task File <==== ATTENTION
Task: {6B054A5F-A0E3-42EF-B939-199ECAD09EEE} - \Registration 1und1 Task No Task File <==== ATTENTION
Task: {73E334A0-2C62-4488-842A-B6047FD36A67} - \{4C3D4C4C-3DD2-436D-B415-CC9B34C519DA} No Task File <==== ATTENTION
Task: {7687468C-FCB9-4157-98A5-29F118266571} - \{80C774A3-BC4E-4FEF-B262-A5578F350E85} No Task File <==== ATTENTION
Task: {7D065A65-864E-4237-909F-B37C27ECC63A} - \{A86E51F0-822F-4FC6-9962-851362E69E65} No Task File <==== ATTENTION
Task: {813A7F73-0382-4A15-BA6D-549796A8A795} - \{A3123A1E-2B47-4121-992C-63487F1CE1F3} No Task File <==== ATTENTION
Task: {8280F3EA-A247-4A48-8F40-7F948D87EB49} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {833E3160-FE17-4A2E-8B96-5ACA617F1334} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31] (ASUS)
Task: {83C4C39B-F484-45E4-B677-EFBBD3E1183A} - \{7874A9A9-C312-459B-A16C-50B15C6AE000} No Task File <==== ATTENTION
Task: {8B51862B-900B-4C95-A7D5-29D974D8EE26} - \{4BA2B75B-115C-4BCA-B45A-BD110E15FEF3} No Task File <==== ATTENTION
Task: {8E7BFA22-A9BF-4269-B793-D870D24D60C2} - System32\Tasks\0215tbUpdateInfo => C:\ProgramData\Avg_Update_0215tb\0215tb_{9AC9BD6A-EC15-4AF2-B2E9-45B20221802C}.exe [2015-02-27] ()
Task: {8F72ADBE-9038-41E9-86A7-8381B850A01F} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2009-07-23] (ATK)
Task: {933153D3-FF7D-4F2F-93DB-4EE18AEC267A} - \{58E9C4A2-89D5-4097-9A1D-3C7212CC100A} No Task File <==== ATTENTION
Task: {95298E87-8CFD-4CCA-890F-8B7D7730CF74} - \{E2D6ACFE-B61E-4447-AE80-4B0CA9F20914} No Task File <==== ATTENTION
Task: {961A4741-EA5F-4FD4-9F58-9824862E1432} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {9AA4F3F3-6B2F-4EA6-B81B-1EA4DF38689E} - \{F99ED12E-E280-47FF-9CC7-4FA9874C09B4} No Task File <==== ATTENTION
Task: {9C67CD09-48FC-4280-A9C2-7D5BE146C9A7} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2015-03-30] (Glarysoft Ltd)
Task: {A7177D9F-E795-4EEA-9386-C0AB9B1E6555} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {AB825B6B-2DF7-408C-A17E-B405E72C327C} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: {ABE155A8-22A7-4F41-A3D7-35B367212640} - \{8EE0BDD3-D87C-4147-865B-EF850579BBB3} No Task File <==== ATTENTION
Task: {B35D3966-C1EC-4ABB-BAC5-D82790C11C3F} - \{E3C1408B-870F-4E8E-863D-53964BB8AC89} No Task File <==== ATTENTION
Task: {B39D560A-BEBE-44B2-BB96-2FB0031EFCB1} - System32\Tasks\{5F6DAA4F-722D-4B6E-9C1D-E206E1B3507A} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{F193FC0E-9E18-40FC-A974-509A1BDD240A}\setup.exe" -c -runfromtemp -l0x0407 -removeonly
Task: {B3AA75D5-DCF3-4574-8832-4A1FD12772EC} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-04-06] (Avast Software s.r.o.)
Task: {B3C1DDB0-DE41-4A0A-BF91-DBEDCF91283A} - \{579791C6-84C4-4514-8990-62DE88C0F405} No Task File <==== ATTENTION
Task: {B4381734-38BC-4416-BA34-AD5B873F9C57} - \Java Update Scheduler No Task File <==== ATTENTION
Task: {B4906D30-8E70-438F-ACE2-F49B1DBE7445} - \{94AA3650-9FB1-4CD9-A08A-C903E473EBCE} No Task File <==== ATTENTION
Task: {B967227B-B6FD-4E2D-8835-423AB6A11D89} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)
Task: {BE3C31CF-63BD-4BBF-B1EC-7B0AD8E1475C} - \{766A2B2A-5AE1-40C4-B5D1-3ACEE3EDB174} No Task File <==== ATTENTION
Task: {BF27F29A-158B-4BB3-8BCE-76285F22E1E8} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
Task: {C070E538-D27F-40CE-A149-1F519DE498C9} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {C9922EB1-0689-4006-9DE5-EC7322657A2E} - \{3A7AA56D-B373-4984-B360-5A49D81838B3} No Task File <==== ATTENTION
Task: {D10B95EB-9C87-4E4B-B2A9-7995BACE3748} - System32\Tasks\ASUSControlDeck => C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe [2010-06-09] (asus)
Task: {D3A8949A-66C0-404E-A951-6D81347CC413} - \{5F42D548-089A-4880-B17A-030133EB09AE} No Task File <==== ATTENTION
Task: {D3DCDC2E-0597-4E10-B9B2-DA8A9D0B8184} - \{C8855EFF-1C49-474C-8EC9-A88A46937291} No Task File <==== ATTENTION
Task: {D79B06A8-69BD-44AF-A4F9-51F90B02F5F9} - \{010E4118-67B1-49F2-B0A9-AEBEB8C22ED8} No Task File <==== ATTENTION
Task: {D804B95C-2E56-41A3-BA15-CBFF3F453270} - \{D1412BBD-3329-445E-BAAC-11DAA3F957DE} No Task File <==== ATTENTION
Task: {D97583DC-E996-4394-9850-866EE5071AA3} - \{54761E2D-0F8D-4150-9BAF-A6C950ABC57C} No Task File <==== ATTENTION
Task: {DCCEAEA3-B771-45EF-B482-A5AF7C257613} - \{F268C70D-1377-46B5-B8EF-B0F597A319DD} No Task File <==== ATTENTION
Task: {DD20FA04-E2E5-4565-BC1F-EF251B8CF767} - \{017BCEFC-6CC0-4438-9C8C-8201389B3A60} No Task File <==== ATTENTION
Task: {DF172056-6ED6-443A-A038-9148CCA273FB} - System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E} => pcalua.exe -a E:\setup.exe -d E:\
Task: {E4FADBEF-BD70-4875-9F9E-1F514FAE9ACE} - \{428451EA-30BB-4D09-B88F-21C45644BDDD} No Task File <==== ATTENTION
Task: {EBAEA87A-60D8-457D-B7BE-FDDEE0C029B6} - \{E72F77B1-78E7-4B59-A542-303E6C370E31} No Task File <==== ATTENTION
Task: {EBC17C4A-B399-454D-880A-2B7927689200} - System32\Tasks\{B499114B-BC27-40FC-98B1-F18D60669500} => pcalua.exe -a C:\ProgramData\ZombieInvasion\uninstall.exe -c /kb=y /ic=1
Task: {EBDB75AC-DD2E-4374-8CA6-CA615964EFDF} - System32\Tasks\{F24AA02C-94D0-40B1-9DB0-D88D09B26BA3} => C:\Program Files (x86)\Matthies &amp; Klock GmbH\Buchliebhaber\PR9\pdxrwn32.exe
Task: {F088DE68-E8E0-404D-A03F-71D270529CAA} - \{C9155B3B-9625-4BCA-8DC8-57E7BE8F3A16} No Task File <==== ATTENTION
Task: {F291C6EE-C628-4432-9AA6-72AB2B105BB0} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {F2C3A777-E8AA-4F3A-BAFD-9404E1BEA2BA} - \SidebarExecute No Task File <==== ATTENTION
Task: {FCC576CF-4869-4F53-B945-CC818F71D6F7} - \{A56BDF5A-F4F1-4A50-8871-D8B38E0FE432} No Task File <==== ATTENTION
Task: C:\Windows\Tasks\0215tbUpdateInfo.job => C:\ProgramData\Avg_Update_0215tb\0215tb_{9AC9BD6A-EC15-4AF2-B2E9-45B20221802C}.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GlaryInitialize 5.job => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-03-23 11:39 - 2015-03-23 11:39 - 00620056 _____ () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
2010-03-05 18:21 - 2010-03-05 18:21 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2007-06-15 19:28 - 2007-06-15 19:28 - 00104960 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll
2007-06-02 01:52 - 2007-06-02 01:52 - 00159744 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll
2010-01-11 19:27 - 2010-01-11 19:27 - 00017920 _____ () C:\Program Files\P4G\DevMng.dll
2010-05-06 03:22 - 2010-05-06 03:22 - 00108544 _____ () C:\Program Files\P4G\OvrClk.dll
2008-10-01 08:02 - 2008-10-01 08:08 - 00011264 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
2010-10-08 21:01 - 2007-11-30 20:20 - 00051768 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
2010-10-08 20:22 - 2010-04-06 08:29 - 00244904 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2015-04-06 17:55 - 2015-04-06 17:55 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-04-06 17:55 - 2015-04-06 17:55 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-04-07 23:05 - 2015-04-07 23:05 - 02924544 _____ () C:\Program Files\AVAST Software\Avast\defs\15040701\algo.dll
2015-04-08 14:54 - 2015-04-08 14:54 - 02925056 _____ () C:\Program Files\AVAST Software\Avast\defs\15040801\algo.dll
2015-04-06 17:55 - 2015-04-06 17:55 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-03-30 08:07 - 2015-03-30 08:07 - 00080160 _____ () C:\Program Files (x86)\Glary Utilities 5\zlib1.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:AD022376

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Classes\exefile:  <===== ATTENTION!

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: ADSMTray => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe
MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
MSCONFIG\startupreg: RemoteControl9 => "C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe"
MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-171592873-1656066399-1947005370-500 - Administrator - Disabled)
Gast (S-1-5-21-171592873-1656066399-1947005370-501 - Limited - Disabled)
Holger Carlson (S-1-5-21-171592873-1656066399-1947005370-1000 - Administrator - Enabled) => C:\Users\Holger Carlson
HomeGroupUser$ (S-1-5-21-171592873-1656066399-1947005370-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/08/2015 10:17:37 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {838dcb48-10f2-4035-8955-78846a8e7807}

Error: (04/08/2015 09:50:44 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 230

Startzeit: 01d071cc5aec4b5f

Endzeit: 390

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID: ef1bd15d-ddc3-11e4-8f0d-20cf30cfa402

Error: (04/08/2015 00:28:45 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 730

Startzeit: 01d0718193adbd30

Endzeit: 0

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID: 6645c20b-dd75-11e4-be47-20cf30cfa402

Error: (04/08/2015 00:17:27 AM) (Source: System Restore) (EventID: 8210) (User: )
Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows-Sicherung). Zusätzliche Informationen: 0x80070005.

Error: (04/07/2015 11:53:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 194

Startzeit: 01d0717cecf34e3b

Endzeit: 78

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID: 78fbce4e-dd70-11e4-ba94-20cf30cfa402

Error: (04/07/2015 11:50:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1364

Startzeit: 01d0717aa5f796e2

Endzeit: 0

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID:

Error: (04/07/2015 11:48:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17689, Zeitstempel: 0x54e6869b
Name des fehlerhaften Moduls: aswWebRepIE64.dll, Version: 10.0.0.44, Zeitstempel: 0x5501a3ca
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000116a3
ID des fehlerhaften Prozesses: 0x14f4
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (04/07/2015 11:47:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17689, Zeitstempel: 0x54e6869b
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7c92c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000019868
ID des fehlerhaften Prozesses: 0xc08
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (04/07/2015 11:34:28 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: b94

Startzeit: 01d0717a6ba74781

Endzeit: 16

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID: d76c519b-dd6d-11e4-ba94-20cf30cfa402

Error: (04/07/2015 11:32:59 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 28c

Startzeit: 01d0717824c2c90c

Endzeit: 0

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID:


System errors:
=============
Error: (04/08/2015 02:53:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/08/2015 09:09:43 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/08/2015 00:16:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/08/2015 00:13:50 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (04/07/2015 11:15:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/07/2015 08:12:10 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (04/07/2015 07:13:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/07/2015 00:46:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (04/07/2015 00:45:27 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (04/07/2015 00:45:27 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll


Microsoft Office Sessions:
=========================
Error: (04/08/2015 10:17:37 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {838dcb48-10f2-4035-8955-78846a8e7807}

Error: (04/08/2015 09:50:44 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe11.0.9600.1768923001d071cc5aec4b5f390C:\Program Files\Internet Explorer\iexplore.exeef1bd15d-ddc3-11e4-8f0d-20cf30cfa402

Error: (04/08/2015 00:28:45 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe11.0.9600.1768973001d0718193adbd300C:\Program Files\Internet Explorer\iexplore.exe6645c20b-dd75-11e4-be47-20cf30cfa402

Error: (04/08/2015 00:17:27 AM) (Source: System Restore) (EventID: 8210) (User: )
Description: Windows-Sicherung0x80070005

Error: (04/07/2015 11:53:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe11.0.9600.1768919401d0717cecf34e3b78C:\Program Files\Internet Explorer\iexplore.exe78fbce4e-dd70-11e4-ba94-20cf30cfa402

Error: (04/07/2015 11:50:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe11.0.9600.17689136401d0717aa5f796e20C:\Program Files\Internet Explorer\iexplore.exe

Error: (04/07/2015 11:48:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.1768954e6869baswWebRepIE64.dll10.0.0.445501a3cac000000500000000000116a314f401d0717c85862374C:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\AVAST Software\Avast\aswWebRepIE64.dlld836be9e-dd6f-11e4-ba94-20cf30cfa402

Error: (04/07/2015 11:47:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.1768954e6869bole32.dll6.1.7601.175144ce7c92cc00000050000000000019868c0801d0717c4fd15be8C:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\ole32.dllacd6a0e2-dd6f-11e4-ba94-20cf30cfa402

Error: (04/07/2015 11:34:28 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe11.0.9600.17689b9401d0717a6ba7478116C:\Program Files\Internet Explorer\iexplore.exed76c519b-dd6d-11e4-ba94-20cf30cfa402

Error: (04/07/2015 11:32:59 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe11.0.9600.1768928c01d0717824c2c90c0C:\Program Files\Internet Explorer\iexplore.exe


CodeIntegrity Errors:
===================================
  Date: 2015-02-10 19:35:28.928
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\emOEM64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-10 19:35:28.536
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\emOEM64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-29 18:03:12.533
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\HOLGER~1\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-29 18:03:12.393
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\HOLGER~1\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-29 18:03:11.993
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-29 18:03:11.843
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU P6100 @ 2.00GHz
Percentage of memory in use: 48%
Total physical RAM: 2924.57 MB
Available physical RAM: 1492.74 MB
Total Pagefile: 6147.32 MB
Available Pagefile: 4319.39 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:72.69 GB) (Free:5.35 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:205.87 GB) (Free:23.08 GB) NTFS
Drive f: (VIEDO) (Removable) (Total:14.7 GB) (Free:14.7 GB) FAT32
Drive s: (EX SPEICHER) (Removable) (Total:7.51 GB) (Free:4.24 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 0237A506)
Partition 1: (Not Active) - (Size=19.5 GB) - (Type=1C)
Partition 2: (Active) - (Size=72.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=205.9 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 7.5 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 2 (Size: 14.7 GB) (Disk ID: 6E652072)
No partition Table on disk 2.

==================== End Of Log ============================
         

2. Quarantäne aus ADWCleaner:
C:\ProgramData\AVG Secure Search\Logger\logger.properties->C:\AdwCleaner\Quarantine\C\ProgramData\AVG Secure Search\Logger\logger.properties.vir
C:\ProgramData\AVG Security Toolbar\TBCampaignINSP.txt->C:\AdwCleaner\Quarantine\C\ProgramData\AVG Security Toolbar\TBCampaignINSP.txt.vir
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe->C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir
C:\ProgramData\WindowsMangerProtect\update\conf->C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\update\conf.vir
C:\ProgramData\IHProtectUpDate\update\conf->C:\AdwCleaner\Quarantine\C\ProgramData\IHProtectUpDate\update\conf.vir
C:\ProgramData\e6ad6c22000030b3\BITE952.tmp->C:\AdwCleaner\Quarantine\C\ProgramData\e6ad6c22000030b3\BITE952.tmp.vir
C:\Program Files (x86)\XTab\BrowerWatchFF.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchFF.dll.vir
C:\Program Files (x86)\XTab\BrowserAction.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowserAction.dll.vir
C:\Program Files (x86)\XTab\CmdShell.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\CmdShell.exe.vir
C:\Program Files (x86)\XTab\conf->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\conf.vir
C:\Program Files (x86)\XTab\HPNotify.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\HPNotify.exe.vir
C:\Program Files (x86)\XTab\IeWatchDog.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\IeWatchDog.dll.vir
C:\Program Files (x86)\XTab\msvcp110.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\msvcp110.dll.vir
C:\Program Files (x86)\XTab\msvcr110.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\msvcr110.dll.vir
C:\Program Files (x86)\XTab\ProtectService.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\InstalledProducts.ini->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\InstalledProducts.ini.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\log4cplusU.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\log4cplusU.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\updater.xml->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\updater.xml.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\UpdaterConfig.ini->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\UpdaterConfig.ini.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\log4cplusU.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\log4cplusU.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\loggingserver.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\loggingserver.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\updater.xml->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\updater.xml.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\UpdaterConfig.ini->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\UpdaterConfig.ini.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.3.0\ViProtocol.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.3.0\ViProtocol.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ToolBandTlb\18.3.0\toolband->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ToolBandTlb\18.3.0\toolband.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\avgtbr.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\avgtbr.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\manifest.json->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\manifest.json.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\ScriptHelper.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\ScriptHelper.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.3.0\manifest.json->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.3.0\manifest.json.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.3.0\ScriptHelper.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.3.0\ScriptHelper.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.4.0\NativeBrowserApi.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.4.0\NativeBrowserApi.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.3.0\NativeBrowserApi.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.3.0\NativeBrowserApi.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\18.4.0\avgdttbx.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\18.4.0\avgdttbx.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\18.3.0\avgdttbx.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\18.3.0\avgdttbx.dll.vir
C:\Users\Holger Carlson\Documents\Optimizer Pro\CookiesException.txt->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\Documents\Optimizer Pro\CookiesException.txt.vir
C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb->C:\AdwCleaner\Quarantine\C\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb.vir
C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml.vir
C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\user.js->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\user.js.vir
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk->C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk.vir
C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk.vir
C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk.vir
C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.vir
C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk.vir
C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk.vir

ich hoffe, das ist jetzt richtig.
nochmal sorry, sorry

Da fehlt immer noch locker die Hälfte:

=> FRST.txt
=> restlichen Logs von adwCleaner
=> tw. hast du nicht in CODE-Tags gepostet

Bitte sorgfältiger lesen und mitarbeiten

jetzt habe ich wieder ein Problem. Wenn ich mein Thema aufrufe, habe ich Cosinus letzte Meldung mit dem Hinweis, es würde noch viel fehlen, auf dem Schirm.
Ich dachte, ich hätte den Rest geschickt.
Ich habe es jetzt noch einmal gemacht und war mir dabei fast sicher, dass ich es schon einmal geschickt habe.
Wenn nicht, sorry, wenn doch abermals sorry


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Holger Carlson (administrator) on FRIDOLIN on 08-04-2015 15:04:27
Running from F:\
Loaded Profiles: Holger Carlson (Available profiles: Holger Carlson)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS CopyProtect\ASPG.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Windows\AsScrPro.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Glarysoft Ltd) C:\Program Files (x86)\Glary Utilities 5\Integrator.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-06] (Avast Software s.r.o.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2015-03-30] (Glarysoft Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll ()
ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll ()
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll ()
ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll ()
BootExecute: autocheck autochk *  
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56939;https=127.0.0.1:56939
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP8803837A-1DA4-472E-BAE6-FF0BFD270EFC&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&q={searchTerms}
BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files\Windows Live\Family Safety\fssbho.dll [2008-12-08] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-06] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-06] (Avast Software s.r.o.)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {534D542D-5637-006A-76A7-7A786E7484D7} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{42264728-0917-4958-91BA-C18941410592}: [NameServer] 0.0.0.0
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default
FF SearchEngineOrder.1: Google (avast)
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-04-06] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-04-06] ()
FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll [2008-10-15] (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2008-12-04] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\bing-avast.xml [2014-11-16]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-avast.xml [2015-02-01]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-images.xml [2014-10-14]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-maps.xml [2014-10-14]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\yahoo-avast.xml [2014-09-19]
FF Extension: Avira Browser Safety - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\abs@avira.com [2015-03-31]
FF Extension: WEB.DE MailCheck - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\toolbar@web.de [2015-04-05]
FF Extension: OkayFreedom - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\{DB981CCA-088E-4731-A4A2-2FE218703C0E}.xpi [2015-04-05]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-06]
FF HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-06]
CHR Extension: (Google Docs) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-06]
CHR Extension: (Google Drive) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-06]
CHR Extension: (YouTube) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-06]
CHR Extension: (Google Search) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-06]
CHR Extension: (Google Sheets) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-06]
CHR Extension: (Avast Online Security) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-06]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-06]
CHR Extension: (Google Wallet) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-06]
CHR Extension: (Gmail) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-06]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [fknfdieimobmimhdkfkheeejenmdjhoe] - C:\Program Files (x86)\pandasecuritytb\chrome-newtab-search.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-06]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ADSMService; C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-06] (Avast Software s.r.o.)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [File not signed]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()
R3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-04-06] () [File not signed]
R2 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-23] ()
S2 TomTomHOMEService; "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-06] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-06] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-06] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-06] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-06] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-06] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-06] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2014-11-14] ()
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2015-04-03] (Glarysoft Ltd)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-04-07] (Malwarebytes Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA64.sys [649984 2009-09-01] (eMPIA Technology, Inc.) [File not signed]
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM64.sys [626688 2009-09-02] (eMPIA Technology, Inc.) [File not signed]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
U3 tmlwf; No ImagePath
U3 tmwfp; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-08 14:52 - 2015-04-08 14:52 - 00003544 ____N () C:\bootsqm.dat
2015-04-07 18:57 - 2015-04-07 18:57 - 00000000 ____D () C:\ProgramData\GlarySoft
2015-04-07 18:44 - 2015-04-07 18:59 - 00000000 ___HD () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled
2015-04-07 18:43 - 2015-04-07 18:44 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup-Disabled
2015-04-07 12:41 - 2015-04-07 12:41 - 02208768 _____ () C:\Users\Holger Carlson\Documents\adwcleaner_4.200.exe
2015-04-06 18:57 - 2015-04-06 18:57 - 00001884 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-06 18:56 - 2015-04-06 18:56 - 00356232 _____ (Dropbox, Inc.) C:\Users\Public\Desktop\DropboxInstallerAvast.exe
2015-04-06 18:56 - 2015-04-06 17:55 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-06 18:01 - 2015-04-06 18:01 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\AVAST Software
2015-04-06 17:59 - 2015-04-06 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-06 17:59 - 2015-04-06 18:01 - 00002037 _____ () C:\Users\Public\Desktop\Avast Premier.lnk
2015-04-06 17:59 - 2015-04-06 17:59 - 00001944 _____ () C:\Users\Public\Desktop\Avast SafeZone.lnk
2015-04-06 17:58 - 2015-04-07 11:53 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-04-06 17:56 - 2015-04-06 17:55 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-06 17:55 - 2015-04-06 17:55 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-06 17:52 - 2015-04-06 17:52 - 00000000 ____D () C:\Program Files\AVAST Software
2015-04-06 17:11 - 2015-04-06 17:11 - 00000000 ____D () C:\Olivetti
2015-04-06 11:28 - 2015-04-07 12:44 - 00000000 ____D () C:\AdwCleaner
2015-04-06 10:27 - 2015-04-07 23:49 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\CrashDumps
2015-04-05 09:52 - 2015-04-05 10:03 - 00000000 ____D () C:\ProgramData\Informer Technologies, Inc
2015-04-05 09:51 - 2015-04-05 09:51 - 03568824 _____ (Informer Technologies, Inc. ) C:\Users\Holger Carlson\Documents\siinst.exe
2015-04-05 09:45 - 2015-04-06 09:42 - 00000000 ____D () C:\ProgramData\{95f4c13f-5638-faae-95f4-4c13f56304fd}
2015-04-05 09:45 - 2015-04-05 09:45 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Drivers et Pilotes
2015-04-05 09:44 - 2015-04-05 10:03 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos
2015-04-05 09:44 - 2015-04-05 09:44 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos VPN
2015-04-05 09:42 - 2015-04-05 09:42 - 00413328 _____ () C:\Users\Holger Carlson\Documents\OLIVETTI_downloader-QaZJ7date.exe
2015-04-05 09:23 - 2015-04-05 09:24 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-05 09:23 - 2015-04-05 09:23 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-04 17:35 - 2015-04-04 17:36 - 00000000 ____D () C:\Users\Holger Carlson\Documents\Wondershare Video Editor
2015-04-03 19:25 - 2015-04-03 19:25 - 00002950 _____ () C:\Windows\System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8}
2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB}
2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D}
2015-04-03 18:43 - 2015-04-03 18:43 - 00001534 _____ () C:\Users\Holger Carlson\Desktop\Buchliebhaber.lnk
2015-04-03 18:42 - 2015-04-03 18:43 - 00000000 ____D () C:\Buchliebhaber1
2015-04-03 18:12 - 2015-04-03 18:12 - 00003050 _____ () C:\Windows\System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E}
2015-04-03 17:59 - 2015-04-08 15:04 - 00000352 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
2015-04-03 17:59 - 2015-04-08 15:04 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
2015-04-03 17:59 - 2015-04-03 17:59 - 00020160 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2015-04-03 17:59 - 2015-04-03 17:59 - 00002990 _____ () C:\Windows\System32\Tasks\GU5SkipUAC
2015-04-03 17:59 - 2015-04-03 17:59 - 00002666 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5
2015-04-03 17:59 - 2015-04-03 17:59 - 00001909 _____ () C:\GUDownLoaddebug.txt
2015-04-03 17:59 - 2015-04-03 17:59 - 00001054 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2015-04-03 17:59 - 2015-04-03 17:59 - 00001042 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk
2015-04-03 17:59 - 2015-04-03 17:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2015-04-03 17:58 - 2015-04-03 17:58 - 04737952 _____ () C:\Users\Holger Carlson\Documents\ausetup.exe
2015-04-03 13:06 - 2015-04-03 13:06 - 00000000 ____D () C:\Program Files\DIFX
2015-04-03 13:04 - 2015-04-03 13:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My NPS Files
2015-04-03 12:54 - 2015-04-03 12:54 - 00003050 _____ () C:\Windows\System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F}
2015-04-03 12:50 - 2015-04-03 12:55 - 00001103 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\MindManager Viewer 2002.lnk
2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MindManager 2002
2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\Program Files (x86)\Mindjet
2015-04-02 13:02 - 2015-04-02 13:02 - 00000000 ____D () C:\Users\Holger Carlson\Documents\TomTom
2015-03-29 13:32 - 2015-03-29 13:33 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\CANON INC
2015-03-29 13:14 - 2015-04-07 23:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-28 11:32 - 2015-03-28 11:32 - 00013703 _____ () C:\Users\Holger Carlson\Documents\~WRD3122.tmp
2015-03-26 19:35 - 2015-03-26 19:35 - 00015595 _____ () C:\Users\Holger Carlson\Documents\Hapimag.htm
2015-03-25 08:28 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 08:28 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 08:28 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 08:28 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 08:28 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 08:28 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 08:28 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 08:28 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-24 10:56 - 2015-03-24 10:56 - 00221029 _____ () C:\Users\Holger Carlson\Documents\ohne tan.xps
2015-03-17 20:28 - 2015-03-17 20:30 - 100632535 _____ (Igor Pavlov) C:\Users\Holger Carlson\Documents\firmware_eBook-Reader_3-0_v-eBR30_1.0.8_20120106.exe
2015-03-17 20:14 - 2015-03-18 19:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Kindle Content
2015-03-17 20:14 - 2015-03-17 20:14 - 00002276 _____ () C:\Users\Holger Carlson\Desktop\Kindle.lnk
2015-03-17 20:14 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2015-03-17 20:13 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Amazon
2015-03-17 20:12 - 2015-03-17 20:13 - 40891792 _____ (Amazon.com) C:\Users\Holger Carlson\Documents\KindleForPC-installer.exe
2015-03-17 00:47 - 2015-03-17 00:49 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Digital Editions
2015-03-17 00:47 - 2015-03-17 00:47 - 00002152 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.0.lnk
2015-03-17 00:47 - 2015-03-17 00:47 - 00002140 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 4.0.lnk
2015-03-17 00:46 - 2015-03-17 00:46 - 08132576 _____ (Adobe Systems Incorporated) C:\Users\Holger Carlson\Documents\ADE_4.0_Installer.exe
2015-03-17 00:32 - 2015-03-17 00:32 - 13245728 _____ () C:\Users\Holger Carlson\Documents\Update.exe
2015-03-12 15:10 - 2015-03-29 13:34 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-03-12 15:10 - 2015-03-12 15:10 - 00000000 ____D () C:\Users\Holger Carlson\Documents\alles was geschrieben wird
2015-03-11 17:04 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 17:04 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 17:04 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 17:04 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 17:04 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 17:04 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 17:04 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 17:04 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 17:04 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 17:04 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 17:04 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 17:04 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-11 17:04 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-11 17:04 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-11 17:04 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-11 17:04 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 17:04 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-11 17:04 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-11 17:04 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-11 17:04 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-11 17:04 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-11 17:04 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-11 17:04 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-11 17:04 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-11 17:04 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-11 17:04 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-11 17:04 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-03-11 17:04 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-03-11 17:03 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-11 17:03 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-11 17:03 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 17:03 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-11 17:03 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-11 17:03 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-11 17:03 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-11 17:03 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-11 17:03 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-11 17:03 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 17:03 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 17:03 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-11 17:03 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-11 17:03 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 17:03 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-11 17:03 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 17:03 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-11 17:03 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-11 17:03 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-11 17:03 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 17:03 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-11 17:03 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-11 17:03 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-11 17:03 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-11 17:03 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-11 17:03 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-11 17:03 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-11 17:03 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-11 17:03 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-11 17:03 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-11 17:03 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-11 17:03 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-11 17:03 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-11 17:03 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-11 17:02 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 17:02 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 17:02 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 17:02 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 17:02 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 17:02 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 17:02 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 17:02 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 17:02 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 17:02 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 17:02 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 17:02 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 17:02 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 17:02 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 17:02 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 17:02 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 17:02 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 17:02 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 17:02 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-11 17:02 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-11 17:02 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-11 17:02 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-11 17:02 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-11 17:02 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-11 17:02 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-11 17:02 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-11 17:02 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-11 17:02 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-11 17:02 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-11 17:02 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-11 17:02 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-11 17:02 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 17:02 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 17:02 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 17:02 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 17:02 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 17:02 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 17:02 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 17:02 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 17:02 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-11 17:01 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 17:01 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-11 17:01 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-11 17:01 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-11 17:01 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-11 17:01 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-11 17:01 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-11 17:01 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-11 17:01 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-11 17:01 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-11 17:01 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-11 17:01 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-11 17:01 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-11 17:01 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-11 17:01 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-11 17:01 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-11 17:01 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-11 17:01 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-11 17:01 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-11 17:01 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-11 17:01 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-11 17:01 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-11 17:01 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-11 17:01 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-11 17:01 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-11 17:01 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-11 17:01 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-11 17:01 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-11 17:01 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-11 17:01 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-11 17:01 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-11 17:01 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-11 17:01 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-11 17:01 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-11 17:01 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-11 17:01 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-11 17:01 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-11 17:01 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-11 17:01 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-11 17:01 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-11 17:01 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-11 17:01 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-11 17:01 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-11 17:01 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-11 17:01 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-11 17:01 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-11 17:01 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-11 17:01 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-11 17:01 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-11 17:01 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-11 17:01 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-11 17:01 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-11 17:01 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-11 17:01 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-11 17:01 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-11 17:01 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-11 17:01 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-11 16:56 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 16:56 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-10 18:22 - 2015-03-10 18:22 - 00001262 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk
2015-03-10 18:21 - 2015-03-10 18:21 - 00000000 ____D () C:\Program Files\paint.net
2015-03-10 18:20 - 2015-03-10 18:38 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\paint.net
2015-03-10 18:19 - 2015-03-10 18:19 - 06554872 _____ () C:\Users\Holger Carlson\Documents\paint.net.4.0.5.install.exe
2015-03-10 18:15 - 2015-03-10 18:15 - 00372688 _____ () C:\Users\Holger Carlson\Documents\paint.net.4.0.5.install_CB-DL-Manager.exe
2015-03-10 17:56 - 2015-03-10 17:56 - 00000000 ____D () C:\ebay1

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-08 15:04 - 2014-02-02 17:36 - 00000000 ____D () C:\FRST
2015-04-08 15:03 - 2012-01-25 17:34 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-08 15:00 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-08 15:00 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-08 14:57 - 2014-03-22 13:03 - 01212293 _____ () C:\Windows\WindowsUpdate.log
2015-04-08 14:57 - 2009-08-04 11:51 - 00734178 _____ () C:\Windows\system32\perfh007.dat
2015-04-08 14:57 - 2009-08-04 11:51 - 00158606 _____ () C:\Windows\system32\perfc007.dat
2015-04-08 14:57 - 2009-07-14 07:13 - 01701722 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-08 14:53 - 2014-08-12 16:34 - 00011202 _____ () C:\Windows\setupact.log
2015-04-08 14:53 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-08 10:11 - 2014-02-08 19:23 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-08 00:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-08 00:16 - 2011-03-12 10:24 - 00045056 _____ () C:\Windows\system32\acovcnt.exe
2015-04-08 00:15 - 2014-08-15 08:33 - 00825176 _____ () C:\Windows\PFRO.log
2015-04-08 00:13 - 2014-05-13 11:11 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%
2015-04-07 23:37 - 2015-01-30 17:35 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-07 18:59 - 2014-11-21 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Driver Updater
2015-04-07 18:59 - 2011-03-26 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WritePro
2015-04-07 18:32 - 2010-10-08 20:33 - 00000000 ____D () C:\Program Files (x86)\Google
2015-04-06 18:33 - 2011-02-13 19:44 - 00013030 _____ () C:\Windows\PDOXUSRS.NET
2015-04-06 18:12 - 2014-02-08 19:23 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-06 18:12 - 2013-08-18 17:45 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-06 18:12 - 2013-08-18 17:45 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-06 18:02 - 2011-02-11 13:02 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Google
2015-04-06 17:51 - 2012-04-03 12:21 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-04-06 11:31 - 2015-01-20 11:53 - 00000975 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-06 09:48 - 2011-04-15 19:24 - 00014848 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-05 10:43 - 2012-09-04 17:54 - 00006144 ____H () C:\Users\Holger Carlson\Documents\photothumb.db
2015-04-05 10:09 - 2010-10-08 21:00 - 00004200 _____ () C:\Windows\system32\AutoRunFilter.ini
2015-04-05 09:53 - 2015-01-30 16:55 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\dlg
2015-04-03 19:08 - 2013-09-28 13:18 - 00000000 ____D () C:\backup
2015-04-03 18:43 - 2014-08-19 14:14 - 00001564 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Buchliebhaber.lnk
2015-04-03 18:43 - 2011-02-13 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Buchliebhaber
2015-04-03 18:42 - 2011-02-15 14:16 - 00000000 ____D () C:\ProgramData\Paradox
2015-04-03 17:59 - 2014-07-24 19:21 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\GlarySoft
2015-04-03 17:59 - 2014-07-24 19:20 - 00001232 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk
2015-04-03 17:59 - 2014-07-24 19:20 - 00001220 _____ () C:\Users\Public\Desktop\Absolute Uninstaller.lnk
2015-04-03 13:42 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-04-03 13:35 - 2011-09-06 09:09 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-04-03 13:34 - 2015-02-11 18:19 - 00024652 _____ () C:\Windows\DPINST.LOG
2015-04-03 13:04 - 2011-09-06 09:10 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Samsung
2015-04-03 13:04 - 2010-10-08 20:22 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-26 13:16 - 2014-09-09 16:34 - 00000000 ____D () C:\Buchliebhaber
2015-03-26 12:06 - 2010-10-08 21:00 - 00002391 _____ () C:\Windows\system32\ServiceFilter.ini
2015-03-26 12:01 - 2014-12-12 15:04 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 12:01 - 2014-07-25 16:01 - 00525312 _____ () C:\Users\Holger Carlson\Documents\Outlook.pst
2015-03-26 12:01 - 2014-05-08 09:46 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-24 19:37 - 2014-02-08 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-03-24 12:27 - 2015-02-27 11:16 - 00000348 _____ () C:\Windows\Tasks\0215tbUpdateInfo.job
2015-03-24 12:27 - 2015-02-27 11:16 - 00000000 ____D () C:\ProgramData\Avg_Update_0215tb
2015-03-24 10:54 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-03-23 11:39 - 2015-02-09 11:33 - 00000000 ____D () C:\Program Files (x86)\AVG Web TuneUp
2015-03-17 00:49 - 2011-02-11 13:08 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Adobe
2015-03-17 00:47 - 2012-11-17 20:50 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Adobe_Systems_Incorporate
2015-03-17 00:47 - 2012-01-03 16:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2015-03-17 00:47 - 2010-10-08 20:32 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-03-15 16:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-03-12 14:37 - 2014-07-12 21:31 - 00424968 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-12 14:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-12 14:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-12 14:02 - 2011-02-11 17:52 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-12 14:02 - 2009-07-14 04:34 - 00000639 _____ () C:\Windows\win.ini
2015-03-12 13:51 - 2013-08-16 23:52 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-12 13:46 - 2011-07-01 21:34 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2013-12-03 17:59 - 2013-12-03 17:59 - 23288584 _____ (Mozilla) C:\Program Files\Firefox_Setup [1].exe
2014-07-13 19:39 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch (1).exe
2014-07-13 19:38 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch.exe
2007-06-12 18:34 - 2007-06-12 18:34 - 0035822 _____ () C:\Program Files (x86)\Common Files\ASPG_icon.ico
2008-05-22 17:35 - 2008-05-22 17:35 - 0051962 _____ () C:\Program Files (x86)\Common Files\banner.jpg
2009-04-08 19:31 - 2009-04-08 19:31 - 0106496 _____ () C:\Program Files (x86)\Common Files\CPInstallAction.dll
2008-08-12 06:45 - 2008-08-12 06:45 - 0155648 _____ (ASUS) C:\Program Files (x86)\Common Files\MSIactionall.dll
2013-12-19 10:19 - 2014-01-10 11:59 - 0000102 _____ () C:\Users\Holger Carlson\AppData\Roaming\WB.CFG
2011-04-15 19:24 - 2015-04-06 09:48 - 0014848 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-31 20:19 - 2015-02-01 12:37 - 0000025 _____ () C:\Users\Holger Carlson\AppData\Local\gt-props
2014-02-10 18:03 - 2014-02-10 18:03 - 0001679 _____ () C:\Users\Holger Carlson\AppData\Local\recently-used.xbel
2012-04-27 10:44 - 2012-04-27 10:44 - 0000017 _____ () C:\Users\Holger Carlson\AppData\Local\resmon.resmoncfg
2014-12-04 13:47 - 2014-12-04 13:47 - 0000000 _____ () C:\Users\Holger Carlson\AppData\Local\{C0180386-8014-4674-B1B2-C6CB0EB6F63F}
2011-02-21 18:31 - 2011-02-21 18:31 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2015-01-17 18:18 - 2015-01-17 18:18 - 0005045 _____ () C:\ProgramData\wmzddnmb.cix

Files to move or delete:
====================
C:\Users\Holger Carlson\Firefox Setup Stub 33.0.2.exe


Some content of TEMP:
====================
C:\Users\Holger Carlson\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-05 11:03

==================== End Of Log ============================
         

--- --- ---
AdwCleaner Logfile:

# AdwCleaner v4.200 - Bericht erstellt 07/04/2015 um 12:44:27
# Aktualisiert 29/03/2015 von Xplode
# Datenbank : 2015-04-06.3 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Holger Carlson - FRIDOLIN
# Gestarted von : C:\Users\Holger Carlson\Documents\adwcleaner_4.200.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\reimagerepair

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17689


-\\ Mozilla Firefox v37.0.1 (x86 de)


-\\ Google Chrome v41.0.2272.118


-\\ Opera v0.0.0.0


*************************

AdwCleaner[R4].txt - [9263 Bytes] - [06/04/2015 11:28:16]
AdwCleaner[R5].txt - [994 Bytes] - [06/04/2015 11:51:41]
AdwCleaner[R6].txt - [1157 Bytes] - [07/04/2015 12:42:05]
AdwCleaner[S2].txt - [8624 Bytes] - [06/04/2015 11:31:41]
AdwCleaner[S3].txt - [1022 Bytes] - [07/04/2015 12:44:27]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1081  Bytes] ##########
         

--- --- ---
AdwCleaner Logfile:

# AdwCleaner v4.200 - Bericht erstellt 06/04/2015 um 11:31:41
# Aktualisiert 29/03/2015 von Xplode
# Datenbank : 2015-03-29.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Holger Carlson - FRIDOLIN
# Gestarted von : C:\Users\Holger Carlson\Documents\alles was geschrieben wird\Downloads\adwcleaner_4.200.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : IHProtect Service
[#] Dienst Gelöscht : WindowsMangerProtect
[#] Dienst Gelöscht : vToolbarUpdater18.4.0

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\AVG Secure Search
Ordner Gelöscht : C:\ProgramData\AVG Security Toolbar
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\ProgramData\IHProtectUpDate
Ordner Gelöscht : C:\ProgramData\e6ad6c22000030b3
Ordner Gelöscht : C:\Program Files (x86)\XTab
Ordner Gelöscht : C:\Program Files (x86)\Common Files\AVG Secure Search
Ordner Gelöscht : C:\Users\Holger Carlson\AppData\Roaming\istartsurf
Ordner Gelöscht : C:\Users\Holger Carlson\Documents\Optimizer Pro
Datei Gelöscht : C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml
Datei Gelöscht : C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\user.js

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine
Schlüssel Gelöscht : HKLM\SOFTWARE\b2653df3-3c30-976c-1931-a2cc61ebdd00
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\DriverTuner_Init
Schlüssel Gelöscht : HKCU\Software\DriverTuner
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17689


-\\ Mozilla Firefox v36.0.4 (x86 de)

[ekdrwrk5.default\prefs.js] - Zeile Gelöscht : user_pref("Zapp_24069.global.CurrentSearchEngineSelection", "US: United States of America");
[ekdrwrk5.default\prefs.js] - Zeile Gelöscht : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[ekdrwrk5.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "istartsurf");
[ekdrwrk5.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.enable_search1", false);
[ekdrwrk5.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

-\\ Opera v0.0.0.0


*************************

AdwCleaner[R4].txt - [9263 Bytes] - [06/04/2015 11:28:16]
AdwCleaner[S2].txt - [8441 Bytes] - [06/04/2015 11:31:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [8500  Bytes] ##########
         

--- --- ---
AdwCleaner Logfile:

# AdwCleaner v4.200 - Bericht erstellt 06/04/2015 um 11:51:41
# Aktualisiert 29/03/2015 von Xplode
# Datenbank : 2015-03-29.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Holger Carlson - FRIDOLIN
# Gestarted von : C:\Users\Holger Carlson\Documents\alles was geschrieben wird\Downloads\adwcleaner_4.200(2).exe
# Option : Suchlauf

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17689


-\\ Mozilla Firefox v36.0.4 (x86 de)


-\\ Opera v0.0.0.0


*************************

AdwCleaner[R4].txt - [9263 Bytes] - [06/04/2015 11:28:16]
AdwCleaner[R5].txt - [799 Bytes] - [06/04/2015 11:51:41]
AdwCleaner[S2].txt - [8624 Bytes] - [06/04/2015 11:31:41]

########## EOF - C:\AdwCleaner\AdwCleaner[R5].txt - [916 Bytes] ##########
         

--- --- ---
AdwCleaner Logfile:

# AdwCleaner v4.200 - Bericht erstellt 06/04/2015 um 11:28:16
# Aktualisiert 29/03/2015 von Xplode
# Datenbank : 2015-03-29.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Holger Carlson - FRIDOLIN
# Gestarted von : C:\Users\Holger Carlson\Documents\alles was geschrieben wird\Downloads\adwcleaner_4.200.exe
# Option : Suchlauf

***** [ Dienste ] *****

Dienst Gefunden : IHProtect Service
Dienst Gefunden : WindowsMangerProtect
Dienst Gefunden : vToolbarUpdater18.4.0

***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml
Datei Gefunden : C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\user.js
Datei Gefunden : C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb
Ordner Gefunden : C:\Program Files (x86)\Common Files\AVG Secure Search
Ordner Gefunden : C:\Program Files (x86)\XTab
Ordner Gefunden : C:\ProgramData\AVG Secure Search
Ordner Gefunden : C:\ProgramData\AVG Security Toolbar
Ordner Gefunden : C:\ProgramData\e6ad6c22000030b3
Ordner Gefunden : C:\ProgramData\IHProtectUpDate
Ordner Gefunden : C:\ProgramData\WindowsMangerProtect
Ordner Gefunden : C:\Users\Holger Carlson\AppData\Roaming\istartsurf
Ordner Gefunden : C:\Users\Holger Carlson\Documents\Optimizer Pro

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****

Verknüpfung Infiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Infiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Infiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Infiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Infiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
Verknüpfung Infiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gefunden : HKCU\Software\DriverTuner
Schlüssel Gefunden : HKCU\Software\DriverTuner_Init
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Schlüssel Gefunden : HKCU\Software\Optimizer Pro
Schlüssel Gefunden : [x64] HKCU\Software\DriverTuner
Schlüssel Gefunden : [x64] HKCU\Software\DriverTuner_Init
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}
Schlüssel Gefunden : [x64] HKCU\Software\Optimizer Pro
Schlüssel Gefunden : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gefunden : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gefunden : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gefunden : HKLM\SOFTWARE\b2653df3-3c30-976c-1931-a2cc61ebdd00
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\S
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gefunden : HKLM\SOFTWARE\SupDp
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17689


-\\ Mozilla Firefox v36.0.4 (x86 de)

[ekdrwrk5.default] - Zeile Gefunden : user_pref("Zapp_24069.global.CurrentSearchEngineSelection", "US: United States of America");
[ekdrwrk5.default] - Zeile Gefunden : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[ekdrwrk5.default] - Zeile Gefunden : user_pref("browser.search.selectedEngine", "istartsurf");
[ekdrwrk5.default] - Zeile Gefunden : user_pref("extensions.quick_start.enable_search1", false);
[ekdrwrk5.default] - Zeile Gefunden : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

-\\ Opera v0.0.0.0


*************************

AdwCleaner[R4].txt - [9053 Bytes] - [06/04/2015 11:28:16]

########## EOF - C:\AdwCleaner\AdwCleaner[R4].txt - [9112 Bytes] ##########
         

--- --- ---
[/CODE]

1. Schritt: Malwarebytes (MBAM)

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

ich habe Addition.txt nicht gefunden und weiß nicht ob das bei JRT richtig ist?


1. Schritt: MBAM

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 12.04.2015
Suchlauf-Zeit: 08:59:18
Logdatei: Ergebnisse Bedrohungssuchlauf.txt
Administrator: Ja

Version: 2.01.4.1018
Malware Datenbank: v2015.04.11.08
Rootkit Datenbank: v2015.03.31.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Holger Carlson

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 418984
Verstrichene Zeit: 33 Min, 57 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 1
PUP.Optional.IStartSurf.A, HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|TopResultURL, hxxp://www.istartsurf.com/web/?type=ds&ts=1428220662&from=pcs&uid=ST9320325AS_6VD6MB83XXXX6VD6MB83&q={searchTerms}, , [9db74724f298e155549c4b078e777d83]

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 1
PUP.Optional.Somoto.SID.A, C:\Users\Holger Carlson\Documents\OLIVETTI_downloader-QaZJ7date.exe, , [ca8ae58601891a1cdcaba09bac5a2dd3], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Holger Carlson (administrator) on FRIDOLIN on 12-04-2015 12:53:40
Running from H:\
Loaded Profiles: Holger Carlson (Available profiles: Holger Carlson)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1928976 2010-03-05] (Intel(R) Corporation)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-06] (Avast Software s.r.o.)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-08-12] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2015-03-30] (Glarysoft Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll ()
ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll ()
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll ()
ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll ()
BootExecute: autocheck autochk *  
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56939;https=127.0.0.1:56939
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP8803837A-1DA4-472E-BAE6-FF0BFD270EFC&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&q={searchTerms}
BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files\Windows Live\Family Safety\fssbho.dll [2008-12-08] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-06] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-06] (Avast Software s.r.o.)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {534D542D-5637-006A-76A7-7A786E7484D7} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{42264728-0917-4958-91BA-C18941410592}: [NameServer] 0.0.0.0
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default
FF SearchEngineOrder.1: Google (avast)
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-04-06] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-04-06] ()
FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll [2008-10-15] (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2008-12-04] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\bing-avast.xml [2014-11-16]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-avast.xml [2015-02-01]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-images.xml [2014-10-14]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-maps.xml [2014-10-14]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\yahoo-avast.xml [2014-09-19]
FF Extension: Avira Browser Safety - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\abs@avira.com [2015-03-31]
FF Extension: WEB.DE MailCheck - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\toolbar@web.de [2015-04-05]
FF Extension: OkayFreedom - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\{DB981CCA-088E-4731-A4A2-2FE218703C0E}.xpi [2015-04-05]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-06]
FF HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-06]
CHR Extension: (Google Docs) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-06]
CHR Extension: (Google Drive) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-06]
CHR Extension: (YouTube) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-06]
CHR Extension: (Google Search) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-06]
CHR Extension: (Google Sheets) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-06]
CHR Extension: (Avast Online Security) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-06]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-06]
CHR Extension: (Google Wallet) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-06]
CHR Extension: (Gmail) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-06]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [fknfdieimobmimhdkfkheeejenmdjhoe] - C:\Program Files (x86)\pandasecuritytb\chrome-newtab-search.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-06]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ADSMService; C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-06] (Avast Software s.r.o.)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [File not signed]
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()
S3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-04-06] () [File not signed]
S2 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-23] ()
S2 TomTomHOMEService; "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-06] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-06] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-06] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-06] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-06] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-06] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-06] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2014-11-14] ()
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2015-04-03] (Glarysoft Ltd)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA64.sys [649984 2009-09-01] (eMPIA Technology, Inc.) [File not signed]
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM64.sys [626688 2009-09-02] (eMPIA Technology, Inc.) [File not signed]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
U3 tmlwf; No ImagePath
U3 tmwfp; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-12 12:51 - 2015-04-12 12:51 - 00000634 _____ () C:\Users\Holger Carlson\Desktop\JRT.txt
2015-04-12 12:46 - 2015-04-12 12:46 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-FRIDOLIN-Windows-7-Home-Premium-(64-bit).dat
2015-04-12 12:46 - 2015-04-12 12:46 - 00000000 ____D () C:\RegBackup
2015-04-08 17:40 - 2015-04-08 17:40 - 00000000 ____D () C:\Users\Holger Carlson\Documents\ASUS
2015-04-07 18:57 - 2015-04-07 18:57 - 00000000 ____D () C:\ProgramData\GlarySoft
2015-04-07 18:44 - 2015-04-07 18:59 - 00000000 ___HD () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled
2015-04-07 18:43 - 2015-04-07 18:44 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup-Disabled
2015-04-06 18:57 - 2015-04-06 18:57 - 00001884 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-06 18:56 - 2015-04-06 18:56 - 00356232 _____ (Dropbox, Inc.) C:\Users\Public\Desktop\DropboxInstallerAvast.exe
2015-04-06 18:56 - 2015-04-06 17:55 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-06 18:01 - 2015-04-06 18:01 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\AVAST Software
2015-04-06 17:59 - 2015-04-06 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-06 17:59 - 2015-04-06 18:01 - 00002037 _____ () C:\Users\Public\Desktop\Avast Premier.lnk
2015-04-06 17:59 - 2015-04-06 17:59 - 00001944 _____ () C:\Users\Public\Desktop\Avast SafeZone.lnk
2015-04-06 17:58 - 2015-04-12 08:58 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-04-06 17:56 - 2015-04-06 17:55 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-06 17:56 - 2015-04-06 17:55 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-06 17:55 - 2015-04-06 17:55 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-06 17:52 - 2015-04-06 17:52 - 00000000 ____D () C:\Program Files\AVAST Software
2015-04-06 17:11 - 2015-04-06 17:11 - 00000000 ____D () C:\Olivetti
2015-04-06 11:28 - 2015-04-07 12:44 - 00000000 ____D () C:\AdwCleaner
2015-04-06 10:27 - 2015-04-11 15:04 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\CrashDumps
2015-04-05 09:52 - 2015-04-05 10:03 - 00000000 ____D () C:\ProgramData\Informer Technologies, Inc
2015-04-05 09:51 - 2015-04-05 09:51 - 03568824 _____ (Informer Technologies, Inc. ) C:\Users\Holger Carlson\Documents\siinst.exe
2015-04-05 09:45 - 2015-04-06 09:42 - 00000000 ____D () C:\ProgramData\{95f4c13f-5638-faae-95f4-4c13f56304fd}
2015-04-05 09:45 - 2015-04-05 09:45 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Drivers et Pilotes
2015-04-05 09:44 - 2015-04-05 10:03 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos
2015-04-05 09:44 - 2015-04-05 09:44 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos VPN
2015-04-05 09:23 - 2015-04-05 09:24 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-05 09:23 - 2015-04-05 09:23 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-04 17:35 - 2015-04-04 17:36 - 00000000 ____D () C:\Users\Holger Carlson\Documents\Wondershare Video Editor
2015-04-03 19:25 - 2015-04-03 19:25 - 00002950 _____ () C:\Windows\System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8}
2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB}
2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D}
2015-04-03 18:43 - 2015-04-03 18:43 - 00001534 _____ () C:\Users\Holger Carlson\Desktop\Buchliebhaber.lnk
2015-04-03 18:42 - 2015-04-03 18:43 - 00000000 ____D () C:\Buchliebhaber1
2015-04-03 18:12 - 2015-04-03 18:12 - 00003050 _____ () C:\Windows\System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E}
2015-04-03 17:59 - 2015-04-12 11:51 - 00000352 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
2015-04-03 17:59 - 2015-04-12 11:50 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
2015-04-03 17:59 - 2015-04-03 17:59 - 00020160 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2015-04-03 17:59 - 2015-04-03 17:59 - 00002990 _____ () C:\Windows\System32\Tasks\GU5SkipUAC
2015-04-03 17:59 - 2015-04-03 17:59 - 00002666 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5
2015-04-03 17:59 - 2015-04-03 17:59 - 00001909 _____ () C:\GUDownLoaddebug.txt
2015-04-03 17:59 - 2015-04-03 17:59 - 00001054 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2015-04-03 17:59 - 2015-04-03 17:59 - 00001042 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk
2015-04-03 17:59 - 2015-04-03 17:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2015-04-03 17:58 - 2015-04-03 17:58 - 04737952 _____ () C:\Users\Holger Carlson\Documents\ausetup.exe
2015-04-03 13:06 - 2015-04-03 13:06 - 00000000 ____D () C:\Program Files\DIFX
2015-04-03 13:04 - 2015-04-03 13:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My NPS Files
2015-04-03 12:54 - 2015-04-03 12:54 - 00003050 _____ () C:\Windows\System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F}
2015-04-03 12:50 - 2015-04-03 12:55 - 00001103 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\MindManager Viewer 2002.lnk
2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MindManager 2002
2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\Program Files (x86)\Mindjet
2015-04-02 13:02 - 2015-04-02 13:02 - 00000000 ____D () C:\Users\Holger Carlson\Documents\TomTom
2015-03-29 13:32 - 2015-03-29 13:33 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\CANON INC
2015-03-29 13:14 - 2015-04-07 23:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-28 11:32 - 2015-03-28 11:32 - 00013703 _____ () C:\Users\Holger Carlson\Documents\~WRD3122.tmp
2015-03-26 19:35 - 2015-03-26 19:35 - 00015595 _____ () C:\Users\Holger Carlson\Documents\Hapimag.htm
2015-03-25 08:28 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 08:28 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 08:28 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 08:28 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 08:28 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 08:28 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 08:28 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 08:28 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-24 10:56 - 2015-03-24 10:56 - 00221029 _____ () C:\Users\Holger Carlson\Documents\ohne tan.xps
2015-03-17 20:28 - 2015-03-17 20:30 - 100632535 _____ (Igor Pavlov) C:\Users\Holger Carlson\Documents\firmware_eBook-Reader_3-0_v-eBR30_1.0.8_20120106.exe
2015-03-17 20:14 - 2015-03-18 19:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Kindle Content
2015-03-17 20:14 - 2015-03-17 20:14 - 00002276 _____ () C:\Users\Holger Carlson\Desktop\Kindle.lnk
2015-03-17 20:14 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2015-03-17 20:13 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Amazon
2015-03-17 20:12 - 2015-03-17 20:13 - 40891792 _____ (Amazon.com) C:\Users\Holger Carlson\Documents\KindleForPC-installer.exe
2015-03-17 00:47 - 2015-03-17 00:49 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Digital Editions
2015-03-17 00:47 - 2015-03-17 00:47 - 00002152 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.0.lnk
2015-03-17 00:47 - 2015-03-17 00:47 - 00002140 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 4.0.lnk
2015-03-17 00:46 - 2015-03-17 00:46 - 08132576 _____ (Adobe Systems Incorporated) C:\Users\Holger Carlson\Documents\ADE_4.0_Installer.exe
2015-03-17 00:32 - 2015-03-17 00:32 - 13245728 _____ () C:\Users\Holger Carlson\Documents\Update.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-12 12:53 - 2014-02-02 17:36 - 00000000 ____D () C:\FRST
2015-04-12 12:53 - 2009-08-04 11:51 - 00734178 _____ () C:\Windows\system32\perfh007.dat
2015-04-12 12:53 - 2009-08-04 11:51 - 00158606 _____ () C:\Windows\system32\perfc007.dat
2015-04-12 12:53 - 2009-07-14 07:13 - 01701722 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-12 12:47 - 2012-01-25 17:34 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-12 12:11 - 2014-02-08 19:23 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-12 12:00 - 2015-01-30 17:35 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-12 11:56 - 2014-03-22 13:03 - 01320131 _____ () C:\Windows\WindowsUpdate.log
2015-04-12 11:56 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-12 11:56 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-12 11:49 - 2014-08-15 08:33 - 00826178 _____ () C:\Windows\PFRO.log
2015-04-12 11:49 - 2014-08-12 16:34 - 00011314 _____ () C:\Windows\setupact.log
2015-04-12 11:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-11 19:46 - 2014-07-24 19:21 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\GlarySoft
2015-04-11 19:24 - 2012-09-04 17:54 - 00006144 ____H () C:\Users\Holger Carlson\Documents\photothumb.db
2015-04-11 19:14 - 2011-04-15 19:24 - 00015360 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-08 15:47 - 2013-03-03 13:04 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Deployment
2015-04-08 15:23 - 2015-01-30 17:34 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-08 15:23 - 2015-01-30 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-08 15:23 - 2015-01-30 17:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-04-08 00:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-08 00:16 - 2011-03-12 10:24 - 00045056 _____ () C:\Windows\system32\acovcnt.exe
2015-04-08 00:13 - 2014-05-13 11:11 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%
2015-04-07 18:59 - 2014-11-21 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Driver Updater
2015-04-07 18:59 - 2011-03-26 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WritePro
2015-04-07 18:32 - 2010-10-08 20:33 - 00000000 ____D () C:\Program Files (x86)\Google
2015-04-06 18:33 - 2011-02-13 19:44 - 00013030 _____ () C:\Windows\PDOXUSRS.NET
2015-04-06 18:12 - 2014-02-08 19:23 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-06 18:12 - 2013-08-18 17:45 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-06 18:12 - 2013-08-18 17:45 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-06 18:02 - 2011-02-11 13:02 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Google
2015-04-06 17:51 - 2012-04-03 12:21 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-04-06 11:31 - 2015-01-20 11:53 - 00000975 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-05 10:09 - 2010-10-08 21:00 - 00004200 _____ () C:\Windows\system32\AutoRunFilter.ini
2015-04-05 09:53 - 2015-01-30 16:55 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\dlg
2015-04-03 19:08 - 2013-09-28 13:18 - 00000000 ____D () C:\backup
2015-04-03 18:43 - 2014-08-19 14:14 - 00001564 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Buchliebhaber.lnk
2015-04-03 18:43 - 2011-02-13 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Buchliebhaber
2015-04-03 18:42 - 2011-02-15 14:16 - 00000000 ____D () C:\ProgramData\Paradox
2015-04-03 17:59 - 2014-07-24 19:20 - 00001232 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk
2015-04-03 17:59 - 2014-07-24 19:20 - 00001220 _____ () C:\Users\Public\Desktop\Absolute Uninstaller.lnk
2015-04-03 13:42 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-04-03 13:35 - 2011-09-06 09:09 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-04-03 13:34 - 2015-02-11 18:19 - 00024652 _____ () C:\Windows\DPINST.LOG
2015-04-03 13:04 - 2011-09-06 09:10 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Samsung
2015-04-03 13:04 - 2010-10-08 20:22 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-29 13:34 - 2015-03-12 15:10 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-03-26 13:16 - 2014-09-09 16:34 - 00000000 ____D () C:\Buchliebhaber
2015-03-26 12:06 - 2010-10-08 21:00 - 00002391 _____ () C:\Windows\system32\ServiceFilter.ini
2015-03-26 12:01 - 2014-12-12 15:04 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 12:01 - 2014-07-25 16:01 - 00525312 _____ () C:\Users\Holger Carlson\Documents\Outlook.pst
2015-03-26 12:01 - 2014-05-08 09:46 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-24 19:37 - 2014-02-08 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-03-24 12:27 - 2015-02-27 11:16 - 00000348 _____ () C:\Windows\Tasks\0215tbUpdateInfo.job
2015-03-24 12:27 - 2015-02-27 11:16 - 00000000 ____D () C:\ProgramData\Avg_Update_0215tb
2015-03-24 10:54 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-03-23 11:39 - 2015-02-09 11:33 - 00000000 ____D () C:\Program Files (x86)\AVG Web TuneUp
2015-03-17 06:15 - 2015-01-30 17:34 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-17 06:15 - 2015-01-30 17:34 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-17 06:15 - 2015-01-30 17:34 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-17 00:49 - 2011-02-11 13:08 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Adobe
2015-03-17 00:47 - 2012-11-17 20:50 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Adobe_Systems_Incorporate
2015-03-17 00:47 - 2012-01-03 16:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2015-03-17 00:47 - 2010-10-08 20:32 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-03-15 16:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

==================== Files in the root of some directories =======

2013-12-03 17:59 - 2013-12-03 17:59 - 23288584 _____ (Mozilla) C:\Program Files\Firefox_Setup [1].exe
2014-07-13 19:39 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch (1).exe
2014-07-13 19:38 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch.exe
2007-06-12 18:34 - 2007-06-12 18:34 - 0035822 _____ () C:\Program Files (x86)\Common Files\ASPG_icon.ico
2008-05-22 17:35 - 2008-05-22 17:35 - 0051962 _____ () C:\Program Files (x86)\Common Files\banner.jpg
2009-04-08 19:31 - 2009-04-08 19:31 - 0106496 _____ () C:\Program Files (x86)\Common Files\CPInstallAction.dll
2008-08-12 06:45 - 2008-08-12 06:45 - 0155648 _____ (ASUS) C:\Program Files (x86)\Common Files\MSIactionall.dll
2013-12-19 10:19 - 2014-01-10 11:59 - 0000102 _____ () C:\Users\Holger Carlson\AppData\Roaming\WB.CFG
2011-04-15 19:24 - 2015-04-11 19:14 - 0015360 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-31 20:19 - 2015-02-01 12:37 - 0000025 _____ () C:\Users\Holger Carlson\AppData\Local\gt-props
2014-02-10 18:03 - 2014-02-10 18:03 - 0001679 _____ () C:\Users\Holger Carlson\AppData\Local\recently-used.xbel
2012-04-27 10:44 - 2012-04-27 10:44 - 0000017 _____ () C:\Users\Holger Carlson\AppData\Local\resmon.resmoncfg
2014-12-04 13:47 - 2014-12-04 13:47 - 0000000 _____ () C:\Users\Holger Carlson\AppData\Local\{C0180386-8014-4674-B1B2-C6CB0EB6F63F}
2011-02-21 18:31 - 2011-02-21 18:31 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2015-01-17 18:18 - 2015-01-17 18:18 - 0005045 _____ () C:\ProgramData\wmzddnmb.cix

Files to move or delete:
====================
C:\Users\Holger Carlson\Firefox Setup Stub 33.0.2.exe


Some content of TEMP:
====================
C:\Users\Holger Carlson\AppData\Local\Temp\avgnt.exe
C:\Users\Holger Carlson\AppData\Local\Temp\Quarantine.exe
C:\Users\Holger Carlson\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-05 11:03

==================== End Of Log ============================
         

--- --- ---

--- --- ---

2. Schritt JRM

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.3 (04.07.2015:1)
OS: Windows 7 Home Premium x64
Ran by Holger Carlson on 12.04.2015 at 12:46:17,20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.04.2015 at 12:51:09,06
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Zukünftig bitte beachten:

Running from H:\

Leider hast du unsere Anleitung nicht richtig befolgt:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind.
Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen.
Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter.


Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.

ich habe avast Free Antivirus + AVG Web TuneUp + Wondershare Video Editor+ Glary Utilities + Anti-Twin deinstalliert, weil auch mein letzter Browser :Internet Exporer, nicht mehr wollte.

Malewarebytes

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 13.04.2015
Suchlauf-Zeit: 09:57:54
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.4.1018
Malware Datenbank: v2015.04.13.03
Rootkit Datenbank: v2015.03.31.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Holger Carlson

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 417851
Verstrichene Zeit: 1 Std, 29 Min, 48 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Warnen

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 3
PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI\Installr, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI\Installr\2.bin, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 

Dateien: 3
PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI\Installr\2.bin\8hEIPlug.dll, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI\Installr\2.bin\8hEZSETP.dll, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI\Installr\2.bin\NP8hEISb.dll, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
         

JRT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.3 (04.07.2015:1)
OS: Windows 7 Home Premium x64
Ran by Holger Carlson on 13.04.2015 at 11:52:12,27
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.04.2015 at 11:56:50,25
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST
FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-04-2015
Ran by Holger Carlson (administrator) on FRIDOLIN on 13-04-2015 12:00:27
Running from C:\Users\Holger Carlson\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XF329JBY
Loaded Profiles: Holger Carlson (Available profiles: Holger Carlson)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1928976 2010-03-05] (Intel(R) Corporation)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-08-12] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll ()
ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll ()
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll ()
ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56939;https=127.0.0.1:56939
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP8803837A-1DA4-472E-BAE6-FF0BFD270EFC&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&q={searchTerms}
BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files\Windows Live\Family Safety\fssbho.dll [2008-12-08] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {534D542D-5637-006A-76A7-7A786E7484D7} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{42264728-0917-4958-91BA-C18941410592}: [NameServer] 0.0.0.0
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default
FF SearchEngineOrder.1: Google (avast)
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-04-06] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-04-06] ()
FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll [2008-10-15] (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2008-12-04] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\bing-avast.xml [2014-11-16]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-avast.xml [2015-02-01]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-images.xml [2014-10-14]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-maps.xml [2014-10-14]
FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\yahoo-avast.xml [2014-09-19]
FF Extension: Avira Browser Safety - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\abs@avira.com [2015-03-31]
FF Extension: WEB.DE MailCheck - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\toolbar@web.de [2015-04-05]
FF Extension: OkayFreedom - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\{DB981CCA-088E-4731-A4A2-2FE218703C0E}.xpi [2015-04-05]
FF HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-06]
CHR Extension: (Google Docs) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-06]
CHR Extension: (Google Drive) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-06]
CHR Extension: (YouTube) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-06]
CHR Extension: (Google Search) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-06]
CHR Extension: (Google Sheets) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-06]
CHR Extension: (Avast Online Security) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-06]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-06]
CHR Extension: (Google Wallet) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-06]
CHR Extension: (Gmail) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-06]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [fknfdieimobmimhdkfkheeejenmdjhoe] - C:\Program Files (x86)\pandasecuritytb\chrome-newtab-search.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ADSMService; C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [File not signed]
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [File not signed]
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()
S3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-04-06] () [File not signed]
S2 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-23] ()
S2 TomTomHOMEService; "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2014-11-14] ()
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-13] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA64.sys [649984 2009-09-01] (eMPIA Technology, Inc.) [File not signed]
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM64.sys [626688 2009-09-02] (eMPIA Technology, Inc.) [File not signed]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
U3 tmlwf; No ImagePath
U3 tmwfp; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-13 12:00 - 2015-04-13 12:00 - 00000000 ____D () C:\FRST
2015-04-13 11:56 - 2015-04-13 11:56 - 00000634 _____ () C:\Users\Holger Carlson\Desktop\JRT.txt
2015-04-13 11:49 - 2015-04-13 11:49 - 00001981 _____ () C:\mbam.txt
2015-04-13 09:55 - 2015-04-13 11:47 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-13 09:54 - 2015-04-13 09:57 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-13 09:54 - 2015-04-13 09:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-13 09:54 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-13 09:54 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-13 09:54 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-12 13:41 - 2015-04-12 13:41 - 00003132 _____ () C:\Windows\System32\Tasks\{69024FA6-BE33-473D-B9A3-EE1A4D9E4625}
2015-04-12 12:46 - 2015-04-12 12:46 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-FRIDOLIN-Windows-7-Home-Premium-(64-bit).dat
2015-04-12 12:46 - 2015-04-12 12:46 - 00000000 ____D () C:\RegBackup
2015-04-08 17:40 - 2015-04-08 17:40 - 00000000 ____D () C:\Users\Holger Carlson\Documents\ASUS
2015-04-07 18:57 - 2015-04-13 09:45 - 00000000 ____D () C:\ProgramData\GlarySoft
2015-04-07 18:44 - 2015-04-07 18:59 - 00000000 ___HD () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled
2015-04-07 18:43 - 2015-04-07 18:44 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup-Disabled
2015-04-06 18:57 - 2015-04-06 18:57 - 00001884 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-06 18:56 - 2015-04-06 18:56 - 00356232 _____ (Dropbox, Inc.) C:\Users\Public\Desktop\DropboxInstallerAvast.exe
2015-04-06 17:59 - 2015-04-06 18:01 - 00002037 _____ () C:\Users\Public\Desktop\Avast Premier.lnk
2015-04-06 17:59 - 2015-04-06 17:59 - 00001944 _____ () C:\Users\Public\Desktop\Avast SafeZone.lnk
2015-04-06 17:11 - 2015-04-06 17:11 - 00000000 ____D () C:\Olivetti
2015-04-06 10:27 - 2015-04-12 18:55 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\CrashDumps
2015-04-05 09:52 - 2015-04-05 10:03 - 00000000 ____D () C:\ProgramData\Informer Technologies, Inc
2015-04-05 09:51 - 2015-04-05 09:51 - 03568824 _____ (Informer Technologies, Inc. ) C:\Users\Holger Carlson\Documents\siinst.exe
2015-04-05 09:45 - 2015-04-06 09:42 - 00000000 ____D () C:\ProgramData\{95f4c13f-5638-faae-95f4-4c13f56304fd}
2015-04-05 09:45 - 2015-04-05 09:45 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Drivers et Pilotes
2015-04-05 09:44 - 2015-04-05 10:03 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos
2015-04-05 09:44 - 2015-04-05 09:44 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos VPN
2015-04-05 09:23 - 2015-04-05 09:24 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-05 09:23 - 2015-04-05 09:23 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-04 17:35 - 2015-04-04 17:36 - 00000000 ____D () C:\Users\Holger Carlson\Documents\Wondershare Video Editor
2015-04-03 19:25 - 2015-04-03 19:25 - 00002950 _____ () C:\Windows\System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8}
2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB}
2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D}
2015-04-03 18:43 - 2015-04-03 18:43 - 00001534 _____ () C:\Users\Holger Carlson\Desktop\Buchliebhaber.lnk
2015-04-03 18:42 - 2015-04-03 18:43 - 00000000 ____D () C:\Buchliebhaber1
2015-04-03 18:12 - 2015-04-03 18:12 - 00003050 _____ () C:\Windows\System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E}
2015-04-03 17:58 - 2015-04-03 17:58 - 04737952 _____ () C:\Users\Holger Carlson\Documents\ausetup.exe
2015-04-03 13:06 - 2015-04-03 13:06 - 00000000 ____D () C:\Program Files\DIFX
2015-04-03 13:04 - 2015-04-03 13:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My NPS Files
2015-04-03 12:54 - 2015-04-03 12:54 - 00003050 _____ () C:\Windows\System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F}
2015-04-03 12:50 - 2015-04-03 12:55 - 00001103 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\MindManager Viewer 2002.lnk
2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MindManager 2002
2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\Program Files (x86)\Mindjet
2015-04-02 13:02 - 2015-04-02 13:02 - 00000000 ____D () C:\Users\Holger Carlson\Documents\TomTom
2015-03-29 13:32 - 2015-03-29 13:33 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\CANON INC
2015-03-29 13:14 - 2015-04-12 17:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-28 11:32 - 2015-03-28 11:32 - 00013703 _____ () C:\Users\Holger Carlson\Documents\~WRD3122.tmp
2015-03-26 19:35 - 2015-03-26 19:35 - 00015595 _____ () C:\Users\Holger Carlson\Documents\Hapimag.htm
2015-03-25 08:28 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 08:28 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 08:28 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 08:28 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 08:28 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 08:28 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 08:28 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 08:28 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-24 10:56 - 2015-03-24 10:56 - 00221029 _____ () C:\Users\Holger Carlson\Documents\ohne tan.xps
2015-03-17 20:28 - 2015-03-17 20:30 - 100632535 _____ (Igor Pavlov) C:\Users\Holger Carlson\Documents\firmware_eBook-Reader_3-0_v-eBR30_1.0.8_20120106.exe
2015-03-17 20:14 - 2015-03-18 19:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Kindle Content
2015-03-17 20:14 - 2015-03-17 20:14 - 00002276 _____ () C:\Users\Holger Carlson\Desktop\Kindle.lnk
2015-03-17 20:14 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2015-03-17 20:13 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Amazon
2015-03-17 20:12 - 2015-03-17 20:13 - 40891792 _____ (Amazon.com) C:\Users\Holger Carlson\Documents\KindleForPC-installer.exe
2015-03-17 00:47 - 2015-03-17 00:49 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Digital Editions
2015-03-17 00:47 - 2015-03-17 00:47 - 00002152 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.0.lnk
2015-03-17 00:47 - 2015-03-17 00:47 - 00002140 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 4.0.lnk
2015-03-17 00:46 - 2015-03-17 00:46 - 08132576 _____ (Adobe Systems Incorporated) C:\Users\Holger Carlson\Documents\ADE_4.0_Installer.exe
2015-03-17 00:32 - 2015-03-17 00:32 - 13245728 _____ () C:\Users\Holger Carlson\Documents\Update.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-13 11:53 - 2014-03-22 13:03 - 01411689 _____ () C:\Windows\WindowsUpdate.log
2015-04-13 11:53 - 2012-01-25 17:34 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-13 11:53 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-13 11:53 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-13 11:51 - 2009-08-04 11:51 - 00734178 _____ () C:\Windows\system32\perfh007.dat
2015-04-13 11:51 - 2009-08-04 11:51 - 00158606 _____ () C:\Windows\system32\perfc007.dat
2015-04-13 11:51 - 2009-07-14 07:13 - 01701722 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-13 11:46 - 2014-08-15 08:33 - 01185266 _____ () C:\Windows\PFRO.log
2015-04-13 11:46 - 2014-08-12 16:34 - 00011650 _____ () C:\Windows\setupact.log
2015-04-13 11:46 - 2012-04-03 12:21 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-04-13 11:46 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-13 11:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2015-04-13 11:11 - 2014-02-08 19:23 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-13 09:57 - 2015-01-30 17:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-04-13 09:47 - 2015-02-14 12:26 - 00000000 ____D () C:\Program Files (x86)\AntiTwin
2015-04-13 09:45 - 2014-07-24 19:21 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\GlarySoft
2015-04-13 09:42 - 2014-07-13 19:49 - 00000000 ____D () C:\Program Files\Pixum
2015-04-13 09:35 - 2011-03-12 10:24 - 00045056 _____ () C:\Windows\system32\acovcnt.exe
2015-04-12 17:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-12 17:53 - 2011-02-11 12:49 - 00000000 ____D () C:\Users\Holger Carlson
2015-04-12 13:40 - 2012-09-04 17:54 - 00006144 ____H () C:\Users\Holger Carlson\Documents\photothumb.db
2015-04-11 19:14 - 2011-04-15 19:24 - 00015360 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-08 15:47 - 2013-03-03 13:04 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Deployment
2015-04-08 00:13 - 2014-05-13 11:11 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%
2015-04-07 18:59 - 2014-11-21 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Driver Updater
2015-04-07 18:59 - 2011-03-26 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WritePro
2015-04-07 18:32 - 2010-10-08 20:33 - 00000000 ____D () C:\Program Files (x86)\Google
2015-04-06 18:12 - 2014-02-08 19:23 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-06 18:12 - 2013-08-18 17:45 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-06 18:12 - 2013-08-18 17:45 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-06 18:02 - 2011-02-11 13:02 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Google
2015-04-06 11:31 - 2015-01-20 11:53 - 00000975 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-05 10:09 - 2010-10-08 21:00 - 00004200 _____ () C:\Windows\system32\AutoRunFilter.ini
2015-04-05 09:53 - 2015-01-30 16:55 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\dlg
2015-04-03 19:08 - 2013-09-28 13:18 - 00000000 ____D () C:\backup
2015-04-03 18:43 - 2014-08-19 14:14 - 00001564 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Buchliebhaber.lnk
2015-04-03 18:43 - 2011-02-13 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Buchliebhaber
2015-04-03 18:42 - 2011-02-15 14:16 - 00000000 ____D () C:\ProgramData\Paradox
2015-04-03 17:59 - 2014-07-24 19:20 - 00001232 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk
2015-04-03 17:59 - 2014-07-24 19:20 - 00001220 _____ () C:\Users\Public\Desktop\Absolute Uninstaller.lnk
2015-04-03 13:42 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-04-03 13:35 - 2011-09-06 09:09 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-04-03 13:34 - 2015-02-11 18:19 - 00024652 _____ () C:\Windows\DPINST.LOG
2015-04-03 13:04 - 2011-09-06 09:10 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Samsung
2015-04-03 13:04 - 2010-10-08 20:22 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-29 13:34 - 2015-03-12 15:10 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-03-26 13:16 - 2014-09-09 16:34 - 00000000 ____D () C:\Buchliebhaber
2015-03-26 12:06 - 2010-10-08 21:00 - 00002391 _____ () C:\Windows\system32\ServiceFilter.ini
2015-03-26 12:01 - 2014-12-12 15:04 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 12:01 - 2014-07-25 16:01 - 00525312 _____ () C:\Users\Holger Carlson\Documents\Outlook.pst
2015-03-26 12:01 - 2014-05-08 09:46 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-24 19:37 - 2014-02-08 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-03-24 12:27 - 2015-02-27 11:16 - 00000348 _____ () C:\Windows\Tasks\0215tbUpdateInfo.job
2015-03-24 12:27 - 2015-02-27 11:16 - 00000000 ____D () C:\ProgramData\Avg_Update_0215tb
2015-03-24 10:54 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-03-23 11:39 - 2015-02-09 11:33 - 00000000 ____D () C:\Program Files (x86)\AVG Web TuneUp
2015-03-17 00:49 - 2011-02-11 13:08 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Adobe
2015-03-17 00:47 - 2012-11-17 20:50 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Adobe_Systems_Incorporate
2015-03-17 00:47 - 2012-01-03 16:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2015-03-17 00:47 - 2010-10-08 20:32 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-03-15 16:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

==================== Files in the root of some directories =======

2013-12-03 17:59 - 2013-12-03 17:59 - 23288584 _____ (Mozilla) C:\Program Files\Firefox_Setup [1].exe
2014-07-13 19:39 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch (1).exe
2014-07-13 19:38 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch.exe
2007-06-12 18:34 - 2007-06-12 18:34 - 0035822 _____ () C:\Program Files (x86)\Common Files\ASPG_icon.ico
2008-05-22 17:35 - 2008-05-22 17:35 - 0051962 _____ () C:\Program Files (x86)\Common Files\banner.jpg
2009-04-08 19:31 - 2009-04-08 19:31 - 0106496 _____ () C:\Program Files (x86)\Common Files\CPInstallAction.dll
2008-08-12 06:45 - 2008-08-12 06:45 - 0155648 _____ (ASUS) C:\Program Files (x86)\Common Files\MSIactionall.dll
2013-12-19 10:19 - 2014-01-10 11:59 - 0000102 _____ () C:\Users\Holger Carlson\AppData\Roaming\WB.CFG
2011-04-15 19:24 - 2015-04-11 19:14 - 0015360 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-31 20:19 - 2015-02-01 12:37 - 0000025 _____ () C:\Users\Holger Carlson\AppData\Local\gt-props
2014-02-10 18:03 - 2014-02-10 18:03 - 0001679 _____ () C:\Users\Holger Carlson\AppData\Local\recently-used.xbel
2012-04-27 10:44 - 2012-04-27 10:44 - 0000017 _____ () C:\Users\Holger Carlson\AppData\Local\resmon.resmoncfg
2014-12-04 13:47 - 2014-12-04 13:47 - 0000000 _____ () C:\Users\Holger Carlson\AppData\Local\{C0180386-8014-4674-B1B2-C6CB0EB6F63F}
2011-02-21 18:31 - 2011-02-21 18:31 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2015-01-17 18:18 - 2015-01-17 18:18 - 0005045 _____ () C:\ProgramData\wmzddnmb.cix

Some content of TEMP:
====================
C:\Users\Holger Carlson\AppData\Local\Temp\avgnt.exe
C:\Users\Holger Carlson\AppData\Local\Temp\Quarantine.exe
C:\Users\Holger Carlson\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-05 11:03

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-04-2015
Ran by Holger Carlson at 2015-04-13 12:01:35
Running from C:\Users\Holger Carlson\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XF329JBY
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Absolute Uninstaller 5.3.1.20 (HKLM-x32\...\Absolute Uninstaller) (Version: 5.3.1.20 - Glarysoft Ltd)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 17.0.0.124 - Adobe Systems Incorporated)
Adobe Digital Editions 4.0 (HKLM-x32\...\Adobe Digital Editions 4.0) (Version: 4.0.3 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Alle meine Adressen 1.20 (HKLM-x32\...\AllemeineAdressen) (Version:  - )
Amazon Kindle (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Amazon Kindle) (Version:  - Amazon)
ASUS FancyStart (HKLM-x32\...\{2B81872B-A054-48DA-BE3B-FA5C164C303A}) (Version:  - )
AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Buchliebhaber 9.1.0 (HKLM-x32\...\Buchliebhaber_is1) (Version:  - Matthies & Klock GmbH)
GMX MediaCenter 1.5.2192.0 (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\GMX Application {sync-000021}) (Version: 1.5.2192.0 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung CE (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.1.0 - 1&1 Mail & Media GmbH)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
MD Adressbuch 2012 (HKLM-x32\...\MD Adressbuch 2012_is1) (Version:  - Stefan Göppert Softwareentwicklung)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MyDriveConnect 3.3.0.1756 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)
MyFreeCodec (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\MyFreeCodec) (Version:  - )
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version:  - )
Samsung Mobile Modem Device Software (HKLM\...\Samsung Mobile Modem Device) (Version:  - )
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version:  - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version:  - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version:  - )
SAMSUNG USB Mobile Device Software (HKLM\...\SAMSUNG USB Mobile Device) (Version:  - )
TomTom HOME (HKLM-x32\...\{BB05590A-6602-43F3-A400-77EA0976BC0A}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version:  - )
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinZip Driver Updater (HKLM-x32\...\{9854A5C4-5BE5-46E2-A989-352DD8B37E20}_is1) (Version: 1.0.648.16298 - WinZip Computing, S.L. (WinZip Computing))
XnView 2.25 (HKLM-x32\...\XnView_is1) (Version: 2.25 - Gougelet Pierre-e)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

12-04-2015 18:04:34 Wiederherstellungsvorgang
12-04-2015 18:22:53 Uniblue PC Mechanic installation
13-04-2015 09:37:37 avast! antivirus system restore point
13-04-2015 09:45:54 Windows-Sicherung

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-12-04 14:19 - 00000860 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {08B758AF-1A52-432B-8127-90EC4AA3A965} - System32\Tasks\{F2C2A228-7128-4269-BFD6-1BA7B353163D} => C:\Program Files (x86)\Matthies & Klock GmbH\Buchliebhaber\PR9\pdxrwn32.exe
Task: {098E8135-34F9-4A64-934D-CB129E5D2CDC} - \Google Updater and Installer No Task File <==== ATTENTION
Task: {0CE00D12-17CE-4495-BF65-180B9826F70C} - \{61A08136-196D-4297-89AD-D497D9417337} No Task File <==== ATTENTION
Task: {0D02835E-8E5B-471D-B8DD-C212A01D96EC} - \{D04405DF-9CCA-470D-B397-4843D8B97AF0} No Task File <==== ATTENTION
Task: {0D85BDAC-E5C7-468D-B749-BB89C6043C0C} - \{5287E865-8199-49E9-9791-D1D1C8255AD2} No Task File <==== ATTENTION
Task: {11951C30-7772-4873-A9C8-E7D79EC20876} - \{D8737E18-1D23-477D-AAC7-5336054949A5} No Task File <==== ATTENTION
Task: {13F363A7-DAF8-481E-B4FE-FE9B141B5AA3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {25201061-4215-47D1-9AD4-34EA219B3820} - System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F} => pcalua.exe -a E:\setup.exe -d E:\
Task: {28C6FF84-FF3C-482A-9DE2-C1E1A727942B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-06] (Adobe Systems Incorporated)
Task: {290FA810-6486-498B-959B-EF77EE05DD0F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)
Task: {2B0BE8B0-825F-4CBB-8C4D-91671BCB9A6A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2FC8335C-FA90-4CEE-A686-C6B49483A403} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {3210E7F8-FB59-421F-B199-67709A46C787} - \{A6277D21-0A69-4926-8537-03083BD82DC4} No Task File <==== ATTENTION
Task: {334ED6C7-1F98-49AE-8A05-3E3B9A21315B} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {358F7EC5-6965-40B1-864E-007E2DF9341F} - System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)
Task: {38A8F2A8-F514-4C70-A1BB-A5D46267F1FB} - \{F46C64DF-4E00-4451-B8AB-B1BD2B03A5D6} No Task File <==== ATTENTION
Task: {38ADF97D-C025-44B4-8A28-255AF09F87BD} - \{9623FEA8-9F14-41C1-B13F-5E2F1DDF2973} No Task File <==== ATTENTION
Task: {3B3ABEC6-C5C7-4317-98AA-0E6A0A2CCF4B} - \{9DB39282-3B31-400F-9105-DE5FB32A8625} No Task File <==== ATTENTION
Task: {3D5A7F1A-A836-46DC-9849-9F87B83A84A3} - System32\Tasks\ASPG => C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe [2009-06-29] (ASUS)
Task: {3DFA3AE3-36A5-43EE-86FD-5CFEE82FD09E} - \{010EC50E-DEBC-4DDF-818F-D8FD586C6441} No Task File <==== ATTENTION
Task: {40210CAF-8AA2-4DD1-BDF5-BB204B73FB6C} - System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)
Task: {413B067F-3B28-4DF2-8F92-254BE963B97C} - System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)
Task: {41E4A974-3CB9-486E-B66F-D3F72922F49D} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-05-28] (ATK)
Task: {442B4BA7-EBD3-4530-973F-E7CC01346952} - \{BA46EF16-D5AD-455B-A934-5EFCEB3A4388} No Task File <==== ATTENTION
Task: {44B27208-7DF9-417C-85BA-311F6EE0FE37} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17] (ASUS)
Task: {46897D9B-08E1-407A-86D2-588D7ABBE189} - \{BE03A807-43D0-45D8-9633-BA1E5A2BF85C} No Task File <==== ATTENTION
Task: {47F29D00-B56D-4D0B-A245-F110AC103BA3} - \{DCE86621-269D-478F-9FAC-AF30D2697486} No Task File <==== ATTENTION
Task: {4A29309C-5F1C-4521-B5A3-74342AD4D434} - System32\Tasks\avastBCLRestartS-1-5-21-171592873-1656066399-1947005370-1000 => Chrome.exe 
Task: {4ABBB83F-8527-455B-839D-0E31E9921ABF} - \{414946E3-07AA-4AF3-BB0D-E22440C7BAAE} No Task File <==== ATTENTION
Task: {4DB12196-A5A6-455A-A31E-8A8F9CDA048F} - \{00D6677F-309E-4218-BCA8-4C50017C8BFD} No Task File <==== ATTENTION
Task: {4E55F6B2-D76F-46DA-85CA-851B04EA102C} - System32\Tasks\4805 => Wscript.exe C:\Users\HOLGER~1\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {536019A5-4DF9-4D2A-AB12-D4F97B46565A} - \{3542F023-1538-411B-9E77-ACAF5E3DCF29} No Task File <==== ATTENTION
Task: {570F0731-82FB-4801-9764-13133948D30D} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {61DA3565-D65E-4727-A79B-CFF46B7C83D0} - \{515B0C8B-D302-490D-B011-1690D5CB8DA8} No Task File <==== ATTENTION
Task: {67253C4B-AA19-4D28-A2C4-ACB82A1E8FB3} - \{8715223C-93FC-489B-A4F9-497C1B06356D} No Task File <==== ATTENTION
Task: {689876BF-828C-4CAC-B3C8-96B7A34B374C} - \{E27BA60A-F9D1-4950-AADD-E4C8BB8E3AE7} No Task File <==== ATTENTION
Task: {6B054A5F-A0E3-42EF-B939-199ECAD09EEE} - \Registration 1und1 Task No Task File <==== ATTENTION
Task: {73E334A0-2C62-4488-842A-B6047FD36A67} - \{4C3D4C4C-3DD2-436D-B415-CC9B34C519DA} No Task File <==== ATTENTION
Task: {75B32520-AE21-407C-924A-BD972FD0ED7F} - System32\Tasks\{69024FA6-BE33-473D-B9A3-EE1A4D9E4625} => pcalua.exe -a C:\Olivetti\MY_WAY_PLUS\Setup.EXE -d C:\Olivetti\MY_WAY_PLUS
Task: {7687468C-FCB9-4157-98A5-29F118266571} - \{80C774A3-BC4E-4FEF-B262-A5578F350E85} No Task File <==== ATTENTION
Task: {7D065A65-864E-4237-909F-B37C27ECC63A} - \{A86E51F0-822F-4FC6-9962-851362E69E65} No Task File <==== ATTENTION
Task: {813A7F73-0382-4A15-BA6D-549796A8A795} - \{A3123A1E-2B47-4121-992C-63487F1CE1F3} No Task File <==== ATTENTION
Task: {8280F3EA-A247-4A48-8F40-7F948D87EB49} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {833E3160-FE17-4A2E-8B96-5ACA617F1334} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31] (ASUS)
Task: {83C4C39B-F484-45E4-B677-EFBBD3E1183A} - \{7874A9A9-C312-459B-A16C-50B15C6AE000} No Task File <==== ATTENTION
Task: {8B51862B-900B-4C95-A7D5-29D974D8EE26} - \{4BA2B75B-115C-4BCA-B45A-BD110E15FEF3} No Task File <==== ATTENTION
Task: {8E7BFA22-A9BF-4269-B793-D870D24D60C2} - System32\Tasks\0215tbUpdateInfo => C:\ProgramData\Avg_Update_0215tb\0215tb_{9AC9BD6A-EC15-4AF2-B2E9-45B20221802C}.exe [2015-02-27] ()
Task: {8F72ADBE-9038-41E9-86A7-8381B850A01F} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2009-07-23] (ATK)
Task: {933153D3-FF7D-4F2F-93DB-4EE18AEC267A} - \{58E9C4A2-89D5-4097-9A1D-3C7212CC100A} No Task File <==== ATTENTION
Task: {95298E87-8CFD-4CCA-890F-8B7D7730CF74} - \{E2D6ACFE-B61E-4447-AE80-4B0CA9F20914} No Task File <==== ATTENTION
Task: {961A4741-EA5F-4FD4-9F58-9824862E1432} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {9AA4F3F3-6B2F-4EA6-B81B-1EA4DF38689E} - \{F99ED12E-E280-47FF-9CC7-4FA9874C09B4} No Task File <==== ATTENTION
Task: {A7177D9F-E795-4EEA-9386-C0AB9B1E6555} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {AB825B6B-2DF7-408C-A17E-B405E72C327C} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: {ABE155A8-22A7-4F41-A3D7-35B367212640} - \{8EE0BDD3-D87C-4147-865B-EF850579BBB3} No Task File <==== ATTENTION
Task: {B35D3966-C1EC-4ABB-BAC5-D82790C11C3F} - \{E3C1408B-870F-4E8E-863D-53964BB8AC89} No Task File <==== ATTENTION
Task: {B39D560A-BEBE-44B2-BB96-2FB0031EFCB1} - System32\Tasks\{5F6DAA4F-722D-4B6E-9C1D-E206E1B3507A} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{F193FC0E-9E18-40FC-A974-509A1BDD240A}\setup.exe" -c -runfromtemp -l0x0407 -removeonly
Task: {B3C1DDB0-DE41-4A0A-BF91-DBEDCF91283A} - \{579791C6-84C4-4514-8990-62DE88C0F405} No Task File <==== ATTENTION
Task: {B4381734-38BC-4416-BA34-AD5B873F9C57} - \Java Update Scheduler No Task File <==== ATTENTION
Task: {B4906D30-8E70-438F-ACE2-F49B1DBE7445} - \{94AA3650-9FB1-4CD9-A08A-C903E473EBCE} No Task File <==== ATTENTION
Task: {B967227B-B6FD-4E2D-8835-423AB6A11D89} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)
Task: {BE3C31CF-63BD-4BBF-B1EC-7B0AD8E1475C} - \{766A2B2A-5AE1-40C4-B5D1-3ACEE3EDB174} No Task File <==== ATTENTION
Task: {BF27F29A-158B-4BB3-8BCE-76285F22E1E8} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
Task: {C070E538-D27F-40CE-A149-1F519DE498C9} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {C9922EB1-0689-4006-9DE5-EC7322657A2E} - \{3A7AA56D-B373-4984-B360-5A49D81838B3} No Task File <==== ATTENTION
Task: {D10B95EB-9C87-4E4B-B2A9-7995BACE3748} - System32\Tasks\ASUSControlDeck => C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe [2010-06-09] (asus)
Task: {D3A8949A-66C0-404E-A951-6D81347CC413} - \{5F42D548-089A-4880-B17A-030133EB09AE} No Task File <==== ATTENTION
Task: {D3DCDC2E-0597-4E10-B9B2-DA8A9D0B8184} - \{C8855EFF-1C49-474C-8EC9-A88A46937291} No Task File <==== ATTENTION
Task: {D79B06A8-69BD-44AF-A4F9-51F90B02F5F9} - \{010E4118-67B1-49F2-B0A9-AEBEB8C22ED8} No Task File <==== ATTENTION
Task: {D804B95C-2E56-41A3-BA15-CBFF3F453270} - \{D1412BBD-3329-445E-BAAC-11DAA3F957DE} No Task File <==== ATTENTION
Task: {D97583DC-E996-4394-9850-866EE5071AA3} - \{54761E2D-0F8D-4150-9BAF-A6C950ABC57C} No Task File <==== ATTENTION
Task: {DCCEAEA3-B771-45EF-B482-A5AF7C257613} - \{F268C70D-1377-46B5-B8EF-B0F597A319DD} No Task File <==== ATTENTION
Task: {DD20FA04-E2E5-4565-BC1F-EF251B8CF767} - \{017BCEFC-6CC0-4438-9C8C-8201389B3A60} No Task File <==== ATTENTION
Task: {DF172056-6ED6-443A-A038-9148CCA273FB} - System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E} => pcalua.exe -a E:\setup.exe -d E:\
Task: {E4FADBEF-BD70-4875-9F9E-1F514FAE9ACE} - \{428451EA-30BB-4D09-B88F-21C45644BDDD} No Task File <==== ATTENTION
Task: {EBAEA87A-60D8-457D-B7BE-FDDEE0C029B6} - \{E72F77B1-78E7-4B59-A542-303E6C370E31} No Task File <==== ATTENTION
Task: {EBC17C4A-B399-454D-880A-2B7927689200} - System32\Tasks\{B499114B-BC27-40FC-98B1-F18D60669500} => pcalua.exe -a C:\ProgramData\ZombieInvasion\uninstall.exe -c /kb=y /ic=1
Task: {EBDB75AC-DD2E-4374-8CA6-CA615964EFDF} - System32\Tasks\{F24AA02C-94D0-40B1-9DB0-D88D09B26BA3} => C:\Program Files (x86)\Matthies &amp; Klock GmbH\Buchliebhaber\PR9\pdxrwn32.exe
Task: {F088DE68-E8E0-404D-A03F-71D270529CAA} - \{C9155B3B-9625-4BCA-8DC8-57E7BE8F3A16} No Task File <==== ATTENTION
Task: {F291C6EE-C628-4432-9AA6-72AB2B105BB0} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {F2C3A777-E8AA-4F3A-BAFD-9404E1BEA2BA} - \SidebarExecute No Task File <==== ATTENTION
Task: {FCC576CF-4869-4F53-B945-CC818F71D6F7} - \{A56BDF5A-F4F1-4A50-8871-D8B38E0FE432} No Task File <==== ATTENTION
Task: C:\Windows\Tasks\0215tbUpdateInfo.job => C:\ProgramData\Avg_Update_0215tb\0215tb_{9AC9BD6A-EC15-4AF2-B2E9-45B20221802C}.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2007-06-15 19:28 - 2007-06-15 19:28 - 00104960 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll
2007-06-02 01:52 - 2007-06-02 01:52 - 00159744 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:AD022376

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Classes\exefile:  <===== ATTENTION!

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: ADSMTray => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe
MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
MSCONFIG\startupreg: RemoteControl9 => "C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe"
MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-171592873-1656066399-1947005370-500 - Administrator - Disabled)
Gast (S-1-5-21-171592873-1656066399-1947005370-501 - Limited - Disabled)
Holger Carlson (S-1-5-21-171592873-1656066399-1947005370-1000 - Administrator - Enabled) => C:\Users\Holger Carlson
HomeGroupUser$ (S-1-5-21-171592873-1656066399-1947005370-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU P6100 @ 2.00GHz
Percentage of memory in use: 53%
Total physical RAM: 2924.57 MB
Available physical RAM: 1358.21 MB
Total Pagefile: 6147.32 MB
Available Pagefile: 4240.17 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:72.69 GB) (Free:7.6 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:205.87 GB) (Free:3.94 GB) NTFS
Drive f: (INTENSO USB) (Removable) (Total:3.84 GB) (Free:3.61 GB) FAT32
Drive g: (CNMemory Festplatte) (Fixed) (Total:698.63 GB) (Free:605.38 GB) NTFS
Drive s: (EX SPEICHER) (Removable) (Total:7.51 GB) (Free:4.24 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 0237A506)
Partition 1: (Not Active) - (Size=19.5 GB) - (Type=1C)
Partition 2: (Active) - (Size=72.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=205.9 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 7.5 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 2 (Size: 3.8 GB) (Disk ID: 6DA16B7B)
Partition 1: (Active) - (Size=3.8 GB) - (Type=0B)

========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: F359C74D)
Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Das müsste jetzt alles sein.
Gruß und danke für deine Geduld