Spybot kann Win32.Qhost.ahnj nicht löschen

Djangolino · 29.04.2015, 22:02

Hallo Zusammen,

nach zwei Tagen Suche zur Fehlerbeseitigung hoffe ich hier sehr auf Hilfe. Leider bin ich technisch nicht sehr bewandert und bitte um Nachsicht.
Vor zwei Tagen fuhr mein Laptop nicht mehr richtig hoch. Mittendrin blieb er hängen. Ich konnte zwar in meinen Datein arbeiten, aber ins Internet bin ich nicht gekommen. Über die Systemwiederherstellung konnte ich das Problem beheben und führte zur Sicherheit einen Suchlauf mit Avast free durch. Es wurde nichts gefunden.
Anschließend lief Spybot Search&Destroy durchlaufen und fand:

Code:

ATTFilter

Win32.Qhost.ahnj: [SBI $3CDB3410] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usnjsvc

Win32.Qhost.ahnj: [SBI $05A39950] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\usnjsvc

Win32.Qhost.ahnj: [SBI $128BFD90] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\usnjsvc

Benutzer-Abbruch: Überprüfung wurde nicht vollständig durchgeführt! (Status)
  


--- Spybot - Search & Destroy version: 1.6.2  (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2009-08-16 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-09-07 advcheck.dll (1.6.4.18)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2015-04-22 Includes\Adware-000.sbi (*)
2015-04-21 Includes\Adware-001.sbi (*)
2015-04-29 Includes\Adware-C.sbi (*)
2014-01-13 Includes\Adware.sbi (*)
2014-01-13 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2014-11-14 Includes\Dialer-000.sbi (*)
2014-11-14 Includes\Dialer-001.sbi (*)
2014-01-08 Includes\Dialer-C.sbi (*)
2014-01-13 Includes\Dialer.sbi (*)
2014-01-13 Includes\DialerC.sbi (*)
2014-01-09 Includes\Fraud-000.sbi (*)
2014-11-03 Includes\Fraud-001.sbi (*)
2014-03-31 Includes\Fraud-002.sbi (*)
2014-01-09 Includes\Fraud-003.sbi (*)
2013-04-11 Includes\HeavyDuty.sbi (*)
2014-11-14 Includes\Hijackers-000.sbi (*)
2014-11-14 Includes\Hijackers-001.sbi (*)
2014-01-08 Includes\Hijackers-C.sbi (*)
2014-01-13 Includes\Hijackers.sbi (*)
2014-01-13 Includes\HijackersC.sbi (*)
2014-01-08 Includes\iPhone-000.sbi (*)
2014-01-08 Includes\iPhone.sbi (*)
2014-11-14 Includes\Keyloggers-000.sbi (*)
2014-09-24 Includes\Keyloggers-C.sbi (*)
2014-01-13 Includes\Keyloggers.sbi (*)
2014-01-13 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2014-11-14 Includes\Malware-000.sbi (*)
2014-11-14 Includes\Malware-001.sbi (*)
2014-11-14 Includes\Malware-002.sbi (*)
2014-11-14 Includes\Malware-003.sbi (*)
2014-11-14 Includes\Malware-004.sbi (*)
2014-11-14 Includes\Malware-005.sbi (*)
2014-07-09 Includes\Malware-006.sbi (*)
2014-01-09 Includes\Malware-007.sbi (*)
2015-04-29 Includes\Malware-C.sbi (*)
2014-01-13 Includes\Malware.sbi (*)
2014-01-13 Includes\MalwareC.sbi (*)
2014-11-14 Includes\PUPS-000.sbi (*)
2014-01-15 Includes\PUPS-001.sbi (*)
2014-01-15 Includes\PUPS-002.sbi (*)
2015-04-29 Includes\PUPS-C.sbi (*)
2014-01-13 Includes\PUPS.sbi (*)
2014-01-13 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2014-01-08 Includes\Security-000.sbi (*)
2014-01-08 Includes\Security-C.sbi (*)
2014-01-08 Includes\Security.sbi (*)
2014-01-13 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2015-02-25 Includes\Spyware-000.sbi (*)
2015-04-07 Includes\Spyware-001.sbi (*)
2015-01-14 Includes\Spyware-C.sbi (*)
2014-01-13 Includes\Spyware.sbi (*)
2014-01-08 Includes\SpywareC.sbi (*)
2012-11-19 Includes\Tracks.uti
2014-01-15 Includes\Trojans-000.sbi (*)
2014-12-04 Includes\Trojans-001.sbi (*)
2015-02-25 Includes\Trojans-002.sbi (*)
2014-01-28 Includes\Trojans-003.sbi (*)
2014-01-15 Includes\Trojans-004.sbi (*)
2015-02-04 Includes\Trojans-005.sbi (*)
2015-03-31 Includes\Trojans-006.sbi (*)
2015-02-26 Includes\Trojans-007.sbi (*)
2015-02-26 Includes\Trojans-008.sbi (*)
2014-11-03 Includes\Trojans-009.sbi (*)
2014-01-09 Includes\Trojans-020.sbi (*)
2014-01-09 Includes\Trojans-021.sbi (*)
2014-01-09 Includes\Trojans-022.sbi (*)
2014-01-09 Includes\Trojans-023.sbi (*)
2015-04-29 Includes\Trojans-C.sbi (*)
2015-02-27 Includes\Trojans-OG-000.sbi (*)
2014-01-15 Includes\Trojans-TD-000.sbi (*)
2014-01-15 Includes\Trojans-VM-000.sbi (*)
2014-01-15 Includes\Trojans-VM-001.sbi (*)
2014-01-15 Includes\Trojans-VM-002.sbi (*)
2014-01-15 Includes\Trojans-VM-003.sbi (*)
2014-01-15 Includes\Trojans-VM-004.sbi (*)
2014-01-15 Includes\Trojans-VM-005.sbi (*)
2014-01-15 Includes\Trojans-VM-006.sbi (*)
2014-01-15 Includes\Trojans-VM-007.sbi (*)
2014-01-15 Includes\Trojans-VM-008.sbi (*)
2014-01-15 Includes\Trojans-VM-009.sbi (*)
2014-01-15 Includes\Trojans-VM-010.sbi (*)
2014-01-15 Includes\Trojans-VM-011.sbi (*)
2014-01-15 Includes\Trojans-VM-012.sbi (*)
2014-01-15 Includes\Trojans-VM-013.sbi (*)
2014-01-15 Includes\Trojans-VM-014.sbi (*)
2014-01-15 Includes\Trojans-VM-015.sbi (*)
2014-01-15 Includes\Trojans-VM-016.sbi (*)
2014-01-15 Includes\Trojans-VM-017.sbi (*)
2014-01-15 Includes\Trojans-VM-018.sbi (*)
2014-01-15 Includes\Trojans-VM-019.sbi (*)
2014-01-15 Includes\Trojans-VM-020.sbi (*)
2014-01-15 Includes\Trojans-VM-021.sbi (*)
2014-01-15 Includes\Trojans-VM-022.sbi (*)
2014-01-15 Includes\Trojans-VM-023.sbi (*)
2014-01-15 Includes\Trojans-VM-024.sbi (*)
2014-01-13 Includes\Trojans-VM-025.sbi (*)
2014-01-13 Includes\Trojans-VM-026.sbi (*)
2014-12-19 Includes\Trojans-ZB-000.sbi (*)
2014-10-27 Includes\Trojans-ZL-000.sbi (*)
2014-01-09 Includes\Trojans.sbi (*)
2010-03-10 Includes\TrojansC-01.sbi (*)
2014-01-09 Includes\TrojansC-02.sbi (*)
2014-01-09 Includes\TrojansC-03.sbi (*)
2014-01-16 Includes\TrojansC-04.sbi (*)
2014-01-09 Includes\TrojansC-05.sbi (*)
2014-01-09 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

Dieser lies sich nicht entfernen.

Ich habe dann Avira Free Antivirus geladen und durchlaufen lassen. Gefunden wurde dies:
(das mit den exportieren der Funde aus Avira habe ich nicht hinbekommen, konnte es nicht einfügen :-( , da stand aber auch nur 7x Fund Maleware, Datum,Uhrzeit.

Code:

ATTFilter

Beginne mit der Desinfektion:
[ERROR] RepairMalware: Not able to Repair Malware PUA/DownloadGuide.A
[ERROR] RepairMalware: Not able to Repair Malware PUA/DownloadGuide.A
[ERROR] RepairMalware: Not able to Repair Malware PUA/SearchProtect.Gen
C:\Users\Andrea\Downloads\mozilla-thunderbird.exe.part
  [FUND]      Enthält Muster der Software PUA/DownloadGuide.A
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '51e49fa1.qua' verschoben!
C:\Users\Andrea\Downloads\mozilla-thunderbird.exe
  [FUND]      Enthält Muster der Software PUA/DownloadGuide.A
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4973b00e.qua' verschoben!
C:\ProgramData\Spybot - Search & Destroy\Recovery\WidgiToolbar85.zip
  [FUND]      Enthält verdächtigen Code GEN/PwdZIP
  [HINWEIS]   Der Fund wurde als verdächtig eingestuft.
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1b32eae1.qua' verschoben!
C:\ProgramData\Spybot - Search & Destroy\Recovery\WidgiToolbar39.zip
  [FUND]      Enthält verdächtigen Code GEN/PwdZIP
  [HINWEIS]   Der Fund wurde als verdächtig eingestuft.
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7d05a523.qua' verschoben!
C:\ProgramData\Spybot - Search & Destroy\Recovery\WidgiToolbar22.zip
  [FUND]      Enthält verdächtigen Code GEN/PwdZIP
  [HINWEIS]   Der Fund wurde als verdächtig eingestuft.
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3881881d.qua' verschoben!
C:\ProgramData\Spybot - Search & Destroy\Recovery\WidgiToolbar102.zip
  [FUND]      Enthält verdächtigen Code GEN/PwdZIP
  [HINWEIS]   Der Fund wurde als verdächtig eingestuft.
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '479aba7c.qua' verschoben!
C:\AdwCleaner\Quarantine\C\Program Files\XTab\ProtectService.exe.vir
  [FUND]      Enthält Muster der Software PUA/SearchProtect.Gen
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0b37962d.qua' verschoben!

Was kann ich tun? Spybot hatte ich abgebrochen, weil es mir nur um die Meldung zum schicken ging. Im Moment habe ich auch beide Virenprogramme auf dem PC, weil ich noch nicht weiß, welches ich am besten behalte.

Vielen lieben Dank!

deeprybka · 29.04.2015, 22:25

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
Bitte kein Crossposting (posten in mehreren Foren).
Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
Poste die Logfiles direkt in Deinen Thread in Code-Tags.
Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.

Los geht's:

Schritt 1

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Djangolino · 29.04.2015, 22:42

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-04-2015 01
Ran by Andrea (administrator) on ANDREA-PC on 29-04-2015 23:33:17
Running from C:\Users\Andrea\Downloads
Loaded Profiles: Andrea (Available profiles: Andrea)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\wlanext.exe
(DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpHostW.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\Hp\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Conexant Systems, Inc.) C:\WINDOWS\System32\drivers\XAudio.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
() C:\Program Files\Hp\QuickPlay\Kernel\TV\QPSched.exe
(DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpAgent.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
() C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Macrovision Corporation) C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
(Dropbox, Inc.) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMUPDT.EXE
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMSWCS.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Safer Networking Limited) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
(Microsoft Corporation) C:\WINDOWS\System32\conime.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [QlbCtrl] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [202032 2007-09-19] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OnScreenDisplay] => C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [554320 2007-09-04] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [DpAgent] => C:\Program Files\DigitalPersona\Bin\dpagent.exe [671744 2007-09-20] (DigitalPersona, Inc.)
HKLM\...\Run: [hpWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [480560 2007-09-13] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [WAWifiMessage] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [311296 2007-01-08] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [APSDaemon] => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1316136 2008-06-20] (Synaptics, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1282120 2013-05-02] (CANON INC.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-04-28] (Avast Software s.r.o.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-29] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Run: [ISUSPM] => C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe [222128 2007-03-29] (Macrovision Corporation)
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {3ee664b1-8988-11de-9584-001e3772bca1} - F:\preinst.exe
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {94d4e4da-7b58-11e1-9a56-001e3772bca1} - F:\AutoRun.exe
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {94d4e509-7b58-11e1-9a56-001e101f2500} - F:\AutoRun.exe
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {94d4e528-7b58-11e1-9a56-001e101f82a0} - F:\AutoRun.exe
HKU\S-1-5-18\...\Run: [FRITZ!protect] => FwebProt.exe
Lsa: [Notification Packages] scecli DPPWDFLT
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Agent.lnk [2012-03-31]
ShortcutTarget: Update Agent.lnk -> C:\Program Files\Connect it\AutoUpdateSrv.exe (No File)
Startup: C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-03-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-04-28] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:64494;https=127.0.0.1:64494
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
SearchScopes: HKLM -> {160DB79B-FE46-41D8-A2F7-3C3A5A247AAE} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {160DB79B-FE46-41D8-A2F7-3C3A5A247AAE} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {E89E1943-40BA-494D-A8CA-79C11FEFFBD1} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: No Name -> {7E853D72-626A-48EC-A868-BA8D5E23E045} ->  No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-28] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll [2007-01-19] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll [2007-01-19] (Microsoft Corporation)
Winsock: Catalog5 05 C:\Program Files\FRITZ!DSL\\sarah.dll [28472 2009-07-28] (AVM Berlin)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2015-04-29] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2015-04-29] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2015-04-29] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2015-04-29] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2015-04-29] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2015-04-29] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2015-04-29] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2015-04-29] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 60 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984 2015-04-29] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\numosj4g.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-28] ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll [2009-09-25] (DivX,Inc.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll [2009-09-25] (DivX, Inc)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\libdivx.dll [2009-09-25] (The OpenSSL Project, hxxp://www.openssl.org/)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdivx32.dll [2009-09-25] (DivX,Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-09-25] (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ssldivx.dll [2009-09-25] (The OpenSSL Project, hxxp://www.openssl.org/)
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2015-03-21]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2015-02-05]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-09-24]

Chrome: 
=======
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\42.0.2311.90\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\42.0.2311.90\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\42.0.2311.90\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (DivX Web Player) - C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll (DivX,Inc.)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (No Name) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-17]
CHR Extension: (Bookmark Manager) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-28]
CHR Extension: (Avast Online Security) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-10]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-10]
CHR Extension: (No Name) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-04]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-28]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [815352 2015-04-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [434424 2015-04-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-29] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-04-29] (Avira Operations GmbH & Co. KG)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-28] (Avast Software s.r.o.)
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.) [File not signed]
R2 DpHost; C:\Program Files\DigitalPersona\Bin\DpHostW.exe [299008 2007-09-20] (DigitalPersona, Inc.) [File not signed]
S2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-10-09] (Hewlett-Packard) [File not signed]
R2 hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [135168 2006-05-02] (Hewlett-Packard Development Company, L.P.) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [73528 2009-07-28] (AVM Berlin)
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] ()
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-09-30] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-09-30] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-04-28] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [74976 2015-04-28] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55200 2015-04-28] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-04-28] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787760 2015-04-28] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427992 2015-04-28] (Avast Software s.r.o.)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57888 2015-04-28] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [209048 2015-04-28] ()
R3 ATSWPDRV; C:\Windows\System32\DRIVERS\ATSwpDrv.sys [146560 2007-08-28] (AuthenTec, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2015-03-17] (Avira Operations GmbH & Co. KG)
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [14976 2006-11-07] (AVM GmbH)
S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-10] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [7168 2007-07-11] (Hewlett-Packard Development Company, L.P.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2015-03-17] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 cpuz134; \??\C:\Users\Andrea\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 SymIM; system32\DRIVERS\SymIM.sys [X]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-29 23:33 - 2015-04-29 23:34 - 00025863 _____ () C:\Users\Andrea\Downloads\FRST.txt
2015-04-29 23:32 - 2015-04-29 23:33 - 00000000 ____D () C:\FRST
2015-04-29 23:31 - 2015-04-29 23:31 - 01140736 _____ (Farbar) C:\Users\Andrea\Downloads\FRST.exe
2015-04-29 23:29 - 2015-04-29 23:29 - 00768512 _____ (Reimage®) C:\Users\Andrea\Downloads\ReimageRepair.exe.part
2015-04-29 17:27 - 2015-04-29 18:07 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Avira
2015-04-29 17:23 - 2015-04-29 18:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-29 17:23 - 2015-04-29 18:05 - 00001819 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-04-29 17:21 - 2015-04-29 17:21 - 00000000 ____D () C:\Program Files\Avira
2015-04-29 17:21 - 2015-03-17 13:02 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2015-04-29 17:21 - 2015-03-17 13:01 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-04-29 17:21 - 2015-03-17 13:01 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-04-29 17:21 - 2015-03-17 13:01 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-04-29 16:51 - 2015-04-29 17:18 - 165283560 _____ () C:\Users\Andrea\Downloads\avira_free_antivirus_de_15.0.9.504.exe
2015-04-29 16:23 - 2015-04-29 16:23 - 00014471 _____ () C:\Windows\AVMInstall.Log
2015-04-29 16:23 - 2009-07-06 03:00 - 00472368 ____N (AVM Berlin) C:\Windows\install.dex
2015-04-29 15:07 - 2015-03-05 04:32 - 00244152 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-29 15:07 - 2015-03-05 04:23 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-29 15:06 - 2015-03-14 04:21 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-29 15:06 - 2015-03-13 03:51 - 03604920 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-04-29 15:06 - 2015-03-13 03:51 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-29 14:46 - 2015-04-29 14:46 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2015-04-29 13:59 - 2015-04-29 13:59 - 04636584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Andrea\Downloads\avira_de_av_5540c77e88c06__ws.exe
2015-04-28 22:22 - 2011-06-21 11:24 - 00032768 _____ () C:\Windows\system32\Drivers\sp_rsdrv2.sys
2015-04-28 22:20 - 2015-04-28 22:21 - 05049344 _____ (Crawler.com ) C:\Users\Andrea\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2015-04-28 21:46 - 2015-04-28 21:42 - 00291312 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-28 21:42 - 2015-04-28 21:42 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-28 21:13 - 2015-04-28 21:18 - 00000000 ____D () C:\AdwCleaner
2015-04-28 21:12 - 2015-04-28 21:12 - 02224640 _____ () C:\Users\Andrea\Downloads\adwcleaner_4.202.exe
2015-04-28 16:51 - 2015-04-28 16:51 - 00000806 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-04-28 16:46 - 2015-04-28 16:46 - 00001404 _____ () C:\Users\Andrea\Desktop\amazon.de.lnk
2015-04-28 16:46 - 2015-04-28 16:46 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\DesktopIconAmazon
2015-04-28 16:02 - 2015-03-10 01:03 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-28 16:02 - 2015-03-10 00:57 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-28 16:02 - 2015-03-10 00:57 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-28 16:02 - 2015-03-10 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-28 16:02 - 2015-03-10 00:55 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-28 16:02 - 2015-03-10 00:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-04-28 16:02 - 2015-03-10 00:55 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-04-28 16:01 - 2015-03-10 01:06 - 12377600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-28 16:01 - 2015-03-10 01:02 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-28 16:01 - 2015-03-10 01:00 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-28 16:01 - 2015-03-10 00:55 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-28 16:01 - 2015-03-10 00:55 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-28 15:37 - 2015-04-28 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-26 20:52 - 2015-04-26 20:53 - 10673209 _____ () C:\Users\Andrea\Downloads\attachments_20150426205219.zip
2015-04-25 20:52 - 2015-04-26 22:56 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{789A27F0-8701-4C9B-B790-6CA563DE3D6C}
2015-04-25 20:52 - 2015-04-25 20:52 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{B7C6ED03-6E77-4622-9571-246FFA9DF968}
2015-04-25 20:49 - 2015-04-25 20:50 - 12091393 _____ () C:\Users\Andrea\Downloads\attachments_20150425204932.zip
2015-04-20 21:27 - 2015-04-20 21:28 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{2C6E799D-BF3F-4542-A28E-7E9EF54D1FD9}
2015-04-19 19:24 - 2015-04-20 21:54 - 00000000 ____D () C:\HDWLE21_TMP
2015-04-19 18:39 - 2015-04-19 18:39 - 00000000 ____D () C:\Users\Andrea\AppData\Local\Panasonic
2015-04-19 18:39 - 2015-04-19 18:39 - 00000000 ____D () C:\ProgramData\Panasonic
2015-04-19 17:48 - 2015-04-19 17:51 - 00000000 ____D () C:\Program Files\Common Files\Panasonic
2015-04-19 17:48 - 2015-04-19 17:48 - 00000000 ____D () C:\Program Files\Panasonic
2015-04-19 14:18 - 2015-04-19 14:18 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2015-04-19 14:18 - 2015-04-19 14:18 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2015-04-19 11:49 - 2015-04-19 11:50 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{FD71EC4F-02E5-499D-B1CD-E6D2E111442A}
2015-04-19 11:49 - 2015-04-19 11:49 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{990D51BC-6832-4F9C-9BCA-087D5BAB5F17}
2015-04-19 01:44 - 2015-04-19 02:11 - 00000000 ____D () C:\Program Files\Windows Live
2015-04-19 01:32 - 2015-04-19 16:09 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-04-19 01:19 - 2015-04-25 20:53 - 00000000 ____D () C:\Users\Andrea\AppData\Local\Windows Live
2015-04-19 01:19 - 2015-04-19 01:19 - 00000000 ____D () C:\Program Files\Common Files\Windows Live
2015-04-19 00:00 - 2015-04-19 00:00 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\MediaInfo
2015-04-18 23:59 - 2015-04-18 23:59 - 00000000 ____D () C:\Program Files\MediaInfo
2015-04-18 23:55 - 2015-04-18 23:55 - 01203488 _____ () C:\Users\Andrea\Downloads\MediaInfo - CHIP-Installer.exe.part
2015-04-04 15:09 - 2015-04-28 14:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox(709)
2015-04-02 13:44 - 2015-04-02 13:44 - 03520935 _____ () C:\Users\Andrea\Downloads\video-1427974124.avi.mp4

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-29 23:32 - 2006-11-02 14:47 - 00004736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-29 23:32 - 2006-11-02 14:47 - 00004736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-29 23:15 - 2012-02-03 19:07 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-29 23:15 - 2012-02-03 19:07 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-29 23:13 - 2012-10-02 15:52 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-29 23:11 - 2007-12-19 05:07 - 01356770 _____ () C:\Windows\WindowsUpdate.log
2015-04-29 19:36 - 2012-02-27 18:22 - 00001923 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-29 18:05 - 2009-08-16 19:46 - 00000000 ____D () C:\ProgramData\Avira
2015-04-29 17:48 - 2014-06-23 15:33 - 00000000 ___RD () C:\Users\Andrea\Dropbox
2015-04-29 17:48 - 2010-03-19 23:33 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Dropbox
2015-04-29 17:43 - 2013-06-19 22:18 - 00049326 _____ () C:\ProgramData\nvModes.dat
2015-04-29 17:43 - 2013-06-19 22:18 - 00049326 _____ () C:\ProgramData\nvModes.001
2015-04-29 17:41 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-29 17:40 - 2013-01-07 19:11 - 00522162 _____ () C:\Windows\PFRO.log
2015-04-29 17:39 - 2007-12-19 05:07 - 00002084 _____ () C:\Windows\bthservsdp.dat
2015-04-29 17:39 - 2006-11-02 15:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-29 16:50 - 2009-08-15 12:56 - 00000000 ____D () C:\Users\Andrea
2015-04-29 16:39 - 2009-10-04 17:28 - 00000000 ___RD () C:\Program Files\Skype
2015-04-29 16:39 - 2009-10-04 17:28 - 00000000 ____D () C:\ProgramData\Skype
2015-04-29 16:32 - 2014-10-08 22:50 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2015-04-29 16:23 - 2010-02-14 21:36 - 00000000 ____D () C:\ProgramData\Apple
2015-04-29 16:23 - 2010-01-30 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Box
2015-04-29 16:23 - 2010-01-30 13:33 - 00000000 ____D () C:\Program Files\FRITZ!Box Monitor
2015-04-29 16:21 - 2010-06-16 13:12 - 00000052 _____ () C:\Windows\system32\DOErrors.log
2015-04-29 15:09 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-04-29 15:08 - 2007-10-24 09:25 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-29 15:03 - 2006-11-02 12:33 - 01572494 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-29 15:00 - 2006-11-02 12:23 - 00000219 _____ () C:\Windows\win.ini
2015-04-29 14:42 - 2007-10-24 09:13 - 00001018 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk
2015-04-29 14:42 - 2007-10-24 09:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works
2015-04-29 14:42 - 2007-10-24 09:12 - 00000000 ____D () C:\Program Files\Microsoft Works
2015-04-28 21:46 - 2014-05-14 19:21 - 00024144 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-28 21:46 - 2013-06-08 22:02 - 00209048 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-28 21:46 - 2013-06-08 22:02 - 00049904 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-28 21:46 - 2011-09-24 18:31 - 00427992 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-28 21:46 - 2011-09-24 18:31 - 00057888 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswTdi.sys
2015-04-28 21:46 - 2011-09-24 18:31 - 00055200 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr.sys
2015-04-28 21:46 - 2011-09-24 18:30 - 00074976 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-28 21:41 - 2011-09-24 18:31 - 00787760 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-28 21:21 - 2012-05-07 18:19 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-28 21:18 - 2012-02-27 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-04-28 21:18 - 2010-03-24 20:20 - 00000000 ____D () C:\ProgramData\ICQ
2015-04-28 21:18 - 2009-08-15 13:09 - 00000937 _____ () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-28 16:51 - 2015-03-21 22:09 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-28 16:51 - 2011-09-20 09:54 - 00000818 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-04-28 16:51 - 2009-08-16 19:18 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Mozilla
2015-04-28 16:29 - 2012-10-02 15:52 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-28 16:29 - 2011-06-22 20:05 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-28 16:25 - 2014-06-23 15:33 - 00000922 _____ () C:\Users\Andrea\Desktop\Dropbox.lnk
2015-04-28 16:25 - 2010-03-19 23:33 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-28 16:13 - 2009-08-15 13:09 - 00104512 _____ () C:\Users\Andrea\AppData\Local\GDIPFONTCACHEV1.DAT
2015-04-28 15:37 - 2014-12-02 23:45 - 00001831 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-28 15:26 - 2007-10-24 09:37 - 00000000 ____D () C:\Program Files\MSN Messenger
2015-04-28 15:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2015-04-28 15:25 - 2014-03-25 19:42 - 62128128 _____ () C:\Windows\system32\config\software_previous
2015-04-28 15:25 - 2014-03-25 19:42 - 38010880 _____ () C:\Windows\system32\config\system_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 51118080 _____ () C:\Windows\system32\config\components_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2015-04-28 15:17 - 2009-10-20 20:37 - 00000000 ____D () C:\Program Files\Common Files\PX Storage Engine
2015-04-28 15:17 - 2009-08-16 19:52 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-04-28 15:17 - 2009-08-15 13:09 - 00000000 ____D () C:\Users\Andrea\AppData\Local\QuickPlay
2015-04-28 15:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2015-04-28 15:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2015-04-28 15:16 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2015-04-26 22:05 - 2014-02-10 19:06 - 00000000 ____D () C:\Users\Andrea\Fellfreunde
2015-04-19 17:48 - 2007-10-24 08:00 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2015-04-19 15:41 - 2013-08-15 14:15 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-19 01:53 - 2013-09-04 22:21 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition
2015-04-19 01:44 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-04-19 01:29 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-04-18 20:17 - 2013-02-11 19:48 - 00006004 _____ () C:\Windows\setupact.log
2015-04-13 20:28 - 2014-01-17 21:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2015-04-10 13:48 - 2010-03-19 23:33 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Dropbox

==================== Files in the root of some directories =======

2009-08-15 13:36 - 2013-06-19 13:02 - 0048438 _____ () C:\Users\Andrea\AppData\Roaming\nvModes.001
2009-08-15 13:32 - 2013-05-28 21:49 - 0048438 _____ () C:\Users\Andrea\AppData\Roaming\nvModes.dat
2009-08-15 13:24 - 2015-03-26 23:15 - 0008658 _____ () C:\Users\Andrea\AppData\Roaming\wklnhst.dat
2009-08-15 13:09 - 2009-08-15 13:09 - 0000000 _____ () C:\Users\Andrea\AppData\Local\AtStart.txt
2009-09-13 13:51 - 2014-08-28 19:04 - 0000680 _____ () C:\Users\Andrea\AppData\Local\d3d9caps.dat
2009-08-15 13:37 - 2014-07-28 13:19 - 0025088 _____ () C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-08-15 13:09 - 2009-08-15 13:09 - 0000000 _____ () C:\Users\Andrea\AppData\Local\DSwitch.txt
2010-01-29 20:35 - 2010-01-29 20:35 - 0000000 _____ () C:\Users\Andrea\AppData\Local\FnF4.txt
2012-04-02 19:21 - 2012-04-02 19:21 - 0000094 _____ () C:\Users\Andrea\AppData\Local\fusioncache.dat
2015-01-18 23:49 - 2015-01-18 23:49 - 0004096 ____H () C:\Users\Andrea\AppData\Local\keyfile3.drm
2009-08-15 13:09 - 2009-08-15 13:09 - 0000000 _____ () C:\Users\Andrea\AppData\Local\QSwitch.txt
2009-10-04 17:34 - 2009-10-04 17:34 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2013-06-19 22:18 - 2015-04-29 17:43 - 0049326 _____ () C:\ProgramData\nvModes.001
2013-06-19 22:18 - 2015-04-29 17:43 - 0049326 _____ () C:\ProgramData\nvModes.dat

Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\avgnt.exe
C:\Users\Andrea\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyipjfb.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-29 17:50

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 29-04-2015 01
Ran by Andrea at 2015-04-29 23:34:42
Running from C:\Users\Andrea\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3332240539-3529680259-2340434327-500 - Administrator - Disabled)
Andrea (S-1-5-21-3332240539-3529680259-2340434327-1000 - Administrator - Enabled) => C:\Users\Andrea
ASPNET (S-1-5-21-3332240539-3529680259-2340434327-1002 - Limited - Enabled)
Gast (S-1-5-21-3332240539-3529680259-2340434327-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
ActiveCheck component for HP Active Support Library (Version: 3.0.0.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
AuthenTec Fingerprint Sensor Minimum Install (HKLM\...\{7F362F06-A9A3-440F-8B19-6A01A72723C4}) (Version: 7.9 - AuthenTec)
AutoUpdate (HKLM\...\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )
Avast Free Antivirus (HKLM\...\avast) (Version: 10.2.2218 - AVAST Software)
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
AVM FRITZ!DSL (HKLM\...\{74A929E2-FBD8-4736-A84E-2ABBB2ABADF2}) (Version: 2.04.03 - AVM Berlin)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11b Network Adapter) (Version: 4.150.22.0 - Broadcom Corporation)
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: 1.4.0.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - Canon Inc.)
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.)
Canon MG6400 series Benutzerregistrierung (HKLM\...\Canon MG6400 series Benutzerregistrierung) (Version:  - *Canon Inc.)
Canon MG6400 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6400_series) (Version: 1.01 - Canon Inc.)
Canon MG6400 series On-screen Manual (HKLM\...\Canon MG6400 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon My Image Garden (HKLM\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.2.1 - Canon Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.36.7.60 - Conexant)
Connect it (HKLM\...\{A899DA1F-D626-401C-8651-F2921E3B4CB3}) (Version: 2.0.0 - Connect it)
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1002 - CyberLink Corp.)
DigitalPersona Personal 3.0.0 (HKLM\...\{C7AF7F33-9092-997E-2D29-DE8095863FE3}) (Version: 3.0.0 - DigitalPersona, Inc.)
DivX Codec (HKLM\...\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.9.1 - DivX, Inc.)
DivX Player (HKLM\...\{8ADFC4160D694100B5B8A22DE9DCABD9}) (Version: 7.2.0 - DivX, Inc.)
DivX Version Checker (HKLM\...\{3FC7CBBC4C1E11DCA1A752EA55D89593}) (Version: 7.1.0.9 - DivX, Inc.)
DivX Web Player (HKLM\...\{B7050CBDB2504B34BC2A9CA0A692CC29}) (Version: 1.5.0 - DivX,Inc.)
Dropbox (HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Dropbox) (Version: 3.4.4 - Dropbox, Inc.)
DVD Suite (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.5.0928 - CyberLink Corp.)
ESU for Microsoft Vista (HKLM\...\{9BA6E8AF-2122-4825-9B55-98BC351E3C94}) (Version: 2.0.10.1 - Hewlett-Packard)
GameXN GO (HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Game Organizer) (Version:  - EasyBits Media)
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.135 - Google Inc.)
Google Drive (HKLM\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Hauppauge MCE XP/Vista Software Encoder (2.0.25149) (HKLM\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.25149 - Hauppauge Computer Works, Inc.)
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDA_HSF) (Version:  - )
HP Active Support Library (HKLM\...\{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}) (Version: 3.1.9.1 - Hewlett-Packard)
HP Customer Experience Enhancements (HKLM\...\{BD0E2B92-3814-46F0-893B-4612EA010C7E}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.02.0001 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM\...\{9885A11E-60E4-417C-B58B-8B31B21C0B8A}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Help and Support (HKLM\...\{31216452-5540-4C96-B754-94890A63D5AB}) (Version: 2.0.10.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.5500 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.5500 - HP)
HP Quick Launch Buttons 6.30 E1 (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.30 E1 - Hewlett-Packard)
HP QuickPlay 3.6 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - )
HP QuickTouch 1.00 C4 (HKLM\...\{7DC4A410-9986-4329-9E5D-687B2C42CA39}) (Version: 1.0.7 - Hewlett-Packard)
HP Total Care Advisor (HKLM\...\{b02df929-29a7-4fd2-9a70-81a644b635f7}) (Version: 1.4.19.2433 - Hewlett-Packard)
HP Update (HKLM\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)
HP User Guides 0087 (HKLM\...\{4D49757C-367A-4333-BDB3-68966162B14E}) (Version: 1.02.0000 - Hewlett-Packard )
HP Wireless Assistant (HKLM\...\{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}) (Version: 3.00 H2 - Hewlett-Packard)
HPAsset component for HP Active Support Library (Version: 3.0.2.2 - Hewlett-Packard) Hidden
HPNetworkAssistant (Version: 1.1.70 - Hewlett-Packard.) Hidden
Huawei modem (HKLM\...\Huawei Modems) (Version:  - )
Java 7 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
LabelPrint (HKLM\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.20.2128 - CyberLink Corp.)
LightScribe System Software  1.10.13.1 (Version: 1.10.13.1 - hxxp://www.lightscribe.com) Hidden
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version:  - )
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 37.0.2 (x86 de) (HKLM\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)
MSCU for Microsoft Vista (HKLM\...\{3D356AA9-2D0C-4373-A762-B42F1A289233}) (Version: 1.0.1.9 - Hewlett-Packard)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: HPCMPQ1902 - WildTangent)
MyDriveConnect 3.3.0.1502 (HKLM\...\MyDriveConnect) (Version: 3.3.0.1502 - TomTom)
NetWaiting (HKLM\...\{3F92ABBB-6BBF-11D5-B229-002078017FBF}) (Version: 2.5.46 - BVRP Software, Inc)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - NVIDIA Corporation)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Power2Go (HKLM\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.3327 - CyberLink Corp.)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2129 - CyberLink Corp.)
PowerDirector (Version: 6.5.2129 - CyberLink Corp.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version:  - )
QuickPlay SlingPlayer 0.4.4 (HKLM\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.4 - SlingMedia)
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.51.01 - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.18.0 - Synaptics)
TomTom HOME 2.8.3.2499 (HKLM\...\TomTom HOME) (Version: 2.8.3.2499 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
USB2 Storage Adapter V3 (LaCie) (HKLM\...\TPP300) (Version:  - )
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0 - DivX, Inc) Hidden
Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
Windows Live Messenger (HKLM\...\{279DB581-239C-4E13-97F8-0F48E40BE75C}) (Version: 8.1.0178.00 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{4D72E5BC-BC7C-11E0-83CA-10424824019B}\InprocServer32 -> C:\Users\Andrea\AppData\Local\ASKTOO~1\DOWNLO~1\AviraIDW.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FBE88A10-FF53-11E0-AB2A-AE904824019B}\InprocServer32 -> C:\Users\Andrea\AppData\Local\ASKTOO~1\DOWNLO~1\AVIRAI~1.DLL No File

==================== Restore Points  =========================

17-03-2015 21:42:12 Windows Update
21-03-2015 21:52:16 Windows Update
25-03-2015 22:35:12 Windows Update
31-03-2015 14:47:45 Windows Update
06-04-2015 19:13:08 avast! antivirus system restore point
07-04-2015 19:57:36 Windows Update
14-04-2015 14:22:35 Windows Update
18-04-2015 19:24:27 Windows Update
19-04-2015 01:20:47 Windows Live Essentials
19-04-2015 01:27:08 Windows Update
19-04-2015 01:34:09 DirectX wurde installiert
19-04-2015 01:36:53 DirectX wurde installiert
19-04-2015 14:01:35 Windows Update
19-04-2015 17:45:18 Installiert HD Writer LE 2.1
20-04-2015 19:15:08 Windows Update
21-04-2015 16:04:52 Windows Update
25-04-2015 17:11:23 Windows Update
27-04-2015 21:31:35 Removed Skype™ 7.0
28-04-2015 13:25:14 Wiederherstellungsvorgang
28-04-2015 13:44:19 avast! antivirus system restore point
28-04-2015 14:02:01 Wiederherstellungsvorgang
28-04-2015 14:47:41 Wiederherstellungsvorgang
28-04-2015 15:29:40 avast! antivirus system restore point
28-04-2015 16:02:48 Windows Update
28-04-2015 21:31:21 avast! antivirus system restore point
29-04-2015 14:01:21 Windows Update
29-04-2015 16:09:22 Removed Apple Software Update
29-04-2015 16:12:22 Removed Apple Mobile Device Support
29-04-2015 16:14:26 Removed Apple Mobile Device Support
29-04-2015 16:17:46 Removed Apple Application Support
29-04-2015 16:24:01 Removed Bonjour
29-04-2015 16:28:08 Removed iTunes
29-04-2015 16:37:41 Removed Skype™ 6.11
29-04-2015 16:41:20 Removed Apple Mobile Device Support

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {17B5CAE3-7EE5-417C-A6F5-C6E258A8BA36} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {21F57ECB-2A4A-4CC6-988D-F1BC3CDBA005} - System32\Tasks\{0C8C4C93-E4EC-4B11-9D59-BC048BF09AA1} => C:\Program Files\Skype\Phone\Skype.exe
Task: {2E9BDE04-B142-4947-88EA-5D35F066E0C5} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-10-09] (Hewlett-Packard)
Task: {3D3F0152-1F5C-4909-837E-1A6FB16A1D20} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {45F153E7-5113-4937-BB7C-155A15B84B04} - System32\Tasks\avastBCLRestartS-1-5-21-3332240539-3529680259-2340434327-1000 => Firefox.exe 
Task: {832C3622-E2DE-4145-B048-F8F65B7DD17A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-04-28] (Avast Software s.r.o.)
Task: {8B02B7DA-5DB5-467B-9A8E-332BFDC0CF60} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-28] (Adobe Systems Incorporated)
Task: {9871882C-89EB-4818-89A3-4475020940F2} - System32\Tasks\{1F2C92B4-9235-4999-8112-9D31F45967C2} => pcalua.exe -a C:\Users\Andrea\Downloads\AVM_FRITZ_WLAN_Repeater_310_Assistent.exe -d C:\Users\Andrea\Downloads
Task: {C568A7BE-4E8A-4807-A654-71149700A2A3} - System32\Tasks\{13E362E9-92BC-441D-B508-1245A60B8D92} => pcalua.exe -a E:\SETUP.EXE -d E:\
Task: {D884BFFD-48E4-499E-AEDD-6D74F91FDC6A} - System32\Tasks\{19B26A87-4A51-45F6-9E75-5FC82E2CB93D} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=4.1.0.166.217&amp;LastError=12029
Task: {D94FCE49-3034-4AA8-BEDE-661665A7B084} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {EF802554-FE0E-4452-B24E-FEFCBBE098DB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {FA6D8A6A-96A8-4DC7-8CDA-1F495BBC0B66} - System32\Tasks\{E76E00A4-8AD4-4280-838D-551E953F708B} => Firefox.exe hxxp://ui.skype.com/ui/0/4.2.0.169.217/de/abandoninstall?page=tsChrome&amp;installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:offered-installed;madedefault

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-04-06 19:25 - 2015-04-28 21:42 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-04-06 19:25 - 2015-04-28 21:42 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-04-29 13:39 - 2015-04-29 13:39 - 02925568 _____ () C:\Program Files\AVAST Software\Avast\defs\15042900\algo.dll
2015-04-29 23:20 - 2015-04-29 23:20 - 02925568 _____ () C:\Program Files\AVAST Software\Avast\defs\15042901\algo.dll
2011-10-29 18:24 - 2001-10-28 17:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2014-01-17 22:26 - 2013-05-14 11:50 - 00140936 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
2007-12-19 05:26 - 2007-09-30 20:34 - 00271760 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2007-12-19 05:26 - 2007-09-30 20:34 - 00255384 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2007-12-19 05:26 - 2007-09-30 20:34 - 00038184 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2007-10-24 09:35 - 2007-01-09 12:25 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2007-12-19 05:26 - 2007-09-30 20:34 - 00112016 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-02-11 01:46 - 2015-04-28 21:45 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2007-05-16 10:43 - 2007-05-16 11:12 - 00671744 _____ () C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
2015-04-29 17:47 - 2015-04-29 17:47 - 00043008 _____ () c:\users\andrea\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyipjfb.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2007-12-19 05:25 - 2007-09-30 20:33 - 00066856 _____ () C:\Program Files\HP\QuickPlay\Kernel\Common\MCEMediaStatus.dll
2009-08-16 19:52 - 2008-06-19 17:35 - 00333288 _____ () C:\Program Files\Spybot - Search & Destroy\sqlite3.dll
2009-08-16 19:52 - 2008-03-04 14:52 - 00790392 _____ () C:\Program Files\Spybot - Search & Destroy\Plugins\Chai.dll
2009-08-16 19:52 - 2008-03-05 09:34 - 00795520 _____ () C:\Program Files\Spybot - Search & Destroy\Plugins\Fennel.dll
2009-08-16 19:52 - 2008-02-26 11:04 - 00717176 _____ () C:\Program Files\Spybot - Search & Destroy\Plugins\Mate.dll
2009-08-16 19:52 - 2007-12-24 01:05 - 00121344 _____ () C:\Program Files\Spybot - Search & Destroy\Plugins\TCPIPAddress.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Andrea\Pictures\Urlaub Rovinj 2011\Urlaub 2011 085.JPG
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [{5C1BDBCD-A111-4618-90CA-9FDBEE4144C6}] => (Allow) C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
FirewallRules: [{65076D90-E8CF-45CC-A013-A167D76022E4}] => (Allow) C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
FirewallRules: [{D81DCF4F-D3B7-40C9-8186-03D27A64E629}] => (Allow) C:\Program Files\Cyberlink\PowerDirector\PDR.EXE
FirewallRules: [{82BD6292-3753-4C8C-B85B-84D9D47E3E86}] => (Allow) C:\Program Files\MSN Messenger\msnmsgr.exe
FirewallRules: [{B2EEA14D-A39B-4479-80AB-C7DDFA9B2183}] => (Allow) svchost.exe
FirewallRules: [{0FFD5ABE-9BB4-4873-8EA3-DE25FAA90BED}] => (Allow) C:\Program Files\MSN Messenger\livecall.exe
FirewallRules: [{4DC5BA04-053E-4A08-AB47-8E122A9043B6}] => (Allow) C:\Program Files\HP\QuickPlay\QP.exe
FirewallRules: [{76E9269D-0855-4B9C-BFAB-3BE39CE21CB1}] => (Allow) C:\Program Files\HP\QuickPlay\QPService.exe
FirewallRules: [TCP Query User{B3B3425B-D786-432A-A00D-2DDB9A399E1E}C:\program files\edonkey2000\edonkey2000.exe] => (Allow) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [UDP Query User{DBCC6D91-8EDB-41B6-B6C3-5C238428A24A}C:\program files\edonkey2000\edonkey2000.exe] => (Allow) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [TCP Query User{61A8A174-591E-4696-8C2E-A82BD2F425A1}C:\program files\edonkey2000\edonkey2000.exe] => (Block) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [UDP Query User{75858838-E10D-4F5D-9A3E-66FDC520E069}C:\program files\edonkey2000\edonkey2000.exe] => (Block) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [TCP Query User{3B7B0DEE-398B-495E-8435-2083C9DC49CC}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Block) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [UDP Query User{F9271F30-2DAB-4257-9EC0-1CE7D81C4BA5}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Block) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [TCP Query User{8B9BEF2A-9C08-41C6-8B08-EFBA960895C3}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Allow) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [UDP Query User{64902BD5-31D9-4DDC-8462-44869462ADBD}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Allow) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [{84C4E59D-3739-401A-A19D-6AA42338B993}] => (Allow) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
FirewallRules: [{916B2A70-48C5-4DCD-91EB-88FB08704C29}] => (Allow) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
FirewallRules: [{F65EDFA6-D7C2-4740-86B0-2033FDA86D54}] => (Allow) C:\Program Files\FRITZ!DSL\FBOXUPD.EXE
FirewallRules: [{216B4696-2533-4291-BD51-5277A36511D0}] => (Allow) C:\Program Files\FRITZ!DSL\FBOXUPD.EXE
FirewallRules: [{B51500E1-2050-47E7-832F-D94BDF799AFA}] => (Allow) C:\Program Files\FRITZ!DSL\WebwaIgd.exe
FirewallRules: [{1E88B0AA-D582-4029-AAEA-035834B416E7}] => (Allow) C:\Program Files\FRITZ!DSL\WebwaIgd.exe
FirewallRules: [TCP Query User{F988F6AB-1E13-4093-BC77-A628CB95CA6E}C:\program files\icq7.1\icq.exe] => (Block) C:\program files\icq7.1\icq.exe
FirewallRules: [UDP Query User{9A8C274D-51C8-4FDE-A41A-394DF88FCACE}C:\program files\icq7.1\icq.exe] => (Block) C:\program files\icq7.1\icq.exe
FirewallRules: [TCP Query User{17109E81-B135-4423-BBA9-E421C9213A76}C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{5CCE0580-0F32-4D93-A9C0-83191F068C8E}C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{167A77B1-4149-483B-9191-145FEC505B15}] => (Allow) LPort=80
FirewallRules: [{0EA5834B-3416-4599-AC6B-6908186FEFD1}] => (Allow) LPort=80
FirewallRules: [{3144AF78-0C59-4632-A078-3BA477D4D1CD}] => (Allow) LPort=80
FirewallRules: [{E298C50A-615A-49C3-8ADB-A741F6754031}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7B3FAB8C-F417-4D16-B9BA-947134AB665E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5B74490C-05C6-473A-BC2B-9656CEC8DE15}] => (Allow) c:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{48E3E3BE-3622-4DB6-A947-3889AE7F2B71}] => (Allow) C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
FirewallRules: [{0A608187-EDBF-4547-9A61-27E7D10D218A}] => (Allow) C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
FirewallRules: [{108289A7-49F9-49E1-8E9E-6CB5576E77FC}] => (Allow) C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE
FirewallRules: [{255532AF-6A82-44D9-BD05-E81DADB500F0}] => (Allow) C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE
FirewallRules: [{E1D410D1-7358-42EE-9637-233EDDC8820C}] => (Allow) C:\Program Files\Microsoft Office\Office14\outlook.exe
FirewallRules: [{F167A822-03B9-40C7-B2B3-39666187F437}] => (Allow) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{FB951898-99A2-4695-A510-8F5AF0CA3032}] => (Allow) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E7F5C095-01D3-49E1-86E0-E63EA93AE97C}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{9952E0C0-C9CE-4289-8274-F49C71E9B095}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [UDP Query User{A749F86E-E8B3-41F0-B31B-7DC009D9FF0C}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [TCP Query User{EA53E467-80D5-4AC0-B4E0-6E7FD2DA3C6C}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [UDP Query User{138C08C7-48B7-49C6-9B6D-48AEE7E17829}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [TCP Query User{FF8C8A29-B041-49B4-B930-12ECD0C6DED1}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{7C50586A-34A0-4DA0-9A5E-47EDD94D82CF}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{E2365A75-2608-4331-9D70-B803EF108BF6}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{DB9B5E51-0323-4992-AF48-24C19573535F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{D19B97D5-0437-4CC4-8C20-336A40098492}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Microsoft-ISATAP-Adapter #3
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================
Error: (04/29/2015 06:05:50 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA IM INTERNET.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:50 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA IM INTERNET.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:49 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS HILFE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:49 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS HILFE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:48 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS STARTEN.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:48 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS STARTEN.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 04:23:09 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Andrea-PC)
Description: 0AppleMobileDeviceService.exeApple Mobile Device03026217818800

Error: (04/28/2015 09:30:23 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {c493a069-b731-4fde-afde-52fd96bb3575}

Error: (04/28/2015 07:24:44 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\ANDREA\APPDATA\ROAMING\MOZILLA\FIREFOX> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Djangolino · 29.04.2015, 22:47

Sorry, gerade gesehen, das da was fehlt.

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 29-04-2015 01
Ran by Andrea at 2015-04-29 23:34:42
Running from C:\Users\Andrea\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3332240539-3529680259-2340434327-500 - Administrator - Disabled)
Andrea (S-1-5-21-3332240539-3529680259-2340434327-1000 - Administrator - Enabled) => C:\Users\Andrea
ASPNET (S-1-5-21-3332240539-3529680259-2340434327-1002 - Limited - Enabled)
Gast (S-1-5-21-3332240539-3529680259-2340434327-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
ActiveCheck component for HP Active Support Library (Version: 3.0.0.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
AuthenTec Fingerprint Sensor Minimum Install (HKLM\...\{7F362F06-A9A3-440F-8B19-6A01A72723C4}) (Version: 7.9 - AuthenTec)
AutoUpdate (HKLM\...\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )
Avast Free Antivirus (HKLM\...\avast) (Version: 10.2.2218 - AVAST Software)
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
AVM FRITZ!DSL (HKLM\...\{74A929E2-FBD8-4736-A84E-2ABBB2ABADF2}) (Version: 2.04.03 - AVM Berlin)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11b Network Adapter) (Version: 4.150.22.0 - Broadcom Corporation)
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: 1.4.0.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - Canon Inc.)
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.)
Canon MG6400 series Benutzerregistrierung (HKLM\...\Canon MG6400 series Benutzerregistrierung) (Version:  - *Canon Inc.)
Canon MG6400 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6400_series) (Version: 1.01 - Canon Inc.)
Canon MG6400 series On-screen Manual (HKLM\...\Canon MG6400 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon My Image Garden (HKLM\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.2.1 - Canon Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.36.7.60 - Conexant)
Connect it (HKLM\...\{A899DA1F-D626-401C-8651-F2921E3B4CB3}) (Version: 2.0.0 - Connect it)
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1002 - CyberLink Corp.)
DigitalPersona Personal 3.0.0 (HKLM\...\{C7AF7F33-9092-997E-2D29-DE8095863FE3}) (Version: 3.0.0 - DigitalPersona, Inc.)
DivX Codec (HKLM\...\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.9.1 - DivX, Inc.)
DivX Player (HKLM\...\{8ADFC4160D694100B5B8A22DE9DCABD9}) (Version: 7.2.0 - DivX, Inc.)
DivX Version Checker (HKLM\...\{3FC7CBBC4C1E11DCA1A752EA55D89593}) (Version: 7.1.0.9 - DivX, Inc.)
DivX Web Player (HKLM\...\{B7050CBDB2504B34BC2A9CA0A692CC29}) (Version: 1.5.0 - DivX,Inc.)
Dropbox (HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Dropbox) (Version: 3.4.4 - Dropbox, Inc.)
DVD Suite (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.5.0928 - CyberLink Corp.)
ESU for Microsoft Vista (HKLM\...\{9BA6E8AF-2122-4825-9B55-98BC351E3C94}) (Version: 2.0.10.1 - Hewlett-Packard)
GameXN GO (HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Game Organizer) (Version:  - EasyBits Media)
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.135 - Google Inc.)
Google Drive (HKLM\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Hauppauge MCE XP/Vista Software Encoder (2.0.25149) (HKLM\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.25149 - Hauppauge Computer Works, Inc.)
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDA_HSF) (Version:  - )
HP Active Support Library (HKLM\...\{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}) (Version: 3.1.9.1 - Hewlett-Packard)
HP Customer Experience Enhancements (HKLM\...\{BD0E2B92-3814-46F0-893B-4612EA010C7E}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.02.0001 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM\...\{9885A11E-60E4-417C-B58B-8B31B21C0B8A}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Help and Support (HKLM\...\{31216452-5540-4C96-B754-94890A63D5AB}) (Version: 2.0.10.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.5500 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.5500 - HP)
HP Quick Launch Buttons 6.30 E1 (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.30 E1 - Hewlett-Packard)
HP QuickPlay 3.6 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - )
HP QuickTouch 1.00 C4 (HKLM\...\{7DC4A410-9986-4329-9E5D-687B2C42CA39}) (Version: 1.0.7 - Hewlett-Packard)
HP Total Care Advisor (HKLM\...\{b02df929-29a7-4fd2-9a70-81a644b635f7}) (Version: 1.4.19.2433 - Hewlett-Packard)
HP Update (HKLM\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)
HP User Guides 0087 (HKLM\...\{4D49757C-367A-4333-BDB3-68966162B14E}) (Version: 1.02.0000 - Hewlett-Packard )
HP Wireless Assistant (HKLM\...\{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}) (Version: 3.00 H2 - Hewlett-Packard)
HPAsset component for HP Active Support Library (Version: 3.0.2.2 - Hewlett-Packard) Hidden
HPNetworkAssistant (Version: 1.1.70 - Hewlett-Packard.) Hidden
Huawei modem (HKLM\...\Huawei Modems) (Version:  - )
Java 7 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
LabelPrint (HKLM\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.20.2128 - CyberLink Corp.)
LightScribe System Software  1.10.13.1 (Version: 1.10.13.1 - hxxp://www.lightscribe.com) Hidden
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version:  - )
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 37.0.2 (x86 de) (HKLM\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)
MSCU for Microsoft Vista (HKLM\...\{3D356AA9-2D0C-4373-A762-B42F1A289233}) (Version: 1.0.1.9 - Hewlett-Packard)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: HPCMPQ1902 - WildTangent)
MyDriveConnect 3.3.0.1502 (HKLM\...\MyDriveConnect) (Version: 3.3.0.1502 - TomTom)
NetWaiting (HKLM\...\{3F92ABBB-6BBF-11D5-B229-002078017FBF}) (Version: 2.5.46 - BVRP Software, Inc)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - NVIDIA Corporation)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Power2Go (HKLM\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.3327 - CyberLink Corp.)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2129 - CyberLink Corp.)
PowerDirector (Version: 6.5.2129 - CyberLink Corp.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version:  - )
QuickPlay SlingPlayer 0.4.4 (HKLM\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.4 - SlingMedia)
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.51.01 - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.18.0 - Synaptics)
TomTom HOME 2.8.3.2499 (HKLM\...\TomTom HOME) (Version: 2.8.3.2499 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
USB2 Storage Adapter V3 (LaCie) (HKLM\...\TPP300) (Version:  - )
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0 - DivX, Inc) Hidden
Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
Windows Live Messenger (HKLM\...\{279DB581-239C-4E13-97F8-0F48E40BE75C}) (Version: 8.1.0178.00 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{4D72E5BC-BC7C-11E0-83CA-10424824019B}\InprocServer32 -> C:\Users\Andrea\AppData\Local\ASKTOO~1\DOWNLO~1\AviraIDW.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FBE88A10-FF53-11E0-AB2A-AE904824019B}\InprocServer32 -> C:\Users\Andrea\AppData\Local\ASKTOO~1\DOWNLO~1\AVIRAI~1.DLL No File

==================== Restore Points  =========================

17-03-2015 21:42:12 Windows Update
21-03-2015 21:52:16 Windows Update
25-03-2015 22:35:12 Windows Update
31-03-2015 14:47:45 Windows Update
06-04-2015 19:13:08 avast! antivirus system restore point
07-04-2015 19:57:36 Windows Update
14-04-2015 14:22:35 Windows Update
18-04-2015 19:24:27 Windows Update
19-04-2015 01:20:47 Windows Live Essentials
19-04-2015 01:27:08 Windows Update
19-04-2015 01:34:09 DirectX wurde installiert
19-04-2015 01:36:53 DirectX wurde installiert
19-04-2015 14:01:35 Windows Update
19-04-2015 17:45:18 Installiert HD Writer LE 2.1
20-04-2015 19:15:08 Windows Update
21-04-2015 16:04:52 Windows Update
25-04-2015 17:11:23 Windows Update
27-04-2015 21:31:35 Removed Skype™ 7.0
28-04-2015 13:25:14 Wiederherstellungsvorgang
28-04-2015 13:44:19 avast! antivirus system restore point
28-04-2015 14:02:01 Wiederherstellungsvorgang
28-04-2015 14:47:41 Wiederherstellungsvorgang
28-04-2015 15:29:40 avast! antivirus system restore point
28-04-2015 16:02:48 Windows Update
28-04-2015 21:31:21 avast! antivirus system restore point
29-04-2015 14:01:21 Windows Update
29-04-2015 16:09:22 Removed Apple Software Update
29-04-2015 16:12:22 Removed Apple Mobile Device Support
29-04-2015 16:14:26 Removed Apple Mobile Device Support
29-04-2015 16:17:46 Removed Apple Application Support
29-04-2015 16:24:01 Removed Bonjour
29-04-2015 16:28:08 Removed iTunes
29-04-2015 16:37:41 Removed Skype™ 6.11
29-04-2015 16:41:20 Removed Apple Mobile Device Support

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {17B5CAE3-7EE5-417C-A6F5-C6E258A8BA36} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {21F57ECB-2A4A-4CC6-988D-F1BC3CDBA005} - System32\Tasks\{0C8C4C93-E4EC-4B11-9D59-BC048BF09AA1} => C:\Program Files\Skype\Phone\Skype.exe
Task: {2E9BDE04-B142-4947-88EA-5D35F066E0C5} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-10-09] (Hewlett-Packard)
Task: {3D3F0152-1F5C-4909-837E-1A6FB16A1D20} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {45F153E7-5113-4937-BB7C-155A15B84B04} - System32\Tasks\avastBCLRestartS-1-5-21-3332240539-3529680259-2340434327-1000 => Firefox.exe 
Task: {832C3622-E2DE-4145-B048-F8F65B7DD17A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-04-28] (Avast Software s.r.o.)
Task: {8B02B7DA-5DB5-467B-9A8E-332BFDC0CF60} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-28] (Adobe Systems Incorporated)
Task: {9871882C-89EB-4818-89A3-4475020940F2} - System32\Tasks\{1F2C92B4-9235-4999-8112-9D31F45967C2} => pcalua.exe -a C:\Users\Andrea\Downloads\AVM_FRITZ_WLAN_Repeater_310_Assistent.exe -d C:\Users\Andrea\Downloads
Task: {C568A7BE-4E8A-4807-A654-71149700A2A3} - System32\Tasks\{13E362E9-92BC-441D-B508-1245A60B8D92} => pcalua.exe -a E:\SETUP.EXE -d E:\
Task: {D884BFFD-48E4-499E-AEDD-6D74F91FDC6A} - System32\Tasks\{19B26A87-4A51-45F6-9E75-5FC82E2CB93D} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=4.1.0.166.217&amp;LastError=12029
Task: {D94FCE49-3034-4AA8-BEDE-661665A7B084} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {EF802554-FE0E-4452-B24E-FEFCBBE098DB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {FA6D8A6A-96A8-4DC7-8CDA-1F495BBC0B66} - System32\Tasks\{E76E00A4-8AD4-4280-838D-551E953F708B} => Firefox.exe hxxp://ui.skype.com/ui/0/4.2.0.169.217/de/abandoninstall?page=tsChrome&amp;installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:offered-installed;madedefault

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-04-06 19:25 - 2015-04-28 21:42 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-04-06 19:25 - 2015-04-28 21:42 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-04-29 13:39 - 2015-04-29 13:39 - 02925568 _____ () C:\Program Files\AVAST Software\Avast\defs\15042900\algo.dll
2015-04-29 23:20 - 2015-04-29 23:20 - 02925568 _____ () C:\Program Files\AVAST Software\Avast\defs\15042901\algo.dll
2011-10-29 18:24 - 2001-10-28 17:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2014-01-17 22:26 - 2013-05-14 11:50 - 00140936 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
2007-12-19 05:26 - 2007-09-30 20:34 - 00271760 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2007-12-19 05:26 - 2007-09-30 20:34 - 00255384 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2007-12-19 05:26 - 2007-09-30 20:34 - 00038184 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2007-10-24 09:35 - 2007-01-09 12:25 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2007-12-19 05:26 - 2007-09-30 20:34 - 00112016 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-02-11 01:46 - 2015-04-28 21:45 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2007-05-16 10:43 - 2007-05-16 11:12 - 00671744 _____ () C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
2015-04-29 17:47 - 2015-04-29 17:47 - 00043008 _____ () c:\users\andrea\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyipjfb.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2007-12-19 05:25 - 2007-09-30 20:33 - 00066856 _____ () C:\Program Files\HP\QuickPlay\Kernel\Common\MCEMediaStatus.dll
2009-08-16 19:52 - 2008-06-19 17:35 - 00333288 _____ () C:\Program Files\Spybot - Search & Destroy\sqlite3.dll
2009-08-16 19:52 - 2008-03-04 14:52 - 00790392 _____ () C:\Program Files\Spybot - Search & Destroy\Plugins\Chai.dll
2009-08-16 19:52 - 2008-03-05 09:34 - 00795520 _____ () C:\Program Files\Spybot - Search & Destroy\Plugins\Fennel.dll
2009-08-16 19:52 - 2008-02-26 11:04 - 00717176 _____ () C:\Program Files\Spybot - Search & Destroy\Plugins\Mate.dll
2009-08-16 19:52 - 2007-12-24 01:05 - 00121344 _____ () C:\Program Files\Spybot - Search & Destroy\Plugins\TCPIPAddress.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Andrea\Pictures\Urlaub Rovinj 2011\Urlaub 2011 085.JPG
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [{5C1BDBCD-A111-4618-90CA-9FDBEE4144C6}] => (Allow) C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
FirewallRules: [{65076D90-E8CF-45CC-A013-A167D76022E4}] => (Allow) C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
FirewallRules: [{D81DCF4F-D3B7-40C9-8186-03D27A64E629}] => (Allow) C:\Program Files\Cyberlink\PowerDirector\PDR.EXE
FirewallRules: [{82BD6292-3753-4C8C-B85B-84D9D47E3E86}] => (Allow) C:\Program Files\MSN Messenger\msnmsgr.exe
FirewallRules: [{B2EEA14D-A39B-4479-80AB-C7DDFA9B2183}] => (Allow) svchost.exe
FirewallRules: [{0FFD5ABE-9BB4-4873-8EA3-DE25FAA90BED}] => (Allow) C:\Program Files\MSN Messenger\livecall.exe
FirewallRules: [{4DC5BA04-053E-4A08-AB47-8E122A9043B6}] => (Allow) C:\Program Files\HP\QuickPlay\QP.exe
FirewallRules: [{76E9269D-0855-4B9C-BFAB-3BE39CE21CB1}] => (Allow) C:\Program Files\HP\QuickPlay\QPService.exe
FirewallRules: [TCP Query User{B3B3425B-D786-432A-A00D-2DDB9A399E1E}C:\program files\edonkey2000\edonkey2000.exe] => (Allow) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [UDP Query User{DBCC6D91-8EDB-41B6-B6C3-5C238428A24A}C:\program files\edonkey2000\edonkey2000.exe] => (Allow) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [TCP Query User{61A8A174-591E-4696-8C2E-A82BD2F425A1}C:\program files\edonkey2000\edonkey2000.exe] => (Block) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [UDP Query User{75858838-E10D-4F5D-9A3E-66FDC520E069}C:\program files\edonkey2000\edonkey2000.exe] => (Block) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [TCP Query User{3B7B0DEE-398B-495E-8435-2083C9DC49CC}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Block) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [UDP Query User{F9271F30-2DAB-4257-9EC0-1CE7D81C4BA5}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Block) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [TCP Query User{8B9BEF2A-9C08-41C6-8B08-EFBA960895C3}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Allow) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [UDP Query User{64902BD5-31D9-4DDC-8462-44869462ADBD}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Allow) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [{84C4E59D-3739-401A-A19D-6AA42338B993}] => (Allow) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
FirewallRules: [{916B2A70-48C5-4DCD-91EB-88FB08704C29}] => (Allow) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
FirewallRules: [{F65EDFA6-D7C2-4740-86B0-2033FDA86D54}] => (Allow) C:\Program Files\FRITZ!DSL\FBOXUPD.EXE
FirewallRules: [{216B4696-2533-4291-BD51-5277A36511D0}] => (Allow) C:\Program Files\FRITZ!DSL\FBOXUPD.EXE
FirewallRules: [{B51500E1-2050-47E7-832F-D94BDF799AFA}] => (Allow) C:\Program Files\FRITZ!DSL\WebwaIgd.exe
FirewallRules: [{1E88B0AA-D582-4029-AAEA-035834B416E7}] => (Allow) C:\Program Files\FRITZ!DSL\WebwaIgd.exe
FirewallRules: [TCP Query User{F988F6AB-1E13-4093-BC77-A628CB95CA6E}C:\program files\icq7.1\icq.exe] => (Block) C:\program files\icq7.1\icq.exe
FirewallRules: [UDP Query User{9A8C274D-51C8-4FDE-A41A-394DF88FCACE}C:\program files\icq7.1\icq.exe] => (Block) C:\program files\icq7.1\icq.exe
FirewallRules: [TCP Query User{17109E81-B135-4423-BBA9-E421C9213A76}C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{5CCE0580-0F32-4D93-A9C0-83191F068C8E}C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{167A77B1-4149-483B-9191-145FEC505B15}] => (Allow) LPort=80
FirewallRules: [{0EA5834B-3416-4599-AC6B-6908186FEFD1}] => (Allow) LPort=80
FirewallRules: [{3144AF78-0C59-4632-A078-3BA477D4D1CD}] => (Allow) LPort=80
FirewallRules: [{E298C50A-615A-49C3-8ADB-A741F6754031}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7B3FAB8C-F417-4D16-B9BA-947134AB665E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5B74490C-05C6-473A-BC2B-9656CEC8DE15}] => (Allow) c:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{48E3E3BE-3622-4DB6-A947-3889AE7F2B71}] => (Allow) C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
FirewallRules: [{0A608187-EDBF-4547-9A61-27E7D10D218A}] => (Allow) C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
FirewallRules: [{108289A7-49F9-49E1-8E9E-6CB5576E77FC}] => (Allow) C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE
FirewallRules: [{255532AF-6A82-44D9-BD05-E81DADB500F0}] => (Allow) C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE
FirewallRules: [{E1D410D1-7358-42EE-9637-233EDDC8820C}] => (Allow) C:\Program Files\Microsoft Office\Office14\outlook.exe
FirewallRules: [{F167A822-03B9-40C7-B2B3-39666187F437}] => (Allow) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{FB951898-99A2-4695-A510-8F5AF0CA3032}] => (Allow) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E7F5C095-01D3-49E1-86E0-E63EA93AE97C}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{9952E0C0-C9CE-4289-8274-F49C71E9B095}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [UDP Query User{A749F86E-E8B3-41F0-B31B-7DC009D9FF0C}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [TCP Query User{EA53E467-80D5-4AC0-B4E0-6E7FD2DA3C6C}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [UDP Query User{138C08C7-48B7-49C6-9B6D-48AEE7E17829}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [TCP Query User{FF8C8A29-B041-49B4-B930-12ECD0C6DED1}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{7C50586A-34A0-4DA0-9A5E-47EDD94D82CF}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{E2365A75-2608-4331-9D70-B803EF108BF6}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{DB9B5E51-0323-4992-AF48-24C19573535F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{D19B97D5-0437-4CC4-8C20-336A40098492}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Microsoft-ISATAP-Adapter #3
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================
Error: (04/29/2015 06:05:50 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA IM INTERNET.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:50 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA IM INTERNET.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:49 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS HILFE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:49 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS HILFE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:48 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS STARTEN.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:48 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS STARTEN.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 04:23:09 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Andrea-PC)
Description: 0AppleMobileDeviceService.exeApple Mobile Device03026217818800

Error: (04/28/2015 09:30:23 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {c493a069-b731-4fde-afde-52fd96bb3575}

Error: (04/28/2015 07:24:44 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\ANDREA\APPDATA\ROAMING\MOZILLA\FIREFOX> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/28/2015 07:24:44 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\ANDREA\APPDATA\ROAMING\MOZILLA\FIREFOX> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)


System errors:
=============
Error: (04/29/2015 05:49:49 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Windows Update

Error: (04/29/2015 05:45:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: HP Health Check Service%%1053

Error: (04/29/2015 05:45:55 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000HP Health Check Service

Error: (04/29/2015 05:45:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Media Player-Netzwerkfreigabedienst%%1053

Error: (04/29/2015 05:45:25 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Media Player-Netzwerkfreigabedienst

Error: (04/29/2015 05:42:01 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (04/29/2015 05:42:01 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: ComputerbrowserServer%%1058

Error: (04/29/2015 04:23:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Apple Mobile Device%%1053

Error: (04/29/2015 04:23:09 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Apple Mobile Device

Error: (04/29/2015 03:17:49 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: QuickPlay Task Scheduler (QTS)QuickPlay Background Capture Service (QBCS)%%1070


Microsoft Office Sessions:
=========================
Error: (04/29/2015 06:05:50 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA IM INTERNET.LNK

Error: (04/29/2015 06:05:50 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA IM INTERNET.LNK

Error: (04/29/2015 06:05:49 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS HILFE.LNK

Error: (04/29/2015 06:05:49 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS HILFE.LNK

Error: (04/29/2015 06:05:48 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS STARTEN.LNK

Error: (04/29/2015 06:05:48 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS STARTEN.LNK

Error: (04/29/2015 04:23:09 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Andrea-PC)
Description: 0AppleMobileDeviceService.exeApple Mobile Device03026217818800

Error: (04/28/2015 09:30:23 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005

Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {c493a069-b731-4fde-afde-52fd96bb3575}

Error: (04/28/2015 07:24:44 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\USERS\ANDREA\APPDATA\ROAMING\MOZILLA\FIREFOX

Error: (04/28/2015 07:24:44 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\USERS\ANDREA\APPDATA\ROAMING\MOZILLA\FIREFOX


CodeIntegrity Errors:
===================================
  Date: 2014-06-16 17:37:35.645
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\DigitalPersona\Bin\DpOFeedb.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-16 17:37:34.730
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\DigitalPersona\Bin\DpOFeedb.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-16 17:36:09.172
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\DigitalPersona\Bin\DpOFeedb.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-16 17:36:08.438
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\DigitalPersona\Bin\DpOFeedb.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-16 17:36:07.707
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\DigitalPersona\Bin\DpOFeedb.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-16 17:36:06.904
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\DigitalPersona\Bin\DpOFeedb.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-16 17:36:06.142
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\DigitalPersona\Bin\DpOFeedb.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-16 17:36:05.374
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\DigitalPersona\Bin\DpOFeedb.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-16 17:36:04.641
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\DigitalPersona\Bin\DpOFeedb.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-16 17:36:03.875
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\DigitalPersona\Bin\DpOFeedb.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: AMD Turion(tm) 64 X2 Mobile Technology TL-60
Percentage of memory in use: 64%
Total physical RAM: 2046.23 MB
Available physical RAM: 730.49 MB
Total Pagefile: 4332.92 MB
Available Pagefile: 2083.52 MB
Total Virtual: 2047.88 MB
Available Virtual: 1890.24 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:221.04 GB) (Free:77.27 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (HP_RECOVERY) (Fixed) (Total:11.84 GB) (Free:2.14 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: 415D13E6)
Partition 1: (Active) - (Size=221 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=11.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

deeprybka · 30.04.2015, 15:45

Hi,
bitte mal Avira und Spybot deinstallieren.

Anschließend neue Scans:

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2

Download und Anleitung
Starte Malwarebytes' Anti-Malware (MBAM).
Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
Unter Einstellungen/ Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
Gehe zurück zum Armaturenbrett und klicke auf "Jetzt scannen".
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben und poste mir das Log.

Schritt 3

Bitte starte FRST erneut, markiere auch die checkbox

und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.

Djangolino · 30.04.2015, 17:26

Code:

ATTFilter

# AdwCleaner v4.202 - Bericht erstellt 30/04/2015 um 17:17:52
# Aktualisiert 23/04/2015 von Xplode
# Datenbank : 2015-04-27.1 [Server]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (x86)
# Benutzername : Andrea - ANDREA-PC
# Gestarted von : C:\Users\Andrea\Desktop\AdwCleaner_4.202.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gelöscht : C:\Windows\system32\drivers\sp_rsdrv2.sys

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:64494;hxxps=127.0.0.1:64494
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>

***** [ Internetbrowser ] *****

-\\ Internet Explorer v9.0.8112.16636


-\\ Mozilla Firefox v37.0.2 (x86 de)


-\\ Google Chrome v42.0.2311.135


*************************

AdwCleaner[R0].txt - [9524 Bytes] - [28/04/2015 21:13:25]
AdwCleaner[R1].txt - [1840 Bytes] - [30/04/2015 17:15:38]
AdwCleaner[S0].txt - [9076 Bytes] - [28/04/2015 21:18:12]
AdwCleaner[S1].txt - [1530 Bytes] - [30/04/2015 17:17:52]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1589  Bytes] ##########

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 30.04.2015
Suchlauf-Zeit: 17:35:22
Logdatei: mbamlog.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.04.30.05
Rootkit Datenbank: v2015.04.21.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Andrea

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 307145
Verstrichene Zeit: 18 Min, 56 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 1
PUP.Optional.Spigot.A, HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E89E1943-40BA-494D-A8CA-79C11FEFFBD1}|URL, hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}, In Quarantäne, [704d77fb7a108ea8726dad1db54e4ab6]

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 1
PUP.Optional.ClientConnect, C:\Users\Andrea\Downloads\IncrediMail_TSA280N5P.exe, In Quarantäne, [48755022602abf770669a52bda27d12f], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-04-2015 01
Ran by Andrea (administrator) on ANDREA-PC on 30-04-2015 18:11:14
Running from C:\Users\Andrea\Desktop
Loaded Profiles: Andrea (Available profiles: Andrea)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\wlanext.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpHostW.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
() C:\Program Files\Hp\QuickPlay\Kernel\TV\QPCapSvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Conexant Systems, Inc.) C:\WINDOWS\System32\drivers\XAudio.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
() C:\Program Files\Hp\QuickPlay\Kernel\TV\QPSched.exe
(DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpAgent.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
() C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Macrovision Corporation) C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Dropbox, Inc.) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMUPDT.EXE
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMSWCS.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\WINDOWS\System32\wuauclt.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [QlbCtrl] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [202032 2007-09-19] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OnScreenDisplay] => C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [554320 2007-09-04] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [DpAgent] => C:\Program Files\DigitalPersona\Bin\dpagent.exe [671744 2007-09-20] (DigitalPersona, Inc.)
HKLM\...\Run: [hpWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [480560 2007-09-13] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [WAWifiMessage] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [311296 2007-01-08] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [APSDaemon] => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1316136 2008-06-20] (Synaptics, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1282120 2013-05-02] (CANON INC.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-04-28] (Avast Software s.r.o.)
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Run: [ISUSPM] => C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe [222128 2007-03-29] (Macrovision Corporation)
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {3ee664b1-8988-11de-9584-001e3772bca1} - F:\preinst.exe
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {94d4e4da-7b58-11e1-9a56-001e3772bca1} - F:\AutoRun.exe
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {94d4e509-7b58-11e1-9a56-001e101f2500} - F:\AutoRun.exe
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {94d4e528-7b58-11e1-9a56-001e101f82a0} - F:\AutoRun.exe
HKU\S-1-5-18\...\Run: [FRITZ!protect] => FwebProt.exe
Lsa: [Notification Packages] scecli DPPWDFLT
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Agent.lnk [2012-03-31]
ShortcutTarget: Update Agent.lnk -> C:\Program Files\Connect it\AutoUpdateSrv.exe (No File)
Startup: C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-03-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-04-28] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:64494;https=127.0.0.1:64494
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
SearchScopes: HKLM -> {160DB79B-FE46-41D8-A2F7-3C3A5A247AAE} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {160DB79B-FE46-41D8-A2F7-3C3A5A247AAE} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {E89E1943-40BA-494D-A8CA-79C11FEFFBD1} URL = 
SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: No Name -> {7E853D72-626A-48EC-A868-BA8D5E23E045} ->  No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-28] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll [2007-01-19] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll [2007-01-19] (Microsoft Corporation)
Winsock: Catalog5 05 C:\Program Files\FRITZ!DSL\\sarah.dll [28472 2009-07-28] (AVM Berlin)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\numosj4g.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-28] ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll [2009-09-25] (DivX,Inc.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll [2009-09-25] (DivX, Inc)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\libdivx.dll [2009-09-25] (The OpenSSL Project, hxxp://www.openssl.org/)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdivx32.dll [2009-09-25] (DivX,Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-09-25] (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ssldivx.dll [2009-09-25] (The OpenSSL Project, hxxp://www.openssl.org/)
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2015-03-21]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2015-02-05]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-09-24]

Chrome: 
=======
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\42.0.2311.90\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\42.0.2311.90\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\42.0.2311.90\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (DivX Web Player) - C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll (DivX,Inc.)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (No Name) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-17]
CHR Extension: (Bookmark Manager) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-28]
CHR Extension: (Avast Online Security) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-10]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-10]
CHR Extension: (No Name) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-04]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-28]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-28] (Avast Software s.r.o.)
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.) [File not signed]
R2 DpHost; C:\Program Files\DigitalPersona\Bin\DpHostW.exe [299008 2007-09-20] (DigitalPersona, Inc.) [File not signed]
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-10-09] (Hewlett-Packard) [File not signed]
R2 hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [135168 2006-05-02] (Hewlett-Packard Development Company, L.P.) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [73528 2009-07-28] (AVM Berlin)
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] ()
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-09-30] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-09-30] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-04-28] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [74976 2015-04-28] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55200 2015-04-28] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-04-28] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787760 2015-04-28] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427992 2015-04-28] (Avast Software s.r.o.)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57888 2015-04-28] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [209048 2015-04-28] ()
R3 ATSWPDRV; C:\Windows\System32\DRIVERS\ATSwpDrv.sys [146560 2007-08-28] (AuthenTec, Inc.)
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [14976 2006-11-07] (AVM GmbH)
S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-10] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [7168 2007-07-11] (Hewlett-Packard Development Company, L.P.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-30] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 cpuz134; \??\C:\Users\Andrea\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 SymIM; system32\DRIVERS\SymIM.sys [X]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-30 17:33 - 2015-04-30 18:05 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-30 17:32 - 2015-04-30 17:32 - 00000859 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-30 17:32 - 2015-04-30 17:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-30 17:32 - 2015-04-30 17:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-04-30 17:32 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-30 17:32 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-30 17:32 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-30 17:28 - 2015-04-30 17:29 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Andrea\Desktop\mbam-setup-2.1.6.1022.exe
2015-04-30 17:14 - 2015-04-30 17:14 - 02224640 _____ () C:\Users\Andrea\Desktop\AdwCleaner_4.202.exe
2015-04-30 00:00 - 2015-04-30 18:16 - 00023668 _____ () C:\Users\Andrea\Desktop\FRST.txt
2015-04-30 00:00 - 2015-04-29 23:31 - 01140736 _____ (Farbar) C:\Users\Andrea\Desktop\FRST.exe
2015-04-29 23:34 - 2015-04-30 06:10 - 00046096 _____ () C:\Users\Andrea\Downloads\Addition.txt
2015-04-29 23:33 - 2015-04-30 06:09 - 00044363 _____ () C:\Users\Andrea\Downloads\FRST.txt
2015-04-29 23:32 - 2015-04-30 18:11 - 00000000 ____D () C:\FRST
2015-04-29 23:31 - 2015-04-29 23:31 - 01140736 _____ (Farbar) C:\Users\Andrea\Downloads\FRST.exe
2015-04-29 23:29 - 2015-04-29 23:29 - 00768512 _____ (Reimage®) C:\Users\Andrea\Downloads\ReimageRepair.exe.part
2015-04-29 17:21 - 2015-04-30 17:00 - 00000000 ____D () C:\Program Files\Avira
2015-04-29 16:51 - 2015-04-29 17:18 - 165283560 _____ () C:\Users\Andrea\Downloads\avira_free_antivirus_de_15.0.9.504.exe
2015-04-29 16:23 - 2015-04-29 16:23 - 00014471 _____ () C:\Windows\AVMInstall.Log
2015-04-29 16:23 - 2009-07-06 03:00 - 00472368 ____N (AVM Berlin) C:\Windows\install.dex
2015-04-29 15:07 - 2015-03-05 04:32 - 00244152 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-29 15:07 - 2015-03-05 04:23 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-29 15:06 - 2015-03-14 04:21 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-29 15:06 - 2015-03-13 03:51 - 03604920 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-04-29 15:06 - 2015-03-13 03:51 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-29 14:46 - 2015-04-29 14:46 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2015-04-29 13:59 - 2015-04-29 13:59 - 04636584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Andrea\Downloads\avira_de_av_5540c77e88c06__ws.exe
2015-04-28 22:20 - 2015-04-28 22:21 - 05049344 _____ (Crawler.com ) C:\Users\Andrea\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2015-04-28 21:46 - 2015-04-28 21:42 - 00291312 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-28 21:42 - 2015-04-28 21:42 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-28 21:13 - 2015-04-30 17:17 - 00000000 ____D () C:\AdwCleaner
2015-04-28 21:12 - 2015-04-28 21:12 - 02224640 _____ () C:\Users\Andrea\Downloads\adwcleaner_4.202.exe
2015-04-28 16:51 - 2015-04-28 16:51 - 00000806 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-04-28 16:46 - 2015-04-28 16:46 - 00001404 _____ () C:\Users\Andrea\Desktop\amazon.de.lnk
2015-04-28 16:46 - 2015-04-28 16:46 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\DesktopIconAmazon
2015-04-28 16:02 - 2015-03-10 01:03 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-28 16:02 - 2015-03-10 00:57 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-28 16:02 - 2015-03-10 00:57 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-28 16:02 - 2015-03-10 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-28 16:02 - 2015-03-10 00:55 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-28 16:02 - 2015-03-10 00:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-04-28 16:02 - 2015-03-10 00:55 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-04-28 16:01 - 2015-03-10 01:06 - 12377600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-28 16:01 - 2015-03-10 01:02 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-28 16:01 - 2015-03-10 01:00 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-28 16:01 - 2015-03-10 00:55 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-28 16:01 - 2015-03-10 00:55 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-28 15:37 - 2015-04-28 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-26 20:52 - 2015-04-26 20:53 - 10673209 _____ () C:\Users\Andrea\Downloads\attachments_20150426205219.zip
2015-04-25 20:52 - 2015-04-26 22:56 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{789A27F0-8701-4C9B-B790-6CA563DE3D6C}
2015-04-25 20:52 - 2015-04-25 20:52 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{B7C6ED03-6E77-4622-9571-246FFA9DF968}
2015-04-25 20:49 - 2015-04-25 20:50 - 12091393 _____ () C:\Users\Andrea\Downloads\attachments_20150425204932.zip
2015-04-20 21:27 - 2015-04-20 21:28 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{2C6E799D-BF3F-4542-A28E-7E9EF54D1FD9}
2015-04-19 19:24 - 2015-04-20 21:54 - 00000000 ____D () C:\HDWLE21_TMP
2015-04-19 18:39 - 2015-04-19 18:39 - 00000000 ____D () C:\Users\Andrea\AppData\Local\Panasonic
2015-04-19 18:39 - 2015-04-19 18:39 - 00000000 ____D () C:\ProgramData\Panasonic
2015-04-19 17:48 - 2015-04-19 17:51 - 00000000 ____D () C:\Program Files\Common Files\Panasonic
2015-04-19 17:48 - 2015-04-19 17:48 - 00000000 ____D () C:\Program Files\Panasonic
2015-04-19 14:18 - 2015-04-19 14:18 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2015-04-19 14:18 - 2015-04-19 14:18 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2015-04-19 11:49 - 2015-04-19 11:50 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{FD71EC4F-02E5-499D-B1CD-E6D2E111442A}
2015-04-19 11:49 - 2015-04-19 11:49 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{990D51BC-6832-4F9C-9BCA-087D5BAB5F17}
2015-04-19 01:44 - 2015-04-19 02:11 - 00000000 ____D () C:\Program Files\Windows Live
2015-04-19 01:32 - 2015-04-19 16:09 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-04-19 01:19 - 2015-04-25 20:53 - 00000000 ____D () C:\Users\Andrea\AppData\Local\Windows Live
2015-04-19 01:19 - 2015-04-19 01:19 - 00000000 ____D () C:\Program Files\Common Files\Windows Live
2015-04-19 00:00 - 2015-04-19 00:00 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\MediaInfo
2015-04-18 23:59 - 2015-04-18 23:59 - 00000000 ____D () C:\Program Files\MediaInfo
2015-04-18 23:55 - 2015-04-18 23:55 - 01203488 _____ () C:\Users\Andrea\Downloads\MediaInfo - CHIP-Installer.exe.part
2015-04-04 15:09 - 2015-04-28 14:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox(709)
2015-04-02 13:44 - 2015-04-02 13:44 - 03520935 _____ () C:\Users\Andrea\Downloads\video-1427974124.avi.mp4

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-30 18:15 - 2012-02-03 19:07 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-30 18:13 - 2012-10-02 15:52 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-30 18:11 - 2007-12-19 05:07 - 01670549 _____ () C:\Windows\WindowsUpdate.log
2015-04-30 18:08 - 2014-06-23 15:33 - 00000000 ___RD () C:\Users\Andrea\Dropbox
2015-04-30 18:08 - 2010-03-19 23:33 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Dropbox
2015-04-30 18:04 - 2013-06-19 22:18 - 00049326 _____ () C:\ProgramData\nvModes.001
2015-04-30 18:04 - 2012-02-03 19:07 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-30 18:02 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-30 18:02 - 2006-11-02 14:47 - 00004736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-30 18:02 - 2006-11-02 14:47 - 00004736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-30 18:01 - 2013-01-07 19:11 - 00810754 _____ () C:\Windows\PFRO.log
2015-04-30 18:01 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2015-04-30 18:00 - 2007-12-19 05:07 - 00002084 _____ () C:\Windows\bthservsdp.dat
2015-04-30 18:00 - 2006-11-02 15:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-30 17:32 - 2012-11-13 23:22 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-30 17:06 - 2009-08-15 13:09 - 00104512 _____ () C:\Users\Andrea\AppData\Local\GDIPFONTCACHEV1.DAT
2015-04-30 17:00 - 2009-08-16 19:52 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy
2015-04-30 17:00 - 2009-08-16 19:46 - 00000000 ____D () C:\ProgramData\Avira
2015-04-30 17:00 - 2006-11-02 14:47 - 00387224 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-30 16:55 - 2009-08-16 19:52 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-04-30 16:51 - 2013-06-19 22:18 - 00049326 _____ () C:\ProgramData\nvModes.dat
2015-04-30 14:37 - 2007-10-24 09:25 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-30 14:26 - 2006-11-02 12:23 - 00000219 _____ () C:\Windows\win.ini
2015-04-29 19:36 - 2012-02-27 18:22 - 00001923 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-29 16:50 - 2009-08-15 12:56 - 00000000 ____D () C:\Users\Andrea
2015-04-29 16:39 - 2009-10-04 17:28 - 00000000 ___RD () C:\Program Files\Skype
2015-04-29 16:39 - 2009-10-04 17:28 - 00000000 ____D () C:\ProgramData\Skype
2015-04-29 16:32 - 2014-10-08 22:50 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2015-04-29 16:23 - 2010-02-14 21:36 - 00000000 ____D () C:\ProgramData\Apple
2015-04-29 16:23 - 2010-01-30 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Box
2015-04-29 16:23 - 2010-01-30 13:33 - 00000000 ____D () C:\Program Files\FRITZ!Box Monitor
2015-04-29 16:21 - 2010-06-16 13:12 - 00000052 _____ () C:\Windows\system32\DOErrors.log
2015-04-29 15:09 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-04-29 15:03 - 2006-11-02 12:33 - 01572494 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-29 14:42 - 2007-10-24 09:13 - 00001018 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk
2015-04-29 14:42 - 2007-10-24 09:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works
2015-04-29 14:42 - 2007-10-24 09:12 - 00000000 ____D () C:\Program Files\Microsoft Works
2015-04-28 21:46 - 2014-05-14 19:21 - 00024144 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-28 21:46 - 2013-06-08 22:02 - 00209048 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-28 21:46 - 2013-06-08 22:02 - 00049904 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-28 21:46 - 2011-09-24 18:31 - 00427992 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-28 21:46 - 2011-09-24 18:31 - 00057888 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswTdi.sys
2015-04-28 21:46 - 2011-09-24 18:31 - 00055200 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr.sys
2015-04-28 21:46 - 2011-09-24 18:30 - 00074976 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-28 21:41 - 2011-09-24 18:31 - 00787760 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-28 21:21 - 2012-05-07 18:19 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-28 21:18 - 2012-02-27 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-04-28 21:18 - 2010-03-24 20:20 - 00000000 ____D () C:\ProgramData\ICQ
2015-04-28 21:18 - 2009-08-15 13:09 - 00000937 _____ () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-28 16:51 - 2015-03-21 22:09 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-28 16:51 - 2011-09-20 09:54 - 00000818 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-04-28 16:51 - 2009-08-16 19:18 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Mozilla
2015-04-28 16:29 - 2012-10-02 15:52 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-28 16:29 - 2011-06-22 20:05 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-28 16:25 - 2014-06-23 15:33 - 00000922 _____ () C:\Users\Andrea\Desktop\Dropbox.lnk
2015-04-28 16:25 - 2010-03-19 23:33 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-28 15:37 - 2014-12-02 23:45 - 00001831 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-28 15:26 - 2007-10-24 09:37 - 00000000 ____D () C:\Program Files\MSN Messenger
2015-04-28 15:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2015-04-28 15:25 - 2014-03-25 19:42 - 62128128 _____ () C:\Windows\system32\config\software_previous
2015-04-28 15:25 - 2014-03-25 19:42 - 38010880 _____ () C:\Windows\system32\config\system_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 51118080 _____ () C:\Windows\system32\config\components_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2015-04-28 15:17 - 2009-10-20 20:37 - 00000000 ____D () C:\Program Files\Common Files\PX Storage Engine
2015-04-28 15:17 - 2009-08-15 13:09 - 00000000 ____D () C:\Users\Andrea\AppData\Local\QuickPlay
2015-04-28 15:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2015-04-28 15:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2015-04-26 22:05 - 2014-02-10 19:06 - 00000000 ____D () C:\Users\Andrea\Fellfreunde
2015-04-19 17:48 - 2007-10-24 08:00 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2015-04-19 15:41 - 2013-08-15 14:15 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-19 01:53 - 2013-09-04 22:21 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition
2015-04-19 01:44 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-04-19 01:29 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-04-18 20:17 - 2013-02-11 19:48 - 00006004 _____ () C:\Windows\setupact.log
2015-04-13 20:28 - 2014-01-17 21:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2015-04-10 13:48 - 2010-03-19 23:33 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Dropbox

==================== Files in the root of some directories =======

2009-08-15 13:36 - 2013-06-19 13:02 - 0048438 _____ () C:\Users\Andrea\AppData\Roaming\nvModes.001
2009-08-15 13:32 - 2013-05-28 21:49 - 0048438 _____ () C:\Users\Andrea\AppData\Roaming\nvModes.dat
2009-08-15 13:24 - 2015-03-26 23:15 - 0008658 _____ () C:\Users\Andrea\AppData\Roaming\wklnhst.dat
2009-08-15 13:09 - 2009-08-15 13:09 - 0000000 _____ () C:\Users\Andrea\AppData\Local\AtStart.txt
2009-09-13 13:51 - 2014-08-28 19:04 - 0000680 _____ () C:\Users\Andrea\AppData\Local\d3d9caps.dat
2009-08-15 13:37 - 2014-07-28 13:19 - 0025088 _____ () C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-08-15 13:09 - 2009-08-15 13:09 - 0000000 _____ () C:\Users\Andrea\AppData\Local\DSwitch.txt
2010-01-29 20:35 - 2010-01-29 20:35 - 0000000 _____ () C:\Users\Andrea\AppData\Local\FnF4.txt
2012-04-02 19:21 - 2012-04-02 19:21 - 0000094 _____ () C:\Users\Andrea\AppData\Local\fusioncache.dat
2015-01-18 23:49 - 2015-01-18 23:49 - 0004096 ____H () C:\Users\Andrea\AppData\Local\keyfile3.drm
2009-08-15 13:09 - 2009-08-15 13:09 - 0000000 _____ () C:\Users\Andrea\AppData\Local\QSwitch.txt
2009-10-04 17:34 - 2009-10-04 17:34 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2013-06-19 22:18 - 2015-04-30 18:04 - 0049326 _____ () C:\ProgramData\nvModes.001
2013-06-19 22:18 - 2015-04-30 16:51 - 0049326 _____ () C:\ProgramData\nvModes.dat

Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\avgnt.exe
C:\Users\Andrea\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpnpj1kn.dll
C:\Users\Andrea\AppData\Local\Temp\Quarantine.exe
C:\Users\Andrea\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-30 18:08

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 29-04-2015 01
Ran by Andrea at 2015-04-30 18:17:15
Running from C:\Users\Andrea\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3332240539-3529680259-2340434327-500 - Administrator - Disabled)
Andrea (S-1-5-21-3332240539-3529680259-2340434327-1000 - Administrator - Enabled) => C:\Users\Andrea
ASPNET (S-1-5-21-3332240539-3529680259-2340434327-1002 - Limited - Enabled)
Gast (S-1-5-21-3332240539-3529680259-2340434327-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
ActiveCheck component for HP Active Support Library (Version: 3.0.0.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
AuthenTec Fingerprint Sensor Minimum Install (HKLM\...\{7F362F06-A9A3-440F-8B19-6A01A72723C4}) (Version: 7.9 - AuthenTec)
AutoUpdate (HKLM\...\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )
Avast Free Antivirus (HKLM\...\avast) (Version: 10.2.2218 - AVAST Software)
AVM FRITZ!DSL (HKLM\...\{74A929E2-FBD8-4736-A84E-2ABBB2ABADF2}) (Version: 2.04.03 - AVM Berlin)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11b Network Adapter) (Version: 4.150.22.0 - Broadcom Corporation)
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: 1.4.0.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - Canon Inc.)
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.)
Canon MG6400 series Benutzerregistrierung (HKLM\...\Canon MG6400 series Benutzerregistrierung) (Version:  - *Canon Inc.)
Canon MG6400 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6400_series) (Version: 1.01 - Canon Inc.)
Canon MG6400 series On-screen Manual (HKLM\...\Canon MG6400 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon My Image Garden (HKLM\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.2.1 - Canon Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.36.7.60 - Conexant)
Connect it (HKLM\...\{A899DA1F-D626-401C-8651-F2921E3B4CB3}) (Version: 2.0.0 - Connect it)
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1002 - CyberLink Corp.)
DigitalPersona Personal 3.0.0 (HKLM\...\{C7AF7F33-9092-997E-2D29-DE8095863FE3}) (Version: 3.0.0 - DigitalPersona, Inc.)
DivX Codec (HKLM\...\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.9.1 - DivX, Inc.)
DivX Player (HKLM\...\{8ADFC4160D694100B5B8A22DE9DCABD9}) (Version: 7.2.0 - DivX, Inc.)
DivX Version Checker (HKLM\...\{3FC7CBBC4C1E11DCA1A752EA55D89593}) (Version: 7.1.0.9 - DivX, Inc.)
DivX Web Player (HKLM\...\{B7050CBDB2504B34BC2A9CA0A692CC29}) (Version: 1.5.0 - DivX,Inc.)
Dropbox (HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Dropbox) (Version: 3.4.4 - Dropbox, Inc.)
DVD Suite (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.5.0928 - CyberLink Corp.)
ESU for Microsoft Vista (HKLM\...\{9BA6E8AF-2122-4825-9B55-98BC351E3C94}) (Version: 2.0.10.1 - Hewlett-Packard)
GameXN GO (HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Game Organizer) (Version:  - EasyBits Media)
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.135 - Google Inc.)
Google Drive (HKLM\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Hauppauge MCE XP/Vista Software Encoder (2.0.25149) (HKLM\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.25149 - Hauppauge Computer Works, Inc.)
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDA_HSF) (Version:  - )
HP Active Support Library (HKLM\...\{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}) (Version: 3.1.9.1 - Hewlett-Packard)
HP Customer Experience Enhancements (HKLM\...\{BD0E2B92-3814-46F0-893B-4612EA010C7E}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.02.0001 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM\...\{9885A11E-60E4-417C-B58B-8B31B21C0B8A}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Help and Support (HKLM\...\{31216452-5540-4C96-B754-94890A63D5AB}) (Version: 2.0.10.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.5500 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.5500 - HP)
HP Quick Launch Buttons 6.30 E1 (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.30 E1 - Hewlett-Packard)
HP QuickPlay 3.6 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - )
HP QuickTouch 1.00 C4 (HKLM\...\{7DC4A410-9986-4329-9E5D-687B2C42CA39}) (Version: 1.0.7 - Hewlett-Packard)
HP Total Care Advisor (HKLM\...\{b02df929-29a7-4fd2-9a70-81a644b635f7}) (Version: 1.4.19.2433 - Hewlett-Packard)
HP Update (HKLM\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)
HP User Guides 0087 (HKLM\...\{4D49757C-367A-4333-BDB3-68966162B14E}) (Version: 1.02.0000 - Hewlett-Packard )
HP Wireless Assistant (HKLM\...\{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}) (Version: 3.00 H2 - Hewlett-Packard)
HPAsset component for HP Active Support Library (Version: 3.0.2.2 - Hewlett-Packard) Hidden
HPNetworkAssistant (Version: 1.1.70 - Hewlett-Packard.) Hidden
Huawei modem (HKLM\...\Huawei Modems) (Version:  - )
Java 7 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
LabelPrint (HKLM\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.20.2128 - CyberLink Corp.)
LightScribe System Software  1.10.13.1 (Version: 1.10.13.1 - hxxp://www.lightscribe.com) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version:  - )
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 37.0.2 (x86 de) (HKLM\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)
MSCU for Microsoft Vista (HKLM\...\{3D356AA9-2D0C-4373-A762-B42F1A289233}) (Version: 1.0.1.9 - Hewlett-Packard)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: HPCMPQ1902 - WildTangent)
MyDriveConnect 3.3.0.1502 (HKLM\...\MyDriveConnect) (Version: 3.3.0.1502 - TomTom)
NetWaiting (HKLM\...\{3F92ABBB-6BBF-11D5-B229-002078017FBF}) (Version: 2.5.46 - BVRP Software, Inc)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - NVIDIA Corporation)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Power2Go (HKLM\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.3327 - CyberLink Corp.)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2129 - CyberLink Corp.)
PowerDirector (Version: 6.5.2129 - CyberLink Corp.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version:  - )
QuickPlay SlingPlayer 0.4.4 (HKLM\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.4 - SlingMedia)
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.51.01 - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.18.0 - Synaptics)
TomTom HOME 2.8.3.2499 (HKLM\...\TomTom HOME) (Version: 2.8.3.2499 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
USB2 Storage Adapter V3 (LaCie) (HKLM\...\TPP300) (Version:  - )
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0 - DivX, Inc) Hidden
Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
Windows Live Messenger (HKLM\...\{279DB581-239C-4E13-97F8-0F48E40BE75C}) (Version: 8.1.0178.00 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{4D72E5BC-BC7C-11E0-83CA-10424824019B}\InprocServer32 -> C:\Users\Andrea\AppData\Local\ASKTOO~1\DOWNLO~1\AviraIDW.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FBE88A10-FF53-11E0-AB2A-AE904824019B}\InprocServer32 -> C:\Users\Andrea\AppData\Local\ASKTOO~1\DOWNLO~1\AVIRAI~1.DLL No File

==================== Restore Points  =========================

06-04-2015 19:13:08 avast! antivirus system restore point
07-04-2015 19:57:36 Windows Update
14-04-2015 14:22:35 Windows Update
18-04-2015 19:24:27 Windows Update
19-04-2015 01:20:47 Windows Live Essentials
19-04-2015 01:27:08 Windows Update
19-04-2015 01:34:09 DirectX wurde installiert
19-04-2015 01:36:53 DirectX wurde installiert
19-04-2015 14:01:35 Windows Update
19-04-2015 17:45:18 Installiert HD Writer LE 2.1
20-04-2015 19:15:08 Windows Update
21-04-2015 16:04:52 Windows Update
25-04-2015 17:11:23 Windows Update
27-04-2015 21:31:35 Removed Skype™ 7.0
28-04-2015 13:25:14 Wiederherstellungsvorgang
28-04-2015 13:44:19 avast! antivirus system restore point
28-04-2015 14:02:01 Wiederherstellungsvorgang
28-04-2015 14:47:41 Wiederherstellungsvorgang
28-04-2015 15:29:40 avast! antivirus system restore point
28-04-2015 16:02:48 Windows Update
28-04-2015 21:31:21 avast! antivirus system restore point
29-04-2015 14:01:21 Windows Update
29-04-2015 16:09:22 Removed Apple Software Update
29-04-2015 16:12:22 Removed Apple Mobile Device Support
29-04-2015 16:14:26 Removed Apple Mobile Device Support
29-04-2015 16:17:46 Removed Apple Application Support
29-04-2015 16:24:01 Removed Bonjour
29-04-2015 16:28:08 Removed iTunes
29-04-2015 16:37:41 Removed Skype™ 6.11
29-04-2015 16:41:20 Removed Apple Mobile Device Support
30-04-2015 14:01:12 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {17B5CAE3-7EE5-417C-A6F5-C6E258A8BA36} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {21F57ECB-2A4A-4CC6-988D-F1BC3CDBA005} - System32\Tasks\{0C8C4C93-E4EC-4B11-9D59-BC048BF09AA1} => C:\Program Files\Skype\Phone\Skype.exe
Task: {2E9BDE04-B142-4947-88EA-5D35F066E0C5} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-10-09] (Hewlett-Packard)
Task: {3D3F0152-1F5C-4909-837E-1A6FB16A1D20} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {45F153E7-5113-4937-BB7C-155A15B84B04} - System32\Tasks\avastBCLRestartS-1-5-21-3332240539-3529680259-2340434327-1000 => Firefox.exe 
Task: {832C3622-E2DE-4145-B048-F8F65B7DD17A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-04-28] (Avast Software s.r.o.)
Task: {8B02B7DA-5DB5-467B-9A8E-332BFDC0CF60} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-28] (Adobe Systems Incorporated)
Task: {9871882C-89EB-4818-89A3-4475020940F2} - System32\Tasks\{1F2C92B4-9235-4999-8112-9D31F45967C2} => pcalua.exe -a C:\Users\Andrea\Downloads\AVM_FRITZ_WLAN_Repeater_310_Assistent.exe -d C:\Users\Andrea\Downloads
Task: {C568A7BE-4E8A-4807-A654-71149700A2A3} - System32\Tasks\{13E362E9-92BC-441D-B508-1245A60B8D92} => pcalua.exe -a E:\SETUP.EXE -d E:\
Task: {D884BFFD-48E4-499E-AEDD-6D74F91FDC6A} - System32\Tasks\{19B26A87-4A51-45F6-9E75-5FC82E2CB93D} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=4.1.0.166.217&amp;LastError=12029
Task: {D94FCE49-3034-4AA8-BEDE-661665A7B084} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {EF802554-FE0E-4452-B24E-FEFCBBE098DB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {FA6D8A6A-96A8-4DC7-8CDA-1F495BBC0B66} - System32\Tasks\{E76E00A4-8AD4-4280-838D-551E953F708B} => Firefox.exe hxxp://ui.skype.com/ui/0/4.2.0.169.217/de/abandoninstall?page=tsChrome&amp;installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:offered-installed;madedefault

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-04-06 19:25 - 2015-04-28 21:42 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-04-06 19:25 - 2015-04-28 21:42 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-04-30 14:04 - 2015-04-30 14:04 - 02926592 _____ () C:\Program Files\AVAST Software\Avast\defs\15043000\algo.dll
2011-10-29 18:24 - 2001-10-28 17:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2014-01-17 22:26 - 2013-05-14 11:50 - 00140936 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
2007-12-19 05:26 - 2007-09-30 20:34 - 00271760 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2007-12-19 05:26 - 2007-09-30 20:34 - 00255384 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2007-12-19 05:26 - 2007-09-30 20:34 - 00038184 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2007-10-24 09:35 - 2007-01-09 12:25 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2007-12-19 05:26 - 2007-09-30 20:34 - 00112016 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-02-11 01:46 - 2015-04-28 21:45 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2007-05-16 10:43 - 2007-05-16 11:12 - 00671744 _____ () C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
2015-04-30 18:07 - 2015-04-30 18:07 - 00043008 _____ () c:\users\andrea\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpnpj1kn.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2007-12-19 05:25 - 2007-09-30 20:33 - 00066856 _____ () C:\Program Files\HP\QuickPlay\Kernel\Common\MCEMediaStatus.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Andrea\Pictures\Urlaub Rovinj 2011\Urlaub 2011 085.JPG
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [{5C1BDBCD-A111-4618-90CA-9FDBEE4144C6}] => (Allow) C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
FirewallRules: [{65076D90-E8CF-45CC-A013-A167D76022E4}] => (Allow) C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
FirewallRules: [{D81DCF4F-D3B7-40C9-8186-03D27A64E629}] => (Allow) C:\Program Files\Cyberlink\PowerDirector\PDR.EXE
FirewallRules: [{82BD6292-3753-4C8C-B85B-84D9D47E3E86}] => (Allow) C:\Program Files\MSN Messenger\msnmsgr.exe
FirewallRules: [{B2EEA14D-A39B-4479-80AB-C7DDFA9B2183}] => (Allow) svchost.exe
FirewallRules: [{0FFD5ABE-9BB4-4873-8EA3-DE25FAA90BED}] => (Allow) C:\Program Files\MSN Messenger\livecall.exe
FirewallRules: [{4DC5BA04-053E-4A08-AB47-8E122A9043B6}] => (Allow) C:\Program Files\HP\QuickPlay\QP.exe
FirewallRules: [{76E9269D-0855-4B9C-BFAB-3BE39CE21CB1}] => (Allow) C:\Program Files\HP\QuickPlay\QPService.exe
FirewallRules: [TCP Query User{B3B3425B-D786-432A-A00D-2DDB9A399E1E}C:\program files\edonkey2000\edonkey2000.exe] => (Allow) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [UDP Query User{DBCC6D91-8EDB-41B6-B6C3-5C238428A24A}C:\program files\edonkey2000\edonkey2000.exe] => (Allow) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [TCP Query User{61A8A174-591E-4696-8C2E-A82BD2F425A1}C:\program files\edonkey2000\edonkey2000.exe] => (Block) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [UDP Query User{75858838-E10D-4F5D-9A3E-66FDC520E069}C:\program files\edonkey2000\edonkey2000.exe] => (Block) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [TCP Query User{3B7B0DEE-398B-495E-8435-2083C9DC49CC}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Block) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [UDP Query User{F9271F30-2DAB-4257-9EC0-1CE7D81C4BA5}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Block) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [TCP Query User{8B9BEF2A-9C08-41C6-8B08-EFBA960895C3}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Allow) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [UDP Query User{64902BD5-31D9-4DDC-8462-44869462ADBD}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Allow) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [{84C4E59D-3739-401A-A19D-6AA42338B993}] => (Allow) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
FirewallRules: [{916B2A70-48C5-4DCD-91EB-88FB08704C29}] => (Allow) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
FirewallRules: [{F65EDFA6-D7C2-4740-86B0-2033FDA86D54}] => (Allow) C:\Program Files\FRITZ!DSL\FBOXUPD.EXE
FirewallRules: [{216B4696-2533-4291-BD51-5277A36511D0}] => (Allow) C:\Program Files\FRITZ!DSL\FBOXUPD.EXE
FirewallRules: [{B51500E1-2050-47E7-832F-D94BDF799AFA}] => (Allow) C:\Program Files\FRITZ!DSL\WebwaIgd.exe
FirewallRules: [{1E88B0AA-D582-4029-AAEA-035834B416E7}] => (Allow) C:\Program Files\FRITZ!DSL\WebwaIgd.exe
FirewallRules: [TCP Query User{F988F6AB-1E13-4093-BC77-A628CB95CA6E}C:\program files\icq7.1\icq.exe] => (Block) C:\program files\icq7.1\icq.exe
FirewallRules: [UDP Query User{9A8C274D-51C8-4FDE-A41A-394DF88FCACE}C:\program files\icq7.1\icq.exe] => (Block) C:\program files\icq7.1\icq.exe
FirewallRules: [TCP Query User{17109E81-B135-4423-BBA9-E421C9213A76}C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{5CCE0580-0F32-4D93-A9C0-83191F068C8E}C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{167A77B1-4149-483B-9191-145FEC505B15}] => (Allow) LPort=80
FirewallRules: [{0EA5834B-3416-4599-AC6B-6908186FEFD1}] => (Allow) LPort=80
FirewallRules: [{3144AF78-0C59-4632-A078-3BA477D4D1CD}] => (Allow) LPort=80
FirewallRules: [{E298C50A-615A-49C3-8ADB-A741F6754031}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7B3FAB8C-F417-4D16-B9BA-947134AB665E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5B74490C-05C6-473A-BC2B-9656CEC8DE15}] => (Allow) c:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{48E3E3BE-3622-4DB6-A947-3889AE7F2B71}] => (Allow) C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
FirewallRules: [{0A608187-EDBF-4547-9A61-27E7D10D218A}] => (Allow) C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
FirewallRules: [{108289A7-49F9-49E1-8E9E-6CB5576E77FC}] => (Allow) C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE
FirewallRules: [{255532AF-6A82-44D9-BD05-E81DADB500F0}] => (Allow) C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE
FirewallRules: [{E1D410D1-7358-42EE-9637-233EDDC8820C}] => (Allow) C:\Program Files\Microsoft Office\Office14\outlook.exe
FirewallRules: [{F167A822-03B9-40C7-B2B3-39666187F437}] => (Allow) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{FB951898-99A2-4695-A510-8F5AF0CA3032}] => (Allow) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E7F5C095-01D3-49E1-86E0-E63EA93AE97C}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{9952E0C0-C9CE-4289-8274-F49C71E9B095}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [UDP Query User{A749F86E-E8B3-41F0-B31B-7DC009D9FF0C}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [TCP Query User{EA53E467-80D5-4AC0-B4E0-6E7FD2DA3C6C}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [UDP Query User{138C08C7-48B7-49C6-9B6D-48AEE7E17829}C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe] => (Allow) C:\users\andrea\appdata\local\temp\fritz!wlanrepeater310\fsetup.exe
FirewallRules: [TCP Query User{FF8C8A29-B041-49B4-B930-12ECD0C6DED1}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{7C50586A-34A0-4DA0-9A5E-47EDD94D82CF}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{E2365A75-2608-4331-9D70-B803EF108BF6}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{DB9B5E51-0323-4992-AF48-24C19573535F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{D19B97D5-0437-4CC4-8C20-336A40098492}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Microsoft-ISATAP-Adapter #3
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================
Error: (04/30/2015 05:25:51 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\ANDREA\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\NUMOSJ4G.DEFAULT\SAFEBROWSING-BACKUP> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/30/2015 06:31:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung QPSched.exe, Version 5.0.0.3327, Zeitstempel 0x46fbc733, fehlerhaftes Modul QPSched.exe, Version 5.0.0.3327, Zeitstempel 0x46fbc733, Ausnahmecode 0xc0000005, Fehleroffset 0x000075bd,
Prozess-ID 0xb88, Anwendungsstartzeit QPSched.exe0.

Error: (04/30/2015 00:40:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung QPSched.exe, Version 5.0.0.3327, Zeitstempel 0x46fbc733, fehlerhaftes Modul QPSched.exe, Version 5.0.0.3327, Zeitstempel 0x46fbc733, Ausnahmecode 0xc0000005, Fehleroffset 0x000075bd,
Prozess-ID 0xb5c, Anwendungsstartzeit QPSched.exe0.

Error: (04/29/2015 06:05:50 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA IM INTERNET.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:50 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA IM INTERNET.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:49 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS HILFE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:49 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS HILFE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:48 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS STARTEN.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 06:05:48 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS STARTEN.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/29/2015 04:23:09 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Andrea-PC)
Description: 0AppleMobileDeviceService.exeApple Mobile Device03026217818800


System errors:
=============
Error: (04/30/2015 06:08:16 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Windows Update

Error: (04/30/2015 06:03:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (04/30/2015 06:03:55 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: ComputerbrowserServer%%1058

Error: (04/30/2015 05:46:43 PM) (Source: disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error: (04/30/2015 05:46:39 PM) (Source: disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error: (04/30/2015 05:46:35 PM) (Source: disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error: (04/30/2015 05:46:31 PM) (Source: disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error: (04/30/2015 05:46:27 PM) (Source: disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error: (04/30/2015 05:46:23 PM) (Source: disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error: (04/30/2015 05:22:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Media Player-Netzwerkfreigabedienst%%1053


Microsoft Office Sessions:
=========================
Error: (04/30/2015 05:25:51 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\USERS\ANDREA\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\NUMOSJ4G.DEFAULT\SAFEBROWSING-BACKUP

Error: (04/30/2015 06:31:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: QPSched.exe5.0.0.332746fbc733QPSched.exe5.0.0.332746fbc733c0000005000075bdb8801d082fc13a5a119

Error: (04/30/2015 00:40:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: QPSched.exe5.0.0.332746fbc733QPSched.exe5.0.0.332746fbc733c0000005000075bdb5c01d08292fbf56c7e

Error: (04/29/2015 06:05:50 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA IM INTERNET.LNK

Error: (04/29/2015 06:05:50 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA IM INTERNET.LNK

Error: (04/29/2015 06:05:49 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS HILFE.LNK

Error: (04/29/2015 06:05:49 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS HILFE.LNK

Error: (04/29/2015 06:05:48 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS STARTEN.LNK

Error: (04/29/2015 06:05:48 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AVIRA\ANTIVIRUS\AVIRA ANTIVIRUS STARTEN.LNK

Error: (04/29/2015 04:23:09 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Andrea-PC)
Description: 0AppleMobileDeviceService.exeApple Mobile Device03026217818800


CodeIntegrity Errors:
===================================
  Date: 2015-04-30 18:16:52.652
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-30 18:16:51.747
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-30 18:16:50.852
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-30 18:16:49.912
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-30 18:16:48.698
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-30 18:16:47.759
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-30 18:16:46.875
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-30 18:16:45.947
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-30 18:13:18.820
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-30 18:13:17.838
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: AMD Turion(tm) 64 X2 Mobile Technology TL-60
Percentage of memory in use: 67%
Total physical RAM: 2046.23 MB
Available physical RAM: 663.84 MB
Total Pagefile: 4332.95 MB
Available Pagefile: 2512.37 MB
Total Virtual: 2047.88 MB
Available Virtual: 1908.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:221.04 GB) (Free:78.14 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (HP_RECOVERY) (Fixed) (Total:11.84 GB) (Free:2.14 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: 415D13E6)
Partition 1: (Active) - (Size=221 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=11.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Uff, geschafft. :-) Ich hoffe, es ist alle ok.

deeprybka · 30.04.2015, 18:33

Sehr schön!

Passend zum langen Wochenende habe ich einen schönen Scan für Dich...

Schritt 1

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Djangolino · 30.04.2015, 22:19

Hast nicht zu viel versprochen

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=36e96f72f506fa4d9a9bf462b7029d0a
# engine=23639
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-30 08:46:24
# local_time=2015-04-30 10:46:24 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='avast! Internet Security'
# compatibility_mode=779 16777213 85 72 173169 194847274 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 177935 267959512 0 0
# scanned=257249
# found=16
# cleaned=0
# scan_time=9749
sh=C0B7F8C09DB0ADA3DF2102A3D08FAC9781A15DC6 ft=1 fh=55bf436402755b8c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\XTab\BrowerWatchCH.dll.vir"
sh=52F9085A177DC911DC513ED9FA431A58126F73CF ft=1 fh=08f0a6962a427f0c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\XTab\BrowerWatchFF.dll.vir"
sh=FBDFC5A9C45940E1EE1DB6ADFCE2B1BD5DD301F3 ft=1 fh=c71c0011210d5c57 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\XTab\BrowserAction.dll.vir"
sh=EAE26C38934A5DFC7EB58B885FCC83DA388D5AE1 ft=1 fh=bf40033c211bd84f vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\XTab\HPNotify.exe.vir"
sh=D4A43936353E001F542FB287278ED350644F1917 ft=1 fh=cf34ce2fc97c23ab vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\XTab\IeWatchDog.dll.vir"
sh=4CF9EF4D739C2F8A1F3909A2720274527EC29E1F ft=1 fh=c71c001143f2d9bd vn="Variante von Win32/ELEX.CP evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Andrea\AppData\Roaming\webssearches\UninstallManager.exe.vir"
sh=3D09B4A1E2E55E7D1DF62B739D434F3F4E51DB90 ft=1 fh=31688d33c108b3f2 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe"
sh=CB5FCE31A767FCDE8104DAC3CA3DD3D2A3B74636 ft=1 fh=abef3335aa53c4f3 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQFSUGPG\Firefox - CHIP-Installer.exe"
sh=0E34C1DA00DE9B9F739D993EA73DB430C95636FE ft=1 fh=cba41fd3ee67bab6 vn="Variante von Win32/ReImageRepair.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PCJW2GQ1\ReimagePackage1804[1].exe"
sh=5133703A8D7C64960D8538869DED2262E8E53B15 ft=0 fh=0000000000000000 vn="Variante von Win32/ELEX.BF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\THUAB1QV\1[1].zip"
sh=F42434EB673DF4B135D8D509943965FE20F75B22 ft=1 fh=84267000d91c779b vn="Win32/ReImageRepair.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\THUAB1QV\ReimageRepair.exe"
sh=45E7449F1A82158B429BE44611AE49BCEFDAB6E1 ft=1 fh=dffb77abfb1a8bfc vn="Win32/ReImageRepair.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Andrea\AppData\Local\Temp\MpT4Lmzq.exe.part"
sh=60F339A693470B3ACC6AC1982DB8AFF6E16C9123 ft=1 fh=d84e8dd2a3f0b029 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Andrea\Downloads\MediaInfo - CHIP-Installer.exe.part"
sh=0EA7D8544216888CF492D123B68F61D8BBD6C629 ft=1 fh=6a40c22b53cdcabe vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Andrea\Downloads\PDF24 Creator - CHIP-Installer.exe"
sh=45E7449F1A82158B429BE44611AE49BCEFDAB6E1 ft=1 fh=dffb77abfb1a8bfc vn="Win32/ReImageRepair.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Andrea\Downloads\ReimageRepair.exe.part"
sh=437E3A113240ED6256DC81A78FC4D199F991A84D ft=1 fh=f32deb8741ca6994 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Andrea\Downloads\Winmail Opener - CHIP-Installer.exe"

deeprybka · 01.05.2015, 14:29

Hi,

Schritt 1

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:

Code:

ATTFilter

CloseProcesses:
C:\Users\Andrea\Downloads\MediaInfo - CHIP-Installer.exe.part
C:\Users\Andrea\Downloads\PDF24 Creator - CHIP-Installer.exe
C:\Users\Andrea\Downloads\ReimageRepair.exe.part
C:\Users\Andrea\Downloads\Winmail Opener - CHIP-Installer.exe
EmptyTemp:
RemoveProxy:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
SearchScopes: HKLM -> {160DB79B-FE46-41D8-A2F7-3C3A5A247AAE} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {E89E1943-40BA-494D-A8CA-79C11FEFFBD1} URL = 
SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: No Name -> {7E853D72-626A-48EC-A868-BA8D5E23E045} ->  No File
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.

Starte FRST und drücke auf den Fix-Button.
Das Tool erstellt eine "Fixlog.txt" -Datei.
Poste mir bitte deren Inhalt.

Nach dem Reboot:

Schritt 2

Bitte starte FRST erneut, und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

Djangolino · 01.05.2015, 18:08

Ohje, hörte sich kompliziert an, aber ich hoffe, es hat alles richtig geklappt......

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 29-04-2015 01
Ran by Andrea at 2015-05-01 18:05:01 Run:1
Running from C:\Users\Andrea\Desktop
Loaded Profiles: Andrea (Available profiles: Andrea)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
CloseProcesses:
C:\Users\Andrea\Downloads\MediaInfo - CHIP-Installer.exe.part
C:\Users\Andrea\Downloads\PDF24 Creator - CHIP-Installer.exe
C:\Users\Andrea\Downloads\ReimageRepair.exe.part
C:\Users\Andrea\Downloads\Winmail Opener - CHIP-Installer.exe
EmptyTemp:
RemoveProxy:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
SearchScopes: HKLM -> {160DB79B-FE46-41D8-A2F7-3C3A5A247AAE} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {E89E1943-40BA-494D-A8CA-79C11FEFFBD1} URL = 
SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: No Name -> {7E853D72-626A-48EC-A868-BA8D5E23E045} ->  No File
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 29-04-2015 01
Ran by Andrea (administrator) on ANDREA-PC on 01-05-2015 18:54:52
Running from C:\Users\Andrea\Desktop
Loaded Profiles: Andrea (Available profiles: Andrea)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\wlanext.exe
(DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpHostW.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
() C:\Program Files\Hp\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Conexant Systems, Inc.) C:\WINDOWS\System32\drivers\XAudio.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
() C:\Program Files\Hp\QuickPlay\Kernel\TV\QPSched.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpAgent.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\WINDOWS\System32\conime.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
(Macrovision Corporation) C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Dropbox, Inc.) C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMUPDT.EXE
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMSWCS.EXE
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [QlbCtrl] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [202032 2007-09-19] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OnScreenDisplay] => C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [554320 2007-09-04] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [DpAgent] => C:\Program Files\DigitalPersona\Bin\dpagent.exe [671744 2007-09-20] (DigitalPersona, Inc.)
HKLM\...\Run: [hpWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [480560 2007-09-13] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [WAWifiMessage] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [311296 2007-01-08] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [APSDaemon] => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1316136 2008-06-20] (Synaptics, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1282120 2013-05-02] (CANON INC.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-04-28] (Avast Software s.r.o.)
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Run: [ISUSPM] => C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe [222128 2007-03-29] (Macrovision Corporation)
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {3ee664b1-8988-11de-9584-001e3772bca1} - F:\preinst.exe
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {94d4e4da-7b58-11e1-9a56-001e3772bca1} - F:\AutoRun.exe
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {94d4e509-7b58-11e1-9a56-001e101f2500} - F:\AutoRun.exe
HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\MountPoints2: {94d4e528-7b58-11e1-9a56-001e101f82a0} - F:\AutoRun.exe
HKU\S-1-5-18\...\Run: [FRITZ!protect] => FwebProt.exe
Lsa: [Notification Packages] scecli DPPWDFLT
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Agent.lnk [2012-03-31]
ShortcutTarget: Update Agent.lnk -> C:\Program Files\Connect it\AutoUpdateSrv.exe (No File)
Startup: C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-03-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-04-28] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-02-19] (Google)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000 -> {160DB79B-FE46-41D8-A2F7-3C3A5A247AAE} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-28] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll [2007-01-19] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll [2007-01-19] (Microsoft Corporation)
Winsock: Catalog5 05 C:\Program Files\FRITZ!DSL\\sarah.dll [28472 2009-07-28] (AVM Berlin)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\numosj4g.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-28] ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll [2009-09-25] (DivX,Inc.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll [2009-09-25] (DivX, Inc)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\libdivx.dll [2009-09-25] (The OpenSSL Project, hxxp://www.openssl.org/)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdivx32.dll [2009-09-25] (DivX,Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-09-25] (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2014-04-02] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ssldivx.dll [2009-09-25] (The OpenSSL Project, hxxp://www.openssl.org/)
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2015-03-21]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2015-02-05]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-09-24]

Chrome: 
=======
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\42.0.2311.90\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\42.0.2311.90\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\42.0.2311.90\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (DivX Web Player) - C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll (DivX,Inc.)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (No Name) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-17]
CHR Extension: (Bookmark Manager) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-28]
CHR Extension: (Avast Online Security) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-10]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-10]
CHR Extension: (No Name) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-04]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-28]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-28] (Avast Software s.r.o.)
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.) [File not signed]
R2 DpHost; C:\Program Files\DigitalPersona\Bin\DpHostW.exe [299008 2007-09-20] (DigitalPersona, Inc.) [File not signed]
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-10-09] (Hewlett-Packard) [File not signed]
R2 hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [135168 2006-05-02] (Hewlett-Packard Development Company, L.P.) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [73528 2009-07-28] (AVM Berlin)
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] ()
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-09-30] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-09-30] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-04-28] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [74976 2015-04-28] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55200 2015-04-28] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-04-28] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787760 2015-04-28] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427992 2015-04-28] (Avast Software s.r.o.)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57888 2015-04-28] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [209048 2015-04-28] ()
R3 ATSWPDRV; C:\Windows\System32\DRIVERS\ATSwpDrv.sys [146560 2007-08-28] (AuthenTec, Inc.)
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [14976 2006-11-07] (AVM GmbH)
S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-10] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [7168 2007-07-11] (Hewlett-Packard Development Company, L.P.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-05-01] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 cpuz134; \??\C:\Users\Andrea\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 SymIM; system32\DRIVERS\SymIM.sys [X]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-01 17:42 - 2015-03-05 04:24 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-30 18:17 - 2015-04-30 18:22 - 00044588 _____ () C:\Users\Andrea\Desktop\Addition.txt
2015-04-30 17:33 - 2015-05-01 18:46 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-30 17:32 - 2015-04-30 17:32 - 00000859 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-30 17:32 - 2015-04-30 17:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-30 17:32 - 2015-04-30 17:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-04-30 17:32 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-30 17:32 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-30 17:32 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-30 17:28 - 2015-04-30 17:29 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Andrea\Desktop\mbam-setup-2.1.6.1022.exe
2015-04-30 17:14 - 2015-04-30 17:14 - 02224640 _____ () C:\Users\Andrea\Desktop\AdwCleaner_4.202.exe
2015-04-30 00:00 - 2015-05-01 18:55 - 00021677 _____ () C:\Users\Andrea\Desktop\FRST.txt
2015-04-30 00:00 - 2015-04-29 23:31 - 01140736 _____ (Farbar) C:\Users\Andrea\Desktop\FRST.exe
2015-04-29 23:34 - 2015-04-30 06:10 - 00046096 _____ () C:\Users\Andrea\Downloads\Addition.txt
2015-04-29 23:33 - 2015-04-30 06:09 - 00044363 _____ () C:\Users\Andrea\Downloads\FRST.txt
2015-04-29 23:32 - 2015-05-01 18:55 - 00000000 ____D () C:\FRST
2015-04-29 23:31 - 2015-04-29 23:31 - 01140736 _____ (Farbar) C:\Users\Andrea\Downloads\FRST.exe
2015-04-29 17:21 - 2015-04-30 17:00 - 00000000 ____D () C:\Program Files\Avira
2015-04-29 16:51 - 2015-04-29 17:18 - 165283560 _____ () C:\Users\Andrea\Downloads\avira_free_antivirus_de_15.0.9.504.exe
2015-04-29 16:23 - 2015-04-29 16:23 - 00014471 _____ () C:\Windows\AVMInstall.Log
2015-04-29 16:23 - 2009-07-06 03:00 - 00472368 ____N (AVM Berlin) C:\Windows\install.dex
2015-04-29 15:07 - 2015-03-05 04:32 - 00244152 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-29 15:07 - 2015-03-05 04:23 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-29 15:06 - 2015-03-14 04:21 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-29 15:06 - 2015-03-13 03:51 - 03604920 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-04-29 15:06 - 2015-03-13 03:51 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-29 14:46 - 2015-04-29 14:46 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2015-04-29 13:59 - 2015-04-29 13:59 - 04636584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Andrea\Downloads\avira_de_av_5540c77e88c06__ws.exe
2015-04-28 22:20 - 2015-04-28 22:21 - 05049344 _____ (Crawler.com ) C:\Users\Andrea\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2015-04-28 21:46 - 2015-04-28 21:42 - 00291312 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-28 21:42 - 2015-04-28 21:42 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-28 21:13 - 2015-04-30 17:17 - 00000000 ____D () C:\AdwCleaner
2015-04-28 21:12 - 2015-04-28 21:12 - 02224640 _____ () C:\Users\Andrea\Downloads\adwcleaner_4.202.exe
2015-04-28 16:51 - 2015-04-28 16:51 - 00000806 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-04-28 16:46 - 2015-04-28 16:46 - 00001404 _____ () C:\Users\Andrea\Desktop\amazon.de.lnk
2015-04-28 16:46 - 2015-04-28 16:46 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\DesktopIconAmazon
2015-04-28 16:02 - 2015-03-10 01:03 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-28 16:02 - 2015-03-10 00:57 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-28 16:02 - 2015-03-10 00:57 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-28 16:02 - 2015-03-10 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-04-28 16:02 - 2015-03-10 00:56 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-28 16:02 - 2015-03-10 00:55 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-28 16:02 - 2015-03-10 00:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-04-28 16:02 - 2015-03-10 00:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-04-28 16:02 - 2015-03-10 00:55 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-04-28 16:01 - 2015-03-10 01:06 - 12377600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-28 16:01 - 2015-03-10 01:02 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-28 16:01 - 2015-03-10 01:00 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-28 16:01 - 2015-03-10 00:55 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-28 16:01 - 2015-03-10 00:55 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-28 15:37 - 2015-04-28 15:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-26 20:52 - 2015-04-26 20:53 - 10673209 _____ () C:\Users\Andrea\Downloads\attachments_20150426205219.zip
2015-04-25 20:52 - 2015-04-26 22:56 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{789A27F0-8701-4C9B-B790-6CA563DE3D6C}
2015-04-25 20:52 - 2015-04-25 20:52 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{B7C6ED03-6E77-4622-9571-246FFA9DF968}
2015-04-25 20:49 - 2015-04-25 20:50 - 12091393 _____ () C:\Users\Andrea\Downloads\attachments_20150425204932.zip
2015-04-20 21:27 - 2015-04-20 21:28 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{2C6E799D-BF3F-4542-A28E-7E9EF54D1FD9}
2015-04-19 19:24 - 2015-04-20 21:54 - 00000000 ____D () C:\HDWLE21_TMP
2015-04-19 18:39 - 2015-04-19 18:39 - 00000000 ____D () C:\Users\Andrea\AppData\Local\Panasonic
2015-04-19 18:39 - 2015-04-19 18:39 - 00000000 ____D () C:\ProgramData\Panasonic
2015-04-19 17:48 - 2015-04-19 17:51 - 00000000 ____D () C:\Program Files\Common Files\Panasonic
2015-04-19 17:48 - 2015-04-19 17:48 - 00000000 ____D () C:\Program Files\Panasonic
2015-04-19 14:18 - 2015-04-19 14:18 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2015-04-19 14:18 - 2015-04-19 14:18 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2015-04-19 11:49 - 2015-04-19 11:50 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{FD71EC4F-02E5-499D-B1CD-E6D2E111442A}
2015-04-19 11:49 - 2015-04-19 11:49 - 00000000 ____D () C:\Users\Andrea\AppData\Local\{990D51BC-6832-4F9C-9BCA-087D5BAB5F17}
2015-04-19 01:44 - 2015-04-19 02:11 - 00000000 ____D () C:\Program Files\Windows Live
2015-04-19 01:32 - 2015-04-19 16:09 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-04-19 01:19 - 2015-04-25 20:53 - 00000000 ____D () C:\Users\Andrea\AppData\Local\Windows Live
2015-04-19 01:19 - 2015-04-19 01:19 - 00000000 ____D () C:\Program Files\Common Files\Windows Live
2015-04-19 00:00 - 2015-04-19 00:00 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\MediaInfo
2015-04-18 23:59 - 2015-04-18 23:59 - 00000000 ____D () C:\Program Files\MediaInfo
2015-04-04 15:09 - 2015-04-28 14:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox(709)
2015-04-02 13:44 - 2015-04-02 13:44 - 03520935 _____ () C:\Users\Andrea\Downloads\video-1427974124.avi.mp4

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-01 18:50 - 2007-12-19 05:07 - 01749221 _____ () C:\Windows\WindowsUpdate.log
2015-05-01 18:49 - 2014-06-23 15:33 - 00000000 ___RD () C:\Users\Andrea\Dropbox
2015-05-01 18:49 - 2010-03-19 23:33 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Dropbox
2015-05-01 18:45 - 2013-06-19 22:18 - 00049326 _____ () C:\ProgramData\nvModes.001
2015-05-01 18:45 - 2012-02-03 19:07 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-01 18:41 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-01 18:41 - 2006-11-02 14:47 - 00004736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-01 18:41 - 2006-11-02 14:47 - 00004736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-01 18:39 - 2013-01-07 19:11 - 00812856 _____ () C:\Windows\PFRO.log
2015-05-01 18:29 - 2007-12-19 05:07 - 00002084 _____ () C:\Windows\bthservsdp.dat
2015-05-01 18:29 - 2006-11-02 15:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-05-01 18:18 - 2012-02-03 19:07 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-01 18:14 - 2012-10-02 15:52 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-01 18:00 - 2013-08-15 14:15 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-01 17:59 - 2006-11-02 12:24 - 125832184 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-05-01 17:54 - 2007-10-24 09:25 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-01 11:44 - 2013-06-19 22:18 - 00049326 _____ () C:\ProgramData\nvModes.dat
2015-04-30 19:49 - 2006-11-02 12:33 - 01596102 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-30 18:01 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2015-04-30 17:32 - 2012-11-13 23:22 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-30 17:06 - 2009-08-15 13:09 - 00104512 _____ () C:\Users\Andrea\AppData\Local\GDIPFONTCACHEV1.DAT
2015-04-30 17:00 - 2009-08-16 19:52 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy
2015-04-30 17:00 - 2009-08-16 19:46 - 00000000 ____D () C:\ProgramData\Avira
2015-04-30 17:00 - 2006-11-02 14:47 - 00387224 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-30 16:55 - 2009-08-16 19:52 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-04-30 14:26 - 2006-11-02 12:23 - 00000219 _____ () C:\Windows\win.ini
2015-04-29 19:36 - 2012-02-27 18:22 - 00001923 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-29 16:50 - 2009-08-15 12:56 - 00000000 ____D () C:\Users\Andrea
2015-04-29 16:39 - 2009-10-04 17:28 - 00000000 ___RD () C:\Program Files\Skype
2015-04-29 16:39 - 2009-10-04 17:28 - 00000000 ____D () C:\ProgramData\Skype
2015-04-29 16:32 - 2014-10-08 22:50 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2015-04-29 16:23 - 2010-02-14 21:36 - 00000000 ____D () C:\ProgramData\Apple
2015-04-29 16:23 - 2010-01-30 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Box
2015-04-29 16:23 - 2010-01-30 13:33 - 00000000 ____D () C:\Program Files\FRITZ!Box Monitor
2015-04-29 16:21 - 2010-06-16 13:12 - 00000052 _____ () C:\Windows\system32\DOErrors.log
2015-04-29 15:09 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-04-29 14:42 - 2007-10-24 09:13 - 00001018 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk
2015-04-29 14:42 - 2007-10-24 09:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works
2015-04-29 14:42 - 2007-10-24 09:12 - 00000000 ____D () C:\Program Files\Microsoft Works
2015-04-28 21:46 - 2014-05-14 19:21 - 00024144 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-28 21:46 - 2013-06-08 22:02 - 00209048 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-28 21:46 - 2013-06-08 22:02 - 00049904 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-28 21:46 - 2011-09-24 18:31 - 00427992 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-28 21:46 - 2011-09-24 18:31 - 00057888 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswTdi.sys
2015-04-28 21:46 - 2011-09-24 18:31 - 00055200 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr.sys
2015-04-28 21:46 - 2011-09-24 18:30 - 00074976 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-28 21:41 - 2011-09-24 18:31 - 00787760 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-28 21:21 - 2012-05-07 18:19 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-28 21:18 - 2012-02-27 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-04-28 21:18 - 2010-03-24 20:20 - 00000000 ____D () C:\ProgramData\ICQ
2015-04-28 21:18 - 2009-08-15 13:09 - 00000937 _____ () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-28 16:51 - 2015-03-21 22:09 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-28 16:51 - 2011-09-20 09:54 - 00000818 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-04-28 16:51 - 2009-08-16 19:18 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Mozilla
2015-04-28 16:29 - 2012-10-02 15:52 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-28 16:29 - 2011-06-22 20:05 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-28 16:25 - 2014-06-23 15:33 - 00000922 _____ () C:\Users\Andrea\Desktop\Dropbox.lnk
2015-04-28 16:25 - 2010-03-19 23:33 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-28 15:37 - 2014-12-02 23:45 - 00001831 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-28 15:26 - 2007-10-24 09:37 - 00000000 ____D () C:\Program Files\MSN Messenger
2015-04-28 15:26 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2015-04-28 15:25 - 2014-03-25 19:42 - 62128128 _____ () C:\Windows\system32\config\software_previous
2015-04-28 15:25 - 2014-03-25 19:42 - 38010880 _____ () C:\Windows\system32\config\system_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 51118080 _____ () C:\Windows\system32\config\components_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2015-04-28 15:25 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2015-04-28 15:17 - 2009-10-20 20:37 - 00000000 ____D () C:\Program Files\Common Files\PX Storage Engine
2015-04-28 15:17 - 2009-08-15 13:09 - 00000000 ____D () C:\Users\Andrea\AppData\Local\QuickPlay
2015-04-28 15:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2015-04-28 15:17 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2015-04-26 22:05 - 2014-02-10 19:06 - 00000000 ____D () C:\Users\Andrea\Fellfreunde
2015-04-19 17:48 - 2007-10-24 08:00 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2015-04-19 01:53 - 2013-09-04 22:21 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition
2015-04-19 01:44 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-04-19 01:29 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-04-18 20:17 - 2013-02-11 19:48 - 00006004 _____ () C:\Windows\setupact.log
2015-04-13 20:28 - 2014-01-17 21:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2015-04-10 13:48 - 2010-03-19 23:33 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Dropbox

==================== Files in the root of some directories =======

2009-08-15 13:36 - 2013-06-19 13:02 - 0048438 _____ () C:\Users\Andrea\AppData\Roaming\nvModes.001
2009-08-15 13:32 - 2013-05-28 21:49 - 0048438 _____ () C:\Users\Andrea\AppData\Roaming\nvModes.dat
2009-08-15 13:24 - 2015-03-26 23:15 - 0008658 _____ () C:\Users\Andrea\AppData\Roaming\wklnhst.dat
2009-08-15 13:09 - 2009-08-15 13:09 - 0000000 _____ () C:\Users\Andrea\AppData\Local\AtStart.txt
2009-09-13 13:51 - 2014-08-28 19:04 - 0000680 _____ () C:\Users\Andrea\AppData\Local\d3d9caps.dat
2009-08-15 13:37 - 2014-07-28 13:19 - 0025088 _____ () C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-08-15 13:09 - 2009-08-15 13:09 - 0000000 _____ () C:\Users\Andrea\AppData\Local\DSwitch.txt
2010-01-29 20:35 - 2010-01-29 20:35 - 0000000 _____ () C:\Users\Andrea\AppData\Local\FnF4.txt
2012-04-02 19:21 - 2012-04-02 19:21 - 0000094 _____ () C:\Users\Andrea\AppData\Local\fusioncache.dat
2015-01-18 23:49 - 2015-01-18 23:49 - 0004096 ____H () C:\Users\Andrea\AppData\Local\keyfile3.drm
2009-08-15 13:09 - 2009-08-15 13:09 - 0000000 _____ () C:\Users\Andrea\AppData\Local\QSwitch.txt
2009-10-04 17:34 - 2009-10-04 17:34 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2013-06-19 22:18 - 2015-05-01 18:45 - 0049326 _____ () C:\ProgramData\nvModes.001
2013-06-19 22:18 - 2015-05-01 11:44 - 0049326 _____ () C:\ProgramData\nvModes.dat

Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpon3ccw.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-01 18:51

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 29-04-2015 01
Ran by Andrea at 2015-05-01 18:57:26
Running from C:\Users\Andrea\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3332240539-3529680259-2340434327-500 - Administrator - Disabled)
Andrea (S-1-5-21-3332240539-3529680259-2340434327-1000 - Administrator - Enabled) => C:\Users\Andrea
ASPNET (S-1-5-21-3332240539-3529680259-2340434327-1002 - Limited - Enabled)
Gast (S-1-5-21-3332240539-3529680259-2340434327-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
ActiveCheck component for HP Active Support Library (Version: 3.0.0.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
AuthenTec Fingerprint Sensor Minimum Install (HKLM\...\{7F362F06-A9A3-440F-8B19-6A01A72723C4}) (Version: 7.9 - AuthenTec)
AutoUpdate (HKLM\...\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )
Avast Free Antivirus (HKLM\...\avast) (Version: 10.2.2218 - AVAST Software)
AVM FRITZ!DSL (HKLM\...\{74A929E2-FBD8-4736-A84E-2ABBB2ABADF2}) (Version: 2.04.03 - AVM Berlin)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11b Network Adapter) (Version: 4.150.22.0 - Broadcom Corporation)
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: 1.4.0.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - Canon Inc.)
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.)
Canon MG6400 series Benutzerregistrierung (HKLM\...\Canon MG6400 series Benutzerregistrierung) (Version:  - *Canon Inc.)
Canon MG6400 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6400_series) (Version: 1.01 - Canon Inc.)
Canon MG6400 series On-screen Manual (HKLM\...\Canon MG6400 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon My Image Garden (HKLM\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.2.1 - Canon Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.36.7.60 - Conexant)
Connect it (HKLM\...\{A899DA1F-D626-401C-8651-F2921E3B4CB3}) (Version: 2.0.0 - Connect it)
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1002 - CyberLink Corp.)
DigitalPersona Personal 3.0.0 (HKLM\...\{C7AF7F33-9092-997E-2D29-DE8095863FE3}) (Version: 3.0.0 - DigitalPersona, Inc.)
DivX Codec (HKLM\...\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.9.1 - DivX, Inc.)
DivX Player (HKLM\...\{8ADFC4160D694100B5B8A22DE9DCABD9}) (Version: 7.2.0 - DivX, Inc.)
DivX Version Checker (HKLM\...\{3FC7CBBC4C1E11DCA1A752EA55D89593}) (Version: 7.1.0.9 - DivX, Inc.)
DivX Web Player (HKLM\...\{B7050CBDB2504B34BC2A9CA0A692CC29}) (Version: 1.5.0 - DivX,Inc.)
Dropbox (HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Dropbox) (Version: 3.4.4 - Dropbox, Inc.)
DVD Suite (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.5.0928 - CyberLink Corp.)
ESU for Microsoft Vista (HKLM\...\{9BA6E8AF-2122-4825-9B55-98BC351E3C94}) (Version: 2.0.10.1 - Hewlett-Packard)
GameXN GO (HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\...\Game Organizer) (Version:  - EasyBits Media)
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.135 - Google Inc.)
Google Drive (HKLM\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Hauppauge MCE XP/Vista Software Encoder (2.0.25149) (HKLM\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.25149 - Hauppauge Computer Works, Inc.)
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDA_HSF) (Version:  - )
HP Active Support Library (HKLM\...\{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}) (Version: 3.1.9.1 - Hewlett-Packard)
HP Customer Experience Enhancements (HKLM\...\{BD0E2B92-3814-46F0-893B-4612EA010C7E}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.02.0001 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM\...\{9885A11E-60E4-417C-B58B-8B31B21C0B8A}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Help and Support (HKLM\...\{31216452-5540-4C96-B754-94890A63D5AB}) (Version: 2.0.10.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.5500 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.5500 - HP)
HP Quick Launch Buttons 6.30 E1 (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.30 E1 - Hewlett-Packard)
HP QuickPlay 3.6 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - )
HP QuickTouch 1.00 C4 (HKLM\...\{7DC4A410-9986-4329-9E5D-687B2C42CA39}) (Version: 1.0.7 - Hewlett-Packard)
HP Total Care Advisor (HKLM\...\{b02df929-29a7-4fd2-9a70-81a644b635f7}) (Version: 1.4.19.2433 - Hewlett-Packard)
HP Update (HKLM\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)
HP User Guides 0087 (HKLM\...\{4D49757C-367A-4333-BDB3-68966162B14E}) (Version: 1.02.0000 - Hewlett-Packard )
HP Wireless Assistant (HKLM\...\{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}) (Version: 3.00 H2 - Hewlett-Packard)
HPAsset component for HP Active Support Library (Version: 3.0.2.2 - Hewlett-Packard) Hidden
HPNetworkAssistant (Version: 1.1.70 - Hewlett-Packard.) Hidden
Huawei modem (HKLM\...\Huawei Modems) (Version:  - )
Java 7 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
LabelPrint (HKLM\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.20.2128 - CyberLink Corp.)
LightScribe System Software  1.10.13.1 (Version: 1.10.13.1 - hxxp://www.lightscribe.com) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version:  - )
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 37.0.2 (x86 de) (HKLM\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)
MSCU for Microsoft Vista (HKLM\...\{3D356AA9-2D0C-4373-A762-B42F1A289233}) (Version: 1.0.1.9 - Hewlett-Packard)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: HPCMPQ1902 - WildTangent)
MyDriveConnect 3.3.0.1502 (HKLM\...\MyDriveConnect) (Version: 3.3.0.1502 - TomTom)
NetWaiting (HKLM\...\{3F92ABBB-6BBF-11D5-B229-002078017FBF}) (Version: 2.5.46 - BVRP Software, Inc)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - NVIDIA Corporation)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Power2Go (HKLM\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.3327 - CyberLink Corp.)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2129 - CyberLink Corp.)
PowerDirector (Version: 6.5.2129 - CyberLink Corp.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version:  - )
QuickPlay SlingPlayer 0.4.4 (HKLM\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.4 - SlingMedia)
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.51.01 - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.18.0 - Synaptics)
TomTom HOME 2.8.3.2499 (HKLM\...\TomTom HOME) (Version: 2.8.3.2499 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
USB2 Storage Adapter V3 (LaCie) (HKLM\...\TPP300) (Version:  - )
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0 - DivX, Inc) Hidden
Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
Windows Live Messenger (HKLM\...\{279DB581-239C-4E13-97F8-0F48E40BE75C}) (Version: 8.1.0178.00 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{4D72E5BC-BC7C-11E0-83CA-10424824019B}\InprocServer32 -> C:\Users\Andrea\AppData\Local\ASKTOO~1\DOWNLO~1\AviraIDW.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Andrea\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3332240539-3529680259-2340434327-1000_Classes\CLSID\{FBE88A10-FF53-11E0-AB2A-AE904824019B}\InprocServer32 -> C:\Users\Andrea\AppData\Local\ASKTOO~1\DOWNLO~1\AVIRAI~1.DLL No File

==================== Restore Points  =========================

07-04-2015 19:57:36 Windows Update
14-04-2015 14:22:35 Windows Update
18-04-2015 19:24:27 Windows Update
19-04-2015 01:20:47 Windows Live Essentials
19-04-2015 01:27:08 Windows Update
19-04-2015 01:34:09 DirectX wurde installiert
19-04-2015 01:36:53 DirectX wurde installiert
19-04-2015 14:01:35 Windows Update
19-04-2015 17:45:18 Installiert HD Writer LE 2.1
20-04-2015 19:15:08 Windows Update
21-04-2015 16:04:52 Windows Update
25-04-2015 17:11:23 Windows Update
27-04-2015 21:31:35 Removed Skype™ 7.0
28-04-2015 13:25:14 Wiederherstellungsvorgang
28-04-2015 13:44:19 avast! antivirus system restore point
28-04-2015 14:02:01 Wiederherstellungsvorgang
28-04-2015 14:47:41 Wiederherstellungsvorgang
28-04-2015 15:29:40 avast! antivirus system restore point
28-04-2015 16:02:48 Windows Update
28-04-2015 21:31:21 avast! antivirus system restore point
29-04-2015 14:01:21 Windows Update
29-04-2015 16:09:22 Removed Apple Software Update
29-04-2015 16:12:22 Removed Apple Mobile Device Support
29-04-2015 16:14:26 Removed Apple Mobile Device Support
29-04-2015 16:17:46 Removed Apple Application Support
29-04-2015 16:24:01 Removed Bonjour
29-04-2015 16:28:08 Removed iTunes
29-04-2015 16:37:41 Removed Skype™ 6.11
29-04-2015 16:41:20 Removed Apple Mobile Device Support
30-04-2015 14:01:12 Windows Update
01-05-2015 17:32:17 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {17B5CAE3-7EE5-417C-A6F5-C6E258A8BA36} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {21F57ECB-2A4A-4CC6-988D-F1BC3CDBA005} - System32\Tasks\{0C8C4C93-E4EC-4B11-9D59-BC048BF09AA1} => C:\Program Files\Skype\Phone\Skype.exe
Task: {2E9BDE04-B142-4947-88EA-5D35F066E0C5} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-10-09] (Hewlett-Packard)
Task: {3D3F0152-1F5C-4909-837E-1A6FB16A1D20} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {45F153E7-5113-4937-BB7C-155A15B84B04} - System32\Tasks\avastBCLRestartS-1-5-21-3332240539-3529680259-2340434327-1000 => Firefox.exe 
Task: {832C3622-E2DE-4145-B048-F8F65B7DD17A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-04-28] (Avast Software s.r.o.)
Task: {8B02B7DA-5DB5-467B-9A8E-332BFDC0CF60} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-28] (Adobe Systems Incorporated)
Task: {9871882C-89EB-4818-89A3-4475020940F2} - System32\Tasks\{1F2C92B4-9235-4999-8112-9D31F45967C2} => pcalua.exe -a C:\Users\Andrea\Downloads\AVM_FRITZ_WLAN_Repeater_310_Assistent.exe -d C:\Users\Andrea\Downloads
Task: {C568A7BE-4E8A-4807-A654-71149700A2A3} - System32\Tasks\{13E362E9-92BC-441D-B508-1245A60B8D92} => pcalua.exe -a E:\SETUP.EXE -d E:\
Task: {D884BFFD-48E4-499E-AEDD-6D74F91FDC6A} - System32\Tasks\{19B26A87-4A51-45F6-9E75-5FC82E2CB93D} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=4.1.0.166.217&amp;LastError=12029
Task: {D94FCE49-3034-4AA8-BEDE-661665A7B084} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {EF802554-FE0E-4452-B24E-FEFCBBE098DB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)
Task: {FA6D8A6A-96A8-4DC7-8CDA-1F495BBC0B66} - System32\Tasks\{E76E00A4-8AD4-4280-838D-551E953F708B} => Firefox.exe hxxp://ui.skype.com/ui/0/4.2.0.169.217/de/abandoninstall?page=tsChrome&amp;installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:offered-installed;madedefault

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-04-06 19:25 - 2015-04-28 21:42 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-04-06 19:25 - 2015-04-28 21:42 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-05-01 11:48 - 2015-05-01 11:48 - 02926592 _____ () C:\Program Files\AVAST Software\Avast\defs\15050100\algo.dll
2011-10-29 18:24 - 2001-10-28 17:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2014-01-17 22:26 - 2013-05-14 11:50 - 00140936 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
2007-12-19 05:26 - 2007-09-30 20:34 - 00271760 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2007-12-19 05:26 - 2007-09-30 20:34 - 00255384 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2007-12-19 05:26 - 2007-09-30 20:34 - 00038184 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2007-10-24 09:35 - 2007-01-09 12:25 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2007-12-19 05:26 - 2007-09-30 20:34 - 00112016 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-02-11 01:46 - 2015-04-28 21:45 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2007-05-16 10:43 - 2007-05-16 11:12 - 00671744 _____ () C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
2015-05-01 18:47 - 2015-05-01 18:47 - 00043008 _____ () c:\users\andrea\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpon3ccw.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Andrea\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2007-12-19 05:25 - 2007-09-30 20:33 - 00066856 _____ () C:\Program Files\HP\QuickPlay\Kernel\Common\MCEMediaStatus.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3332240539-3529680259-2340434327-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Andrea\Pictures\Urlaub Rovinj 2011\Urlaub 2011 085.JPG
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [{5C1BDBCD-A111-4618-90CA-9FDBEE4144C6}] => (Allow) C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
FirewallRules: [{65076D90-E8CF-45CC-A013-A167D76022E4}] => (Allow) C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
FirewallRules: [{D81DCF4F-D3B7-40C9-8186-03D27A64E629}] => (Allow) C:\Program Files\Cyberlink\PowerDirector\PDR.EXE
FirewallRules: [{82BD6292-3753-4C8C-B85B-84D9D47E3E86}] => (Allow) C:\Program Files\MSN Messenger\msnmsgr.exe
FirewallRules: [{B2EEA14D-A39B-4479-80AB-C7DDFA9B2183}] => (Allow) svchost.exe
FirewallRules: [{0FFD5ABE-9BB4-4873-8EA3-DE25FAA90BED}] => (Allow) C:\Program Files\MSN Messenger\livecall.exe
FirewallRules: [{4DC5BA04-053E-4A08-AB47-8E122A9043B6}] => (Allow) C:\Program Files\HP\QuickPlay\QP.exe
FirewallRules: [{76E9269D-0855-4B9C-BFAB-3BE39CE21CB1}] => (Allow) C:\Program Files\HP\QuickPlay\QPService.exe
FirewallRules: [TCP Query User{B3B3425B-D786-432A-A00D-2DDB9A399E1E}C:\program files\edonkey2000\edonkey2000.exe] => (Allow) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [UDP Query User{DBCC6D91-8EDB-41B6-B6C3-5C238428A24A}C:\program files\edonkey2000\edonkey2000.exe] => (Allow) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [TCP Query User{61A8A174-591E-4696-8C2E-A82BD2F425A1}C:\program files\edonkey2000\edonkey2000.exe] => (Block) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [UDP Query User{75858838-E10D-4F5D-9A3E-66FDC520E069}C:\program files\edonkey2000\edonkey2000.exe] => (Block) C:\program files\edonkey2000\edonkey2000.exe
FirewallRules: [TCP Query User{3B7B0DEE-398B-495E-8435-2083C9DC49CC}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Block) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [UDP Query User{F9271F30-2DAB-4257-9EC0-1CE7D81C4BA5}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Block) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [TCP Query User{8B9BEF2A-9C08-41C6-8B08-EFBA960895C3}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Allow) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [UDP Query User{64902BD5-31D9-4DDC-8462-44869462ADBD}C:\program files\fritz!box monitor\fritzboxmonitor.exe] => (Allow) C:\program files\fritz!box monitor\fritzboxmonitor.exe
FirewallRules: [{84C4E59D-3739-401A-A19D-6AA42338B993}] => (Allow) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
FirewallRules: [{916B2A70-48C5-4DCD-91EB-88FB08704C29}] => (Allow) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
FirewallRules: [{F65EDFA6-D7C2-4740-86B0-2033FDA86D54}] => (Allow) C:\Program Files\FRITZ!DSL\FBOXUPD.EXE
FirewallRules: [{216B4696-2533-4291-BD51-5277A36511D0}] => (Allow) C:\Program Files\FRITZ!DSL\FBOXUPD.EXE
FirewallRules: [{B51500E1-2050-47E7-832F-D94BDF799AFA}] => (Allow) C:\Program Files\FRITZ!DSL\WebwaIgd.exe
FirewallRules: [{1E88B0AA-D582-4029-AAEA-035834B416E7}] => (Allow) C:\Program Files\FRITZ!DSL\WebwaIgd.exe
FirewallRules: [TCP Query User{F988F6AB-1E13-4093-BC77-A628CB95CA6E}C:\program files\icq7.1\icq.exe] => (Block) C:\program files\icq7.1\icq.exe
FirewallRules: [UDP Query User{9A8C274D-51C8-4FDE-A41A-394DF88FCACE}C:\program files\icq7.1\icq.exe] => (Block) C:\program files\icq7.1\icq.exe
FirewallRules: [TCP Query User{17109E81-B135-4423-BBA9-E421C9213A76}C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{5CCE0580-0F32-4D93-A9C0-83191F068C8E}C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\andrea\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{167A77B1-4149-483B-9191-145FEC505B15}] => (Allow) LPort=80
FirewallRules: [{0EA5834B-3416-4599-AC6B-6908186FEFD1}] => (Allow) LPort=80

deeprybka · 01.05.2015, 18:18

Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

Djangolino · 01.05.2015, 18:30

Offensichtlich kann ich nichts feststellen. Wenn er hochfährt dauert es so seine Zeit, war aber schon länger so.
Sonst alles ok.

deeprybka · 01.05.2015, 18:31

Zitat:

Zitat von Djangolino

Wenn er hochfährt dauert es so seine Zeit, war aber schon länger so.

Wie lange ca.?

Poste Dir dann noch ne Aufräumanleitung.

Djangolino · 01.05.2015, 20:14

Ohja, das wäre super und sicher dringend notwendig.

Gerade nochmal probiert, denn mit schätzen ist das so eine Sache.....

bis ich arbeiten kann ohne das er sich aufhängt 8 Minuten.

Bekam jetzt noch folgende Fehlermeldung (irgendwann hatte ich sie schon mal)

CL Sched Module wurde beendet und geschlossen.
Die anwendung wird aufgrund eines Problems nicht mehr richtig ausgeführt. Sie erhalten eine Nachricht, wenn eine Lösung verfügbar ist.

deeprybka · 02.05.2015, 12:22

Naja, das ist schon lange...

Kannst aber mal das ausprobieren:

Schritt 1

Clean-Boot

Drücke auf den Start -Button und gib "msconfig" in das Suchfeld ein. Klicke auf das Suchergebnis.
Bestätige die Meldung der Benutzerkontensteuerung
Wähle die auf dem Bild gezeigte Konfiguration (1) und klicke dann auf Dienste (2)
Setze einen Haken bei den Microsoftdiensten (1) und klicke auf "Alle deaktivieren" (2). Bestätige mit OK. (3)

Wie verhält sich der Computer nach dem Neustart?

01.05.2015, 18:18	#11
deeprybka /// TB-Ausbilder /// Anleitungs-Guru	Spybot kann Win32.Qhost.ahnj nicht löschen Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche? __________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Spybot kann Win32.Qhost.ahnj nicht löschen

Log-Analyse und Auswertung: Spybot kann Win32.Qhost.ahnj nicht löschen