Trojaner-Board - adsdelivery + iStartSurf

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - adsdelivery + iStartSurf (https://www.trojaner-board.de/165908-adsdelivery-istartsurf.html)

adsdelivery + iStartSurf

Nichts geht mehr auf meinem Laptop.
Habe es mit AdwCleaner und malewarebytes versucht und nichts gefunden.
Dann gab es folgende Meldung: resource:// firefox.abs.avira.com/html/blocled.html.
Dann habe ich firefox gelöscht und eine Systemwiederherstellung versucht. Ging nicht, weil "C: $ Extrend $ Realität $Txf " nicht extrahiert werden konnte.

Wenn ich jetzt den Internet Exporer starten will, schweigt mein Computer.
Bevor ich meinen Laptop jetzt an die Wand schmeiße, weil ich wohl alles, was man falsch machen kann, falsch gemacht habe, geht mein letzter Hilferuf über den Laptop meiner Frau an Sie:kloppen:

Bei Vorschlägen bitte berücksichtigen, dass ich möglichst einfache Anweisungen brauche

Danke

Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

wie bekomme ich FRST 64-Bit vom Laptop meinerFRau auf meinen Laptop

Du hast keinen USB-Stick?
Oder geht nichtmal mehr FRST auf dem Problemrechner?

FRST 64-Bit Addition

konnte das Programm auf ein USB STick laden und auf meinem PC starten.
ob das mit dem Anhang geklappt hat, kann ich nicht erkennen

Ich hab da extra dick und fett was zu CODE-Tags und Anhängen gepostet... :pfeiff:

habe Quarantäne Liste von ADWCleaner gefunden:

ist jetzt alles angekommen,ich glaube ich habe Dein Pfeifen leider nicht gehört, oder doch?:headbang:

Also dann nochmal :wtf:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

entschuldige, ich dachte das wäre eine Reklame

Code:

Additional scan result of Farbar 

1. FRST Addition:
 

Recovery Scan Tool (x64) Version: 11-03-2015

Ran by Holger Carlson at 2015-04-08 15:05:37

Running from F:\

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

FW: avast! Antivirus (Disabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Absolute Uninstaller 5.3.1.20 (HKLM-x32\...\Absolute Uninstaller) (Version: 5.3.1.20 - Glarysoft Ltd)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 17.0.0.124 - Adobe Systems Incorporated)

Adobe Digital Editions 4.0 (HKLM-x32\...\Adobe Digital Editions 4.0) (Version: 4.0.3 - Adobe Systems Incorporated)

Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.134 - Adobe Systems Incorporated)

Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Alle meine Adressen 1.20 (HKLM-x32\...\AllemeineAdressen) (Version:  - )

Amazon Kindle (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Amazon Kindle) (Version:  - Amazon)

Anti-Twin (Installation 14.02.2015) (HKLM-x32\...\Anti-Twin 2015-02-14 11.26.34) (Version:  - Joerg Rosenthal, Germany)

ASUS FancyStart (HKLM-x32\...\{2B81872B-A054-48DA-BE3B-FA5C164C303A}) (Version:  - )

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2215 - AVAST Software)

AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)

Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)

Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden

Buchliebhaber 9.1.0 (HKLM-x32\...\Buchliebhaber_is1) (Version:  - Matthies & Klock GmbH)

Glary Utilities 5.22 (HKLM-x32\...\Glary Utilities 5) (Version: 5.22.0.41 - Glarysoft Ltd)

GMX MediaCenter 1.5.2192.0 (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\GMX Application {sync-000021}) (Version: 1.5.2192.0 - 1&1 Mail & Media GmbH)

GMX Softwareaktualisierung CE (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.1.0 - 1&1 Mail & Media GmbH)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)

MD Adressbuch 2012 (HKLM-x32\...\MD Adressbuch 2012_is1) (Version:  - Stefan Göppert Softwareentwicklung)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)

MyDriveConnect 3.3.0.1756 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)

MyFreeCodec (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\MyFreeCodec) (Version:  - )

paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)

Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)

SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version:  - )

Samsung Mobile Modem Device Software (HKLM\...\Samsung Mobile Modem Device) (Version:  - )

SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version:  - )

Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )

SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version:  - )

SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version:  - )

SAMSUNG USB Mobile Device Software (HKLM\...\SAMSUNG USB Mobile Device) (Version:  - )

TomTom HOME (HKLM-x32\...\{BB05590A-6602-43F3-A400-77EA0976BC0A}) (Version: 2.9.8 - Ihr Firmenname)

TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version:  - )

Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)

WinZip Driver Updater (HKLM-x32\...\{9854A5C4-5BE5-46E2-A989-352DD8B37E20}_is1) (Version: 1.0.648.16298 - WinZip Computing, S.L. (WinZip Computing))

Wondershare Video Editor(Build 4.8.0) (HKLM-x32\...\Wondershare Video Editor_is1) (Version:  - Wondershare Software)

XnView 2.25 (HKLM-x32\...\XnView_is1) (Version: 2.25 - Gougelet Pierre-e)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

08-04-2015 00:11:59 Wiederherstellungsvorgang

08-04-2015 10:17:37 Die Service Pack-Sicherungsdateien wurden entfernt.
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2014-12-04 14:19 - 00000860 ____N C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

::1 localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {08B758AF-1A52-432B-8127-90EC4AA3A965} - System32\Tasks\{F2C2A228-7128-4269-BFD6-1BA7B353163D} => C:\Program Files (x86)\Matthies &amp; Klock GmbH\Buchliebhaber\PR9\pdxrwn32.exe

Task: {098E8135-34F9-4A64-934D-CB129E5D2CDC} - \Google Updater and Installer No Task File <==== ATTENTION

Task: {0CE00D12-17CE-4495-BF65-180B9826F70C} - \{61A08136-196D-4297-89AD-D497D9417337} No Task File <==== ATTENTION

Task: {0D02835E-8E5B-471D-B8DD-C212A01D96EC} - \{D04405DF-9CCA-470D-B397-4843D8B97AF0} No Task File <==== ATTENTION

Task: {0D85BDAC-E5C7-468D-B749-BB89C6043C0C} - \{5287E865-8199-49E9-9791-D1D1C8255AD2} No Task File <==== ATTENTION

Task: {11951C30-7772-4873-A9C8-E7D79EC20876} - \{D8737E18-1D23-477D-AAC7-5336054949A5} No Task File <==== ATTENTION

Task: {13F363A7-DAF8-481E-B4FE-FE9B141B5AA3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)

Task: {25201061-4215-47D1-9AD4-34EA219B3820} - System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F} => pcalua.exe -a E:\setup.exe -d E:\

Task: {28C6FF84-FF3C-482A-9DE2-C1E1A727942B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-06] (Adobe Systems Incorporated)

Task: {290FA810-6486-498B-959B-EF77EE05DD0F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)

Task: {2B0BE8B0-825F-4CBB-8C4D-91671BCB9A6A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {2FC8335C-FA90-4CEE-A686-C6B49483A403} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)

Task: {3210E7F8-FB59-421F-B199-67709A46C787} - \{A6277D21-0A69-4926-8537-03083BD82DC4} No Task File <==== ATTENTION

Task: {334ED6C7-1F98-49AE-8A05-3E3B9A21315B} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)

Task: {358F7EC5-6965-40B1-864E-007E2DF9341F} - System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)

Task: {38A8F2A8-F514-4C70-A1BB-A5D46267F1FB} - \{F46C64DF-4E00-4451-B8AB-B1BD2B03A5D6} No Task File <==== ATTENTION

Task: {38ADF97D-C025-44B4-8A28-255AF09F87BD} - \{9623FEA8-9F14-41C1-B13F-5E2F1DDF2973} No Task File <==== ATTENTION

Task: {38F64A5C-9D9B-402B-A2B5-B669F928CBC9} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2015-03-30] (Glarysoft Ltd)

Task: {3B3ABEC6-C5C7-4317-98AA-0E6A0A2CCF4B} - \{9DB39282-3B31-400F-9105-DE5FB32A8625} No Task File <==== ATTENTION

Task: {3D5A7F1A-A836-46DC-9849-9F87B83A84A3} - System32\Tasks\ASPG => C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe [2009-06-29] (ASUS)

Task: {3DFA3AE3-36A5-43EE-86FD-5CFEE82FD09E} - \{010EC50E-DEBC-4DDF-818F-D8FD586C6441} No Task File <==== ATTENTION

Task: {40210CAF-8AA2-4DD1-BDF5-BB204B73FB6C} - System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)

Task: {413B067F-3B28-4DF2-8F92-254BE963B97C} - System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)

Task: {41E4A974-3CB9-486E-B66F-D3F72922F49D} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-05-28] (ATK)

Task: {442B4BA7-EBD3-4530-973F-E7CC01346952} - \{BA46EF16-D5AD-455B-A934-5EFCEB3A4388} No Task File <==== ATTENTION

Task: {44B27208-7DF9-417C-85BA-311F6EE0FE37} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17] (ASUS)

Task: {46897D9B-08E1-407A-86D2-588D7ABBE189} - \{BE03A807-43D0-45D8-9633-BA1E5A2BF85C} No Task File <==== ATTENTION

Task: {47F29D00-B56D-4D0B-A245-F110AC103BA3} - \{DCE86621-269D-478F-9FAC-AF30D2697486} No Task File <==== ATTENTION

Task: {4A29309C-5F1C-4521-B5A3-74342AD4D434} - System32\Tasks\avastBCLRestartS-1-5-21-171592873-1656066399-1947005370-1000 => Chrome.exe 

Task: {4ABBB83F-8527-455B-839D-0E31E9921ABF} - \{414946E3-07AA-4AF3-BB0D-E22440C7BAAE} No Task File <==== ATTENTION

Task: {4DB12196-A5A6-455A-A31E-8A8F9CDA048F} - \{00D6677F-309E-4218-BCA8-4C50017C8BFD} No Task File <==== ATTENTION

Task: {4E55F6B2-D76F-46DA-85CA-851B04EA102C} - System32\Tasks\4805 => Wscript.exe C:\Users\HOLGER~1\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION

Task: {536019A5-4DF9-4D2A-AB12-D4F97B46565A} - \{3542F023-1538-411B-9E77-ACAF5E3DCF29} No Task File <==== ATTENTION

Task: {570F0731-82FB-4801-9764-13133948D30D} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {61DA3565-D65E-4727-A79B-CFF46B7C83D0} - \{515B0C8B-D302-490D-B011-1690D5CB8DA8} No Task File <==== ATTENTION

Task: {67253C4B-AA19-4D28-A2C4-ACB82A1E8FB3} - \{8715223C-93FC-489B-A4F9-497C1B06356D} No Task File <==== ATTENTION

Task: {689876BF-828C-4CAC-B3C8-96B7A34B374C} - \{E27BA60A-F9D1-4950-AADD-E4C8BB8E3AE7} No Task File <==== ATTENTION

Task: {6B054A5F-A0E3-42EF-B939-199ECAD09EEE} - \Registration 1und1 Task No Task File <==== ATTENTION

Task: {73E334A0-2C62-4488-842A-B6047FD36A67} - \{4C3D4C4C-3DD2-436D-B415-CC9B34C519DA} No Task File <==== ATTENTION

Task: {7687468C-FCB9-4157-98A5-29F118266571} - \{80C774A3-BC4E-4FEF-B262-A5578F350E85} No Task File <==== ATTENTION

Task: {7D065A65-864E-4237-909F-B37C27ECC63A} - \{A86E51F0-822F-4FC6-9962-851362E69E65} No Task File <==== ATTENTION

Task: {813A7F73-0382-4A15-BA6D-549796A8A795} - \{A3123A1E-2B47-4121-992C-63487F1CE1F3} No Task File <==== ATTENTION

Task: {8280F3EA-A247-4A48-8F40-7F948D87EB49} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe

Task: {833E3160-FE17-4A2E-8B96-5ACA617F1334} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31] (ASUS)

Task: {83C4C39B-F484-45E4-B677-EFBBD3E1183A} - \{7874A9A9-C312-459B-A16C-50B15C6AE000} No Task File <==== ATTENTION

Task: {8B51862B-900B-4C95-A7D5-29D974D8EE26} - \{4BA2B75B-115C-4BCA-B45A-BD110E15FEF3} No Task File <==== ATTENTION

Task: {8E7BFA22-A9BF-4269-B793-D870D24D60C2} - System32\Tasks\0215tbUpdateInfo => C:\ProgramData\Avg_Update_0215tb\0215tb_{9AC9BD6A-EC15-4AF2-B2E9-45B20221802C}.exe [2015-02-27] ()

Task: {8F72ADBE-9038-41E9-86A7-8381B850A01F} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2009-07-23] (ATK)

Task: {933153D3-FF7D-4F2F-93DB-4EE18AEC267A} - \{58E9C4A2-89D5-4097-9A1D-3C7212CC100A} No Task File <==== ATTENTION

Task: {95298E87-8CFD-4CCA-890F-8B7D7730CF74} - \{E2D6ACFE-B61E-4447-AE80-4B0CA9F20914} No Task File <==== ATTENTION

Task: {961A4741-EA5F-4FD4-9F58-9824862E1432} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION

Task: {9AA4F3F3-6B2F-4EA6-B81B-1EA4DF38689E} - \{F99ED12E-E280-47FF-9CC7-4FA9874C09B4} No Task File <==== ATTENTION

Task: {9C67CD09-48FC-4280-A9C2-7D5BE146C9A7} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2015-03-30] (Glarysoft Ltd)

Task: {A7177D9F-E795-4EEA-9386-C0AB9B1E6555} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {AB825B6B-2DF7-408C-A17E-B405E72C327C} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()

Task: {ABE155A8-22A7-4F41-A3D7-35B367212640} - \{8EE0BDD3-D87C-4147-865B-EF850579BBB3} No Task File <==== ATTENTION

Task: {B35D3966-C1EC-4ABB-BAC5-D82790C11C3F} - \{E3C1408B-870F-4E8E-863D-53964BB8AC89} No Task File <==== ATTENTION

Task: {B39D560A-BEBE-44B2-BB96-2FB0031EFCB1} - System32\Tasks\{5F6DAA4F-722D-4B6E-9C1D-E206E1B3507A} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{F193FC0E-9E18-40FC-A974-509A1BDD240A}\setup.exe" -c -runfromtemp -l0x0407 -removeonly

Task: {B3AA75D5-DCF3-4574-8832-4A1FD12772EC} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-04-06] (Avast Software s.r.o.)

Task: {B3C1DDB0-DE41-4A0A-BF91-DBEDCF91283A} - \{579791C6-84C4-4514-8990-62DE88C0F405} No Task File <==== ATTENTION

Task: {B4381734-38BC-4416-BA34-AD5B873F9C57} - \Java Update Scheduler No Task File <==== ATTENTION

Task: {B4906D30-8E70-438F-ACE2-F49B1DBE7445} - \{94AA3650-9FB1-4CD9-A08A-C903E473EBCE} No Task File <==== ATTENTION

Task: {B967227B-B6FD-4E2D-8835-423AB6A11D89} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)

Task: {BE3C31CF-63BD-4BBF-B1EC-7B0AD8E1475C} - \{766A2B2A-5AE1-40C4-B5D1-3ACEE3EDB174} No Task File <==== ATTENTION

Task: {BF27F29A-158B-4BB3-8BCE-76285F22E1E8} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe

Task: {C070E538-D27F-40CE-A149-1F519DE498C9} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)

Task: {C9922EB1-0689-4006-9DE5-EC7322657A2E} - \{3A7AA56D-B373-4984-B360-5A49D81838B3} No Task File <==== ATTENTION

Task: {D10B95EB-9C87-4E4B-B2A9-7995BACE3748} - System32\Tasks\ASUSControlDeck => C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe [2010-06-09] (asus)

Task: {D3A8949A-66C0-404E-A951-6D81347CC413} - \{5F42D548-089A-4880-B17A-030133EB09AE} No Task File <==== ATTENTION

Task: {D3DCDC2E-0597-4E10-B9B2-DA8A9D0B8184} - \{C8855EFF-1C49-474C-8EC9-A88A46937291} No Task File <==== ATTENTION

Task: {D79B06A8-69BD-44AF-A4F9-51F90B02F5F9} - \{010E4118-67B1-49F2-B0A9-AEBEB8C22ED8} No Task File <==== ATTENTION

Task: {D804B95C-2E56-41A3-BA15-CBFF3F453270} - \{D1412BBD-3329-445E-BAAC-11DAA3F957DE} No Task File <==== ATTENTION

Task: {D97583DC-E996-4394-9850-866EE5071AA3} - \{54761E2D-0F8D-4150-9BAF-A6C950ABC57C} No Task File <==== ATTENTION

Task: {DCCEAEA3-B771-45EF-B482-A5AF7C257613} - \{F268C70D-1377-46B5-B8EF-B0F597A319DD} No Task File <==== ATTENTION

Task: {DD20FA04-E2E5-4565-BC1F-EF251B8CF767} - \{017BCEFC-6CC0-4438-9C8C-8201389B3A60} No Task File <==== ATTENTION

Task: {DF172056-6ED6-443A-A038-9148CCA273FB} - System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E} => pcalua.exe -a E:\setup.exe -d E:\

Task: {E4FADBEF-BD70-4875-9F9E-1F514FAE9ACE} - \{428451EA-30BB-4D09-B88F-21C45644BDDD} No Task File <==== ATTENTION

Task: {EBAEA87A-60D8-457D-B7BE-FDDEE0C029B6} - \{E72F77B1-78E7-4B59-A542-303E6C370E31} No Task File <==== ATTENTION

Task: {EBC17C4A-B399-454D-880A-2B7927689200} - System32\Tasks\{B499114B-BC27-40FC-98B1-F18D60669500} => pcalua.exe -a C:\ProgramData\ZombieInvasion\uninstall.exe -c /kb=y /ic=1

Task: {EBDB75AC-DD2E-4374-8CA6-CA615964EFDF} - System32\Tasks\{F24AA02C-94D0-40B1-9DB0-D88D09B26BA3} => C:\Program Files (x86)\Matthies &amp; Klock GmbH\Buchliebhaber\PR9\pdxrwn32.exe

Task: {F088DE68-E8E0-404D-A03F-71D270529CAA} - \{C9155B3B-9625-4BCA-8DC8-57E7BE8F3A16} No Task File <==== ATTENTION

Task: {F291C6EE-C628-4432-9AA6-72AB2B105BB0} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe

Task: {F2C3A777-E8AA-4F3A-BAFD-9404E1BEA2BA} - \SidebarExecute No Task File <==== ATTENTION

Task: {FCC576CF-4869-4F53-B945-CC818F71D6F7} - \{A56BDF5A-F4F1-4A50-8871-D8B38E0FE432} No Task File <==== ATTENTION

Task: C:\Windows\Tasks\0215tbUpdateInfo.job => C:\ProgramData\Avg_Update_0215tb\0215tb_{9AC9BD6A-EC15-4AF2-B2E9-45B20221802C}.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GlaryInitialize 5.job => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) ==============
 

2015-03-23 11:39 - 2015-03-23 11:39 - 00620056 _____ () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe

2010-03-05 18:21 - 2010-03-05 18:21 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll

2007-06-15 19:28 - 2007-06-15 19:28 - 00104960 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll

2007-06-02 01:52 - 2007-06-02 01:52 - 00159744 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll

2010-01-11 19:27 - 2010-01-11 19:27 - 00017920 _____ () C:\Program Files\P4G\DevMng.dll

2010-05-06 03:22 - 2010-05-06 03:22 - 00108544 _____ () C:\Program Files\P4G\OvrClk.dll

2008-10-01 08:02 - 2008-10-01 08:08 - 00011264 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll

2010-10-08 21:01 - 2007-11-30 20:20 - 00051768 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

2010-10-08 20:22 - 2010-04-06 08:29 - 00244904 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

2015-04-06 17:55 - 2015-04-06 17:55 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll

2015-04-06 17:55 - 2015-04-06 17:55 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll

2015-04-07 23:05 - 2015-04-07 23:05 - 02924544 _____ () C:\Program Files\AVAST Software\Avast\defs\15040701\algo.dll

2015-04-08 14:54 - 2015-04-08 14:54 - 02925056 _____ () C:\Program Files\AVAST Software\Avast\defs\15040801\algo.dll

2015-04-06 17:55 - 2015-04-06 17:55 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2015-03-30 08:07 - 2015-03-30 08:07 - 00080160 _____ () C:\Program Files (x86)\Glary Utilities 5\zlib1.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\Temp:AD022376
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Classes\exefile:  <===== ATTENTION!
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.2.1
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupreg: ADSMTray => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe

MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe

MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"

MSCONFIG\startupreg: RemoteControl9 => "C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe"

MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-171592873-1656066399-1947005370-500 - Administrator - Disabled)

Gast (S-1-5-21-171592873-1656066399-1947005370-501 - Limited - Disabled)

Holger Carlson (S-1-5-21-171592873-1656066399-1947005370-1000 - Administrator - Enabled) => C:\Users\Holger Carlson

HomeGroupUser$ (S-1-5-21-171592873-1656066399-1947005370-1002 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft-Teredo-Tunneling-Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (04/08/2015 10:17:37 AM) (Source: VSS) (EventID: 8194) (User: )

Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert

.

Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
 
 

Vorgang:

   Generatordaten werden gesammelt
 

Kontext:

   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}

   Generatorname: System Writer

   Generatorinstanz-ID: {838dcb48-10f2-4035-8955-78846a8e7807}
 

Error: (04/08/2015 09:50:44 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 230
 

Startzeit: 01d071cc5aec4b5f
 

Endzeit: 390
 

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe
 

Berichts-ID: ef1bd15d-ddc3-11e4-8f0d-20cf30cfa402
 

Error: (04/08/2015 00:28:45 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 730
 

Startzeit: 01d0718193adbd30
 

Endzeit: 0
 

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe
 

Berichts-ID: 6645c20b-dd75-11e4-be47-20cf30cfa402
 

Error: (04/08/2015 00:17:27 AM) (Source: System Restore) (EventID: 8210) (User: )

Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows-Sicherung). Zusätzliche Informationen: 0x80070005.
 

Error: (04/07/2015 11:53:18 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 194
 

Startzeit: 01d0717cecf34e3b
 

Endzeit: 78
 

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe
 

Berichts-ID: 78fbce4e-dd70-11e4-ba94-20cf30cfa402
 

Error: (04/07/2015 11:50:56 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1364
 

Startzeit: 01d0717aa5f796e2
 

Endzeit: 0
 

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe
 

Berichts-ID:
 

Error: (04/07/2015 11:48:37 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17689, Zeitstempel: 0x54e6869b

Name des fehlerhaften Moduls: aswWebRepIE64.dll, Version: 10.0.0.44, Zeitstempel: 0x5501a3ca

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00000000000116a3

ID des fehlerhaften Prozesses: 0x14f4

Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0

Pfad der fehlerhaften Anwendung: iexplore.exe1

Pfad des fehlerhaften Moduls: iexplore.exe2

Berichtskennung: iexplore.exe3
 

Error: (04/07/2015 11:47:24 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17689, Zeitstempel: 0x54e6869b

Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7c92c

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000019868

ID des fehlerhaften Prozesses: 0xc08

Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0

Pfad der fehlerhaften Anwendung: iexplore.exe1

Pfad des fehlerhaften Moduls: iexplore.exe2

Berichtskennung: iexplore.exe3
 

Error: (04/07/2015 11:34:28 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: b94
 

Startzeit: 01d0717a6ba74781
 

Endzeit: 16
 

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe
 

Berichts-ID: d76c519b-dd6d-11e4-ba94-20cf30cfa402
 

Error: (04/07/2015 11:32:59 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm iexplore.exe, Version 11.0.9600.17689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 28c
 

Startzeit: 01d0717824c2c90c
 

Endzeit: 0
 

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe
 

Berichts-ID:
 
 

System errors:

=============

Error: (04/08/2015 02:53:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/08/2015 09:09:43 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/08/2015 00:16:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/08/2015 00:13:50 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\Windows\System32\IWMSSvc.dll
 

Error: (04/07/2015 11:15:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/07/2015 08:12:10 PM) (Source: volsnap) (EventID: 36) (User: )

Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 

Error: (04/07/2015 07:13:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/07/2015 00:46:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/07/2015 00:45:27 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\Windows\System32\IWMSSvc.dll
 

Error: (04/07/2015 00:45:27 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\Windows\System32\IWMSSvc.dll
 
 

Microsoft Office Sessions:

=========================

Error: (04/08/2015 10:17:37 AM) (Source: VSS) (EventID: 8194) (User: )

Description: 0x80070005, Zugriff verweigert
 
 

Vorgang:

   Generatordaten werden gesammelt
 

Kontext:

   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}

   Generatorname: System Writer

   Generatorinstanz-ID: {838dcb48-10f2-4035-8955-78846a8e7807}
 

Error: (04/08/2015 09:50:44 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: iexplore.exe11.0.9600.1768923001d071cc5aec4b5f390C:\Program Files\Internet Explorer\iexplore.exeef1bd15d-ddc3-11e4-8f0d-20cf30cfa402
 

Error: (04/08/2015 00:28:45 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: iexplore.exe11.0.9600.1768973001d0718193adbd300C:\Program Files\Internet Explorer\iexplore.exe6645c20b-dd75-11e4-be47-20cf30cfa402
 

Error: (04/08/2015 00:17:27 AM) (Source: System Restore) (EventID: 8210) (User: )

Description: Windows-Sicherung0x80070005
 

Error: (04/07/2015 11:53:18 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: iexplore.exe11.0.9600.1768919401d0717cecf34e3b78C:\Program Files\Internet Explorer\iexplore.exe78fbce4e-dd70-11e4-ba94-20cf30cfa402
 

Error: (04/07/2015 11:50:56 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: iexplore.exe11.0.9600.17689136401d0717aa5f796e20C:\Program Files\Internet Explorer\iexplore.exe
 

Error: (04/07/2015 11:48:37 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: iexplore.exe11.0.9600.1768954e6869baswWebRepIE64.dll10.0.0.445501a3cac000000500000000000116a314f401d0717c85862374C:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\AVAST Software\Avast\aswWebRepIE64.dlld836be9e-dd6f-11e4-ba94-20cf30cfa402
 

Error: (04/07/2015 11:47:24 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: iexplore.exe11.0.9600.1768954e6869bole32.dll6.1.7601.175144ce7c92cc00000050000000000019868c0801d0717c4fd15be8C:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\ole32.dllacd6a0e2-dd6f-11e4-ba94-20cf30cfa402
 

Error: (04/07/2015 11:34:28 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: iexplore.exe11.0.9600.17689b9401d0717a6ba7478116C:\Program Files\Internet Explorer\iexplore.exed76c519b-dd6d-11e4-ba94-20cf30cfa402
 

Error: (04/07/2015 11:32:59 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: iexplore.exe11.0.9600.1768928c01d0717824c2c90c0C:\Program Files\Internet Explorer\iexplore.exe
 
 

CodeIntegrity Errors:

===================================

  Date: 2015-02-10 19:35:28.928

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\emOEM64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2015-02-10 19:35:28.536

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\emOEM64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-12-29 18:03:12.533

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\HOLGER~1\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-12-29 18:03:12.393

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\HOLGER~1\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-12-29 18:03:11.993

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-12-29 18:03:11.843

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Pentium(R) CPU P6100 @ 2.00GHz

Percentage of memory in use: 48%

Total physical RAM: 2924.57 MB

Available physical RAM: 1492.74 MB

Total Pagefile: 6147.32 MB

Available Pagefile: 4319.39 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:72.69 GB) (Free:5.35 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive d: (Data) (Fixed) (Total:205.87 GB) (Free:23.08 GB) NTFS

Drive f: (VIEDO) (Removable) (Total:14.7 GB) (Free:14.7 GB) FAT32

Drive s: (EX SPEICHER) (Removable) (Total:7.51 GB) (Free:4.24 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 0237A506)

Partition 1: (Not Active) - (Size=19.5 GB) - (Type=1C)

Partition 2: (Active) - (Size=72.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=205.9 GB) - (Type=OF Extended)
 

========================================================

Disk: 1 (Size: 7.5 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type.
 

========================================================

Disk: 2 (Size: 14.7 GB) (Disk ID: 6E652072)

No partition Table on disk 2.
 

==================== End Of Log ============================

2. Quarantäne aus ADWCleaner:
C:\ProgramData\AVG Secure Search\Logger\logger.properties->C:\AdwCleaner\Quarantine\C\ProgramData\AVG Secure Search\Logger\logger.properties.vir
C:\ProgramData\AVG Security Toolbar\TBCampaignINSP.txt->C:\AdwCleaner\Quarantine\C\ProgramData\AVG Security Toolbar\TBCampaignINSP.txt.vir
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe->C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir
C:\ProgramData\WindowsMangerProtect\update\conf->C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\update\conf.vir
C:\ProgramData\IHProtectUpDate\update\conf->C:\AdwCleaner\Quarantine\C\ProgramData\IHProtectUpDate\update\conf.vir
C:\ProgramData\e6ad6c22000030b3\BITE952.tmp->C:\AdwCleaner\Quarantine\C\ProgramData\e6ad6c22000030b3\BITE952.tmp.vir
C:\Program Files (x86)\XTab\BrowerWatchFF.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchFF.dll.vir
C:\Program Files (x86)\XTab\BrowserAction.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowserAction.dll.vir
C:\Program Files (x86)\XTab\CmdShell.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\CmdShell.exe.vir
C:\Program Files (x86)\XTab\conf->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\conf.vir
C:\Program Files (x86)\XTab\HPNotify.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\HPNotify.exe.vir
C:\Program Files (x86)\XTab\IeWatchDog.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\IeWatchDog.dll.vir
C:\Program Files (x86)\XTab\msvcp110.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\msvcp110.dll.vir
C:\Program Files (x86)\XTab\msvcr110.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\msvcr110.dll.vir
C:\Program Files (x86)\XTab\ProtectService.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\InstalledProducts.ini->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\InstalledProducts.ini.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\log4cplusU.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\log4cplusU.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\updater.xml->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\updater.xml.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\UpdaterConfig.ini->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\UpdaterConfig.ini.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\log4cplusU.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\log4cplusU.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\loggingserver.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\loggingserver.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\updater.xml->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\updater.xml.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\UpdaterConfig.ini->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\UpdaterConfig.ini.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.3.0\ViProtocol.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.3.0\ViProtocol.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ToolBandTlb\18.3.0\toolband->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ToolBandTlb\18.3.0\toolband.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\avgtbr.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\avgtbr.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\manifest.json->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\manifest.json.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\ScriptHelper.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\ScriptHelper.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.3.0\manifest.json->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.3.0\manifest.json.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.3.0\ScriptHelper.exe->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.3.0\ScriptHelper.exe.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.4.0\NativeBrowserApi.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.4.0\NativeBrowserApi.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.3.0\NativeBrowserApi.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.3.0\NativeBrowserApi.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\18.4.0\avgdttbx.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\18.4.0\avgdttbx.dll.vir
C:\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\18.3.0\avgdttbx.dll->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\18.3.0\avgdttbx.dll.vir
C:\Users\Holger Carlson\Documents\Optimizer Pro\CookiesException.txt->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\Documents\Optimizer Pro\CookiesException.txt.vir
C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb->C:\AdwCleaner\Quarantine\C\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb.vir
C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml->C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml.vir
C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\user.js->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\user.js.vir
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk->C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk.vir
C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk.vir
C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk.vir
C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.vir
C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk.vir
C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk->C:\AdwCleaner\Quarantine\C\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk.vir

ich hoffe, das ist jetzt richtig.
nochmal sorry, sorry

Da fehlt immer noch locker die Hälfte:

=> FRST.txt
=> restlichen Logs von adwCleaner
=> tw. hast du nicht in CODE-Tags gepostet

Bitte sorgfältiger lesen und mitarbeiten

jetzt habe ich wieder ein Problem. Wenn ich mein Thema aufrufe, habe ich Cosinus letzte Meldung mit dem Hinweis, es würde noch viel fehlen, auf dem Schirm.
Ich dachte, ich hätte den Rest geschickt.
Ich habe es jetzt noch einmal gemacht und war mir dabei fast sicher, dass ich es schon einmal geschickt habe.
Wenn nicht, sorry, wenn doch abermals sorry:headbang:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by Holger Carlson (administrator) on FRIDOLIN on 08-04-2015 15:04:27

Running from F:\

Loaded Profiles: Holger Carlson (Available profiles: Holger Carlson)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser not detected!)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe

(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(ASUS) C:\Program Files (x86)\ASUS\ASUS CopyProtect\ASPG.exe

(ATK) C:\Program Files\P4G\BatteryLife.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe

(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

(ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe

() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

(ASUS) C:\Windows\AsScrPro.exe

(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe

() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

(Glarysoft Ltd) C:\Program Files (x86)\Glary Utilities 5\Integrator.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-06] (Avast Software s.r.o.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2015-03-30] (Glarysoft Ltd)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)

ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll ()

ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll ()

ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File

ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll ()

ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll ()

BootExecute: autocheck autochk *  

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.

ProxyServer: [.DEFAULT] => http=127.0.0.1:56939;https=127.0.0.1:56939

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01

SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}

SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP8803837A-1DA4-472E-BAE6-FF0BFD270EFC&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&q={searchTerms}

BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files\Windows Live\Family Safety\fssbho.dll [2008-12-08] (Microsoft Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-06] (Avast Software s.r.o.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-06] (Avast Software s.r.o.)

BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17] (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {534D542D-5637-006A-76A7-7A786E7484D7} -  No File

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

Tcpip\..\Interfaces\{42264728-0917-4958-91BA-C18941410592}: [NameServer] 0.0.0.0

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF ProfilePath: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default

FF SearchEngineOrder.1: Google (avast)

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-04-06] ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-04-06] ()

FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll [2008-10-15] (CANON INC.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2008-12-04] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\bing-avast.xml [2014-11-16]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-avast.xml [2015-02-01]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-images.xml [2014-10-14]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-maps.xml [2014-10-14]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\yahoo-avast.xml [2014-09-19]

FF Extension: Avira Browser Safety - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\abs@avira.com [2015-03-31]

FF Extension: WEB.DE MailCheck - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\toolbar@web.de [2015-04-05]

FF Extension: OkayFreedom - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\{DB981CCA-088E-4731-A4A2-2FE218703C0E}.xpi [2015-04-05]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-06]

FF HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 

Chrome: 

=======

CHR StartupUrls: Default -> "hxxp://www.google.com/"

CHR Profile: C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-06]

CHR Extension: (Google Docs) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-06]

CHR Extension: (Google Drive) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-06]

CHR Extension: (YouTube) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-06]

CHR Extension: (Google Search) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-06]

CHR Extension: (Google Sheets) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-06]

CHR Extension: (Avast Online Security) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-06]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-06]

CHR Extension: (Google Wallet) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-06]

CHR Extension: (Gmail) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-06]

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - No Path Or update_url value

CHR HKLM-x32\...\Chrome\Extension: [fknfdieimobmimhdkfkheeejenmdjhoe] - C:\Program Files (x86)\pandasecuritytb\chrome-newtab-search.crx [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-06]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 ADSMService; C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [File not signed]

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-06] (Avast Software s.r.o.)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)

R2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [File not signed]

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()

R3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-04-06] () [File not signed]

R2 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [File not signed]

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-23] ()

S2 TomTomHOMEService; "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-06] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-06] (Avast Software s.r.o.)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-06] (Avast Software s.r.o.)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-06] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-06] (Avast Software s.r.o.)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-06] (Avast Software s.r.o.)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-06] (Avast Software s.r.o.)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-06] ()

S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2014-11-14] ()

R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2015-04-03] (Glarysoft Ltd)

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-04-07] (Malwarebytes Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()

S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA64.sys [649984 2009-09-01] (eMPIA Technology, Inc.) [File not signed]

S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM64.sys [626688 2009-09-02] (eMPIA Technology, Inc.) [File not signed]

S3 dgderdrv; System32\drivers\dgderdrv.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]

U3 tmlwf; No ImagePath

U3 tmwfp; No ImagePath
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-08 14:52 - 2015-04-08 14:52 - 00003544 ____N () C:\bootsqm.dat

2015-04-07 18:57 - 2015-04-07 18:57 - 00000000 ____D () C:\ProgramData\GlarySoft

2015-04-07 18:44 - 2015-04-07 18:59 - 00000000 ___HD () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled

2015-04-07 18:43 - 2015-04-07 18:44 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup-Disabled

2015-04-07 12:41 - 2015-04-07 12:41 - 02208768 _____ () C:\Users\Holger Carlson\Documents\adwcleaner_4.200.exe

2015-04-06 18:57 - 2015-04-06 18:57 - 00001884 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk

2015-04-06 18:56 - 2015-04-06 18:56 - 00356232 _____ (Dropbox, Inc.) C:\Users\Public\Desktop\DropboxInstallerAvast.exe

2015-04-06 18:56 - 2015-04-06 17:55 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe

2015-04-06 18:01 - 2015-04-06 18:01 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\AVAST Software

2015-04-06 17:59 - 2015-04-06 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software

2015-04-06 17:59 - 2015-04-06 18:01 - 00002037 _____ () C:\Users\Public\Desktop\Avast Premier.lnk

2015-04-06 17:59 - 2015-04-06 17:59 - 00001944 _____ () C:\Users\Public\Desktop\Avast SafeZone.lnk

2015-04-06 17:58 - 2015-04-07 11:53 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2015-04-06 17:56 - 2015-04-06 17:55 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2015-04-06 17:55 - 2015-04-06 17:55 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr

2015-04-06 17:52 - 2015-04-06 17:52 - 00000000 ____D () C:\Program Files\AVAST Software

2015-04-06 17:11 - 2015-04-06 17:11 - 00000000 ____D () C:\Olivetti

2015-04-06 11:28 - 2015-04-07 12:44 - 00000000 ____D () C:\AdwCleaner

2015-04-06 10:27 - 2015-04-07 23:49 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\CrashDumps

2015-04-05 09:52 - 2015-04-05 10:03 - 00000000 ____D () C:\ProgramData\Informer Technologies, Inc

2015-04-05 09:51 - 2015-04-05 09:51 - 03568824 _____ (Informer Technologies, Inc. ) C:\Users\Holger Carlson\Documents\siinst.exe

2015-04-05 09:45 - 2015-04-06 09:42 - 00000000 ____D () C:\ProgramData\{95f4c13f-5638-faae-95f4-4c13f56304fd}

2015-04-05 09:45 - 2015-04-05 09:45 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Drivers et Pilotes

2015-04-05 09:44 - 2015-04-05 10:03 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos

2015-04-05 09:44 - 2015-04-05 09:44 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos VPN

2015-04-05 09:42 - 2015-04-05 09:42 - 00413328 _____ () C:\Users\Holger Carlson\Documents\OLIVETTI_downloader-QaZJ7date.exe

2015-04-05 09:23 - 2015-04-05 09:24 - 00000000 ___SD () C:\Windows\system32\GWX

2015-04-05 09:23 - 2015-04-05 09:23 - 00000000 ___SD () C:\Windows\SysWOW64\GWX

2015-04-04 17:35 - 2015-04-04 17:36 - 00000000 ____D () C:\Users\Holger Carlson\Documents\Wondershare Video Editor

2015-04-03 19:25 - 2015-04-03 19:25 - 00002950 _____ () C:\Windows\System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8}

2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB}

2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D}

2015-04-03 18:43 - 2015-04-03 18:43 - 00001534 _____ () C:\Users\Holger Carlson\Desktop\Buchliebhaber.lnk

2015-04-03 18:42 - 2015-04-03 18:43 - 00000000 ____D () C:\Buchliebhaber1

2015-04-03 18:12 - 2015-04-03 18:12 - 00003050 _____ () C:\Windows\System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E}

2015-04-03 17:59 - 2015-04-08 15:04 - 00000352 _____ () C:\Windows\Tasks\GlaryInitialize 5.job

2015-04-03 17:59 - 2015-04-08 15:04 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5

2015-04-03 17:59 - 2015-04-03 17:59 - 00020160 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys

2015-04-03 17:59 - 2015-04-03 17:59 - 00002990 _____ () C:\Windows\System32\Tasks\GU5SkipUAC

2015-04-03 17:59 - 2015-04-03 17:59 - 00002666 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5

2015-04-03 17:59 - 2015-04-03 17:59 - 00001909 _____ () C:\GUDownLoaddebug.txt

2015-04-03 17:59 - 2015-04-03 17:59 - 00001054 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk

2015-04-03 17:59 - 2015-04-03 17:59 - 00001042 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk

2015-04-03 17:59 - 2015-04-03 17:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5

2015-04-03 17:58 - 2015-04-03 17:58 - 04737952 _____ () C:\Users\Holger Carlson\Documents\ausetup.exe

2015-04-03 13:06 - 2015-04-03 13:06 - 00000000 ____D () C:\Program Files\DIFX

2015-04-03 13:04 - 2015-04-03 13:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My NPS Files

2015-04-03 12:54 - 2015-04-03 12:54 - 00003050 _____ () C:\Windows\System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F}

2015-04-03 12:50 - 2015-04-03 12:55 - 00001103 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\MindManager Viewer 2002.lnk

2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MindManager 2002

2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\Program Files (x86)\Mindjet

2015-04-02 13:02 - 2015-04-02 13:02 - 00000000 ____D () C:\Users\Holger Carlson\Documents\TomTom

2015-03-29 13:32 - 2015-03-29 13:33 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\CANON INC

2015-03-29 13:14 - 2015-04-07 23:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-03-28 11:32 - 2015-03-28 11:32 - 00013703 _____ () C:\Users\Holger Carlson\Documents\~WRD3122.tmp

2015-03-26 19:35 - 2015-03-26 19:35 - 00015595 _____ () C:\Users\Holger Carlson\Documents\Hapimag.htm

2015-03-25 08:28 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-03-25 08:28 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-03-25 08:28 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-03-25 08:28 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-03-25 08:28 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2015-03-25 08:28 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2015-03-25 08:28 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2015-03-25 08:28 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-03-24 10:56 - 2015-03-24 10:56 - 00221029 _____ () C:\Users\Holger Carlson\Documents\ohne tan.xps

2015-03-17 20:28 - 2015-03-17 20:30 - 100632535 _____ (Igor Pavlov) C:\Users\Holger Carlson\Documents\firmware_eBook-Reader_3-0_v-eBR30_1.0.8_20120106.exe

2015-03-17 20:14 - 2015-03-18 19:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Kindle Content

2015-03-17 20:14 - 2015-03-17 20:14 - 00002276 _____ () C:\Users\Holger Carlson\Desktop\Kindle.lnk

2015-03-17 20:14 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2015-03-17 20:13 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Amazon

2015-03-17 20:12 - 2015-03-17 20:13 - 40891792 _____ (Amazon.com) C:\Users\Holger Carlson\Documents\KindleForPC-installer.exe

2015-03-17 00:47 - 2015-03-17 00:49 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Digital Editions

2015-03-17 00:47 - 2015-03-17 00:47 - 00002152 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.0.lnk

2015-03-17 00:47 - 2015-03-17 00:47 - 00002140 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 4.0.lnk

2015-03-17 00:46 - 2015-03-17 00:46 - 08132576 _____ (Adobe Systems Incorporated) C:\Users\Holger Carlson\Documents\ADE_4.0_Installer.exe

2015-03-17 00:32 - 2015-03-17 00:32 - 13245728 _____ () C:\Users\Holger Carlson\Documents\Update.exe

2015-03-12 15:10 - 2015-03-29 13:34 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-03-12 15:10 - 2015-03-12 15:10 - 00000000 ____D () C:\Users\Holger Carlson\Documents\alles was geschrieben wird

2015-03-11 17:04 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2015-03-11 17:04 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2015-03-11 17:04 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2015-03-11 17:04 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2015-03-11 17:04 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll

2015-03-11 17:04 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2015-03-11 17:04 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll

2015-03-11 17:04 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll

2015-03-11 17:04 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2015-03-11 17:04 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2015-03-11 17:04 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-03-11 17:04 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2015-03-11 17:04 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys

2015-03-11 17:04 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2015-03-11 17:04 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll

2015-03-11 17:04 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-03-11 17:04 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe

2015-03-11 17:04 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll

2015-03-11 17:04 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll

2015-03-11 17:04 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys

2015-03-11 17:04 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-03-11 17:04 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-03-11 17:04 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2015-03-11 17:04 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll

2015-03-11 17:04 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys

2015-03-11 17:04 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2015-03-11 17:04 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe

2015-03-11 17:04 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll

2015-03-11 17:03 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll

2015-03-11 17:03 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll

2015-03-11 17:03 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-03-11 17:03 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll

2015-03-11 17:03 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll

2015-03-11 17:03 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx

2015-03-11 17:03 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll

2015-03-11 17:03 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL

2015-03-11 17:03 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2015-03-11 17:03 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe

2015-03-11 17:03 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2015-03-11 17:03 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll

2015-03-11 17:03 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe

2015-03-11 17:03 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2015-03-11 17:03 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe

2015-03-11 17:03 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe

2015-03-11 17:03 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe

2015-03-11 17:03 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe

2015-03-11 17:03 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll

2015-03-11 17:03 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2015-03-11 17:03 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll

2015-03-11 17:03 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll

2015-03-11 17:03 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll

2015-03-11 17:03 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll

2015-03-11 17:03 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll

2015-03-11 17:03 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-03-11 17:03 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll

2015-03-11 17:03 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx

2015-03-11 17:03 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll

2015-03-11 17:03 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL

2015-03-11 17:03 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe

2015-03-11 17:03 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe

2015-03-11 17:03 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll

2015-03-11 17:03 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2015-03-11 17:02 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-03-11 17:02 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-03-11 17:02 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-03-11 17:02 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-03-11 17:02 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-03-11 17:02 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-03-11 17:02 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-03-11 17:02 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-03-11 17:02 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-03-11 17:02 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-03-11 17:02 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-03-11 17:02 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-03-11 17:02 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-03-11 17:02 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-03-11 17:02 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-03-11 17:02 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-03-11 17:02 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-03-11 17:02 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-03-11 17:02 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-03-11 17:02 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-03-11 17:02 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-03-11 17:02 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-03-11 17:02 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-03-11 17:02 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-03-11 17:02 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-03-11 17:02 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-03-11 17:02 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-03-11 17:02 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-03-11 17:02 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-03-11 17:02 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-03-11 17:02 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-03-11 17:02 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2015-03-11 17:02 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2015-03-11 17:02 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2015-03-11 17:02 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll

2015-03-11 17:02 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2015-03-11 17:02 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll

2015-03-11 17:02 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys

2015-03-11 17:02 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll

2015-03-11 17:02 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll

2015-03-11 17:01 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-03-11 17:01 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-03-11 17:01 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-03-11 17:01 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-03-11 17:01 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-03-11 17:01 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-03-11 17:01 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-03-11 17:01 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-03-11 17:01 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-03-11 17:01 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-03-11 17:01 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-03-11 17:01 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2015-03-11 17:01 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2015-03-11 17:01 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-03-11 17:01 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2015-03-11 17:01 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-03-11 17:01 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-03-11 17:01 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-03-11 17:01 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2015-03-11 17:01 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-03-11 17:01 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-03-11 17:01 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2015-03-11 17:01 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-03-11 17:01 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-03-11 17:01 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2015-03-11 17:01 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-03-11 17:01 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-03-11 17:01 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2015-03-11 17:01 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-03-11 17:01 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2015-03-11 17:01 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-03-11 17:01 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-03-11 17:01 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-03-11 17:01 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-03-11 17:01 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-03-11 17:01 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-03-11 17:01 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-03-11 17:01 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-03-11 17:01 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-03-11 17:01 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-03-11 17:01 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-03-11 17:01 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-03-11 17:01 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2015-03-11 17:01 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-03-11 17:01 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-03-11 17:01 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-03-11 17:01 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-03-11 17:01 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-03-11 17:01 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-03-11 17:01 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-03-11 17:01 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-03-11 17:01 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-03-11 17:01 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-03-11 17:01 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-03-11 17:01 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-03-11 17:01 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-03-11 17:01 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-03-11 16:56 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll

2015-03-11 16:56 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll

2015-03-10 18:22 - 2015-03-10 18:22 - 00001262 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk

2015-03-10 18:21 - 2015-03-10 18:21 - 00000000 ____D () C:\Program Files\paint.net

2015-03-10 18:20 - 2015-03-10 18:38 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\paint.net

2015-03-10 18:19 - 2015-03-10 18:19 - 06554872 _____ () C:\Users\Holger Carlson\Documents\paint.net.4.0.5.install.exe

2015-03-10 18:15 - 2015-03-10 18:15 - 00372688 _____ () C:\Users\Holger Carlson\Documents\paint.net.4.0.5.install_CB-DL-Manager.exe

2015-03-10 17:56 - 2015-03-10 17:56 - 00000000 ____D () C:\ebay1
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-08 15:04 - 2014-02-02 17:36 - 00000000 ____D () C:\FRST

2015-04-08 15:03 - 2012-01-25 17:34 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-04-08 15:00 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-04-08 15:00 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-04-08 14:57 - 2014-03-22 13:03 - 01212293 _____ () C:\Windows\WindowsUpdate.log

2015-04-08 14:57 - 2009-08-04 11:51 - 00734178 _____ () C:\Windows\system32\perfh007.dat

2015-04-08 14:57 - 2009-08-04 11:51 - 00158606 _____ () C:\Windows\system32\perfc007.dat

2015-04-08 14:57 - 2009-07-14 07:13 - 01701722 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-04-08 14:53 - 2014-08-12 16:34 - 00011202 _____ () C:\Windows\setupact.log

2015-04-08 14:53 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-04-08 10:11 - 2014-02-08 19:23 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-04-08 00:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2015-04-08 00:16 - 2011-03-12 10:24 - 00045056 _____ () C:\Windows\system32\acovcnt.exe

2015-04-08 00:15 - 2014-08-15 08:33 - 00825176 _____ () C:\Windows\PFRO.log

2015-04-08 00:13 - 2014-05-13 11:11 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%

2015-04-07 23:37 - 2015-01-30 17:35 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-04-07 18:59 - 2014-11-21 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Driver Updater

2015-04-07 18:59 - 2011-03-26 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WritePro

2015-04-07 18:32 - 2010-10-08 20:33 - 00000000 ____D () C:\Program Files (x86)\Google

2015-04-06 18:33 - 2011-02-13 19:44 - 00013030 _____ () C:\Windows\PDOXUSRS.NET

2015-04-06 18:12 - 2014-02-08 19:23 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-04-06 18:12 - 2013-08-18 17:45 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-04-06 18:12 - 2013-08-18 17:45 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-04-06 18:02 - 2011-02-11 13:02 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Google

2015-04-06 17:51 - 2012-04-03 12:21 - 00000000 ____D () C:\ProgramData\AVAST Software

2015-04-06 11:31 - 2015-01-20 11:53 - 00000975 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-04-06 09:48 - 2011-04-15 19:24 - 00014848 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-04-05 10:43 - 2012-09-04 17:54 - 00006144 ____H () C:\Users\Holger Carlson\Documents\photothumb.db

2015-04-05 10:09 - 2010-10-08 21:00 - 00004200 _____ () C:\Windows\system32\AutoRunFilter.ini

2015-04-05 09:53 - 2015-01-30 16:55 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\dlg

2015-04-03 19:08 - 2013-09-28 13:18 - 00000000 ____D () C:\backup

2015-04-03 18:43 - 2014-08-19 14:14 - 00001564 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Buchliebhaber.lnk

2015-04-03 18:43 - 2011-02-13 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Buchliebhaber

2015-04-03 18:42 - 2011-02-15 14:16 - 00000000 ____D () C:\ProgramData\Paradox

2015-04-03 17:59 - 2014-07-24 19:21 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\GlarySoft

2015-04-03 17:59 - 2014-07-24 19:20 - 00001232 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk

2015-04-03 17:59 - 2014-07-24 19:20 - 00001220 _____ () C:\Users\Public\Desktop\Absolute Uninstaller.lnk

2015-04-03 13:42 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD

2015-04-03 13:35 - 2011-09-06 09:09 - 00000000 ____D () C:\Program Files (x86)\Samsung

2015-04-03 13:34 - 2015-02-11 18:19 - 00024652 _____ () C:\Windows\DPINST.LOG

2015-04-03 13:04 - 2011-09-06 09:10 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Samsung

2015-04-03 13:04 - 2010-10-08 20:22 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2015-03-26 13:16 - 2014-09-09 16:34 - 00000000 ____D () C:\Buchliebhaber

2015-03-26 12:06 - 2010-10-08 21:00 - 00002391 _____ () C:\Windows\system32\ServiceFilter.ini

2015-03-26 12:01 - 2014-12-12 15:04 - 00000000 ____D () C:\Windows\system32\appraiser

2015-03-26 12:01 - 2014-07-25 16:01 - 00525312 _____ () C:\Users\Holger Carlson\Documents\Outlook.pst

2015-03-26 12:01 - 2014-05-08 09:46 - 00000000 ___SD () C:\Windows\system32\CompatTel

2015-03-24 19:37 - 2014-02-08 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung

2015-03-24 12:27 - 2015-02-27 11:16 - 00000348 _____ () C:\Windows\Tasks\0215tbUpdateInfo.job

2015-03-24 12:27 - 2015-02-27 11:16 - 00000000 ____D () C:\ProgramData\Avg_Update_0215tb

2015-03-24 10:54 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

2015-03-23 11:39 - 2015-02-09 11:33 - 00000000 ____D () C:\Program Files (x86)\AVG Web TuneUp

2015-03-17 00:49 - 2011-02-11 13:08 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Adobe

2015-03-17 00:47 - 2012-11-17 20:50 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Adobe_Systems_Incorporate

2015-03-17 00:47 - 2012-01-03 16:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe

2015-03-17 00:47 - 2010-10-08 20:32 - 00000000 ____D () C:\Program Files (x86)\Adobe

2015-03-15 16:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2015-03-12 14:37 - 2014-07-12 21:31 - 00424968 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-03-12 14:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism

2015-03-12 14:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism

2015-03-12 14:02 - 2011-02-11 17:52 - 00000000 ____D () C:\ProgramData\Microsoft Help

2015-03-12 14:02 - 2009-07-14 04:34 - 00000639 _____ () C:\Windows\win.ini

2015-03-12 13:51 - 2013-08-16 23:52 - 00000000 ____D () C:\Windows\system32\MRT

2015-03-12 13:46 - 2011-07-01 21:34 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
 

==================== Files in the root of some directories =======
 

2013-12-03 17:59 - 2013-12-03 17:59 - 23288584 _____ (Mozilla) C:\Program Files\Firefox_Setup [1].exe

2014-07-13 19:39 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch (1).exe

2014-07-13 19:38 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch.exe

2007-06-12 18:34 - 2007-06-12 18:34 - 0035822 _____ () C:\Program Files (x86)\Common Files\ASPG_icon.ico

2008-05-22 17:35 - 2008-05-22 17:35 - 0051962 _____ () C:\Program Files (x86)\Common Files\banner.jpg

2009-04-08 19:31 - 2009-04-08 19:31 - 0106496 _____ () C:\Program Files (x86)\Common Files\CPInstallAction.dll

2008-08-12 06:45 - 2008-08-12 06:45 - 0155648 _____ (ASUS) C:\Program Files (x86)\Common Files\MSIactionall.dll

2013-12-19 10:19 - 2014-01-10 11:59 - 0000102 _____ () C:\Users\Holger Carlson\AppData\Roaming\WB.CFG

2011-04-15 19:24 - 2015-04-06 09:48 - 0014848 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-01-31 20:19 - 2015-02-01 12:37 - 0000025 _____ () C:\Users\Holger Carlson\AppData\Local\gt-props

2014-02-10 18:03 - 2014-02-10 18:03 - 0001679 _____ () C:\Users\Holger Carlson\AppData\Local\recently-used.xbel

2012-04-27 10:44 - 2012-04-27 10:44 - 0000017 _____ () C:\Users\Holger Carlson\AppData\Local\resmon.resmoncfg

2014-12-04 13:47 - 2014-12-04 13:47 - 0000000 _____ () C:\Users\Holger Carlson\AppData\Local\{C0180386-8014-4674-B1B2-C6CB0EB6F63F}

2011-02-21 18:31 - 2011-02-21 18:31 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

2015-01-17 18:18 - 2015-01-17 18:18 - 0005045 _____ () C:\ProgramData\wmzddnmb.cix
 

Files to move or delete:

====================

C:\Users\Holger Carlson\Firefox Setup Stub 33.0.2.exe
 
 

Some content of TEMP:

====================

C:\Users\Holger Carlson\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-04-05 11:03
 

==================== End Of Log ============================

--- --- ---
AdwCleaner Logfile:

Code:

# AdwCleaner v4.200 - Bericht erstellt 07/04/2015 um 12:44:27

# Aktualisiert 29/03/2015 von Xplode

# Datenbank : 2015-04-06.3 [Server]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)

# Benutzername : Holger Carlson - FRIDOLIN

# Gestarted von : C:\Users\Holger Carlson\Documents\adwcleaner_4.200.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Geplante Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\reimagerepair
 

***** [ Internetbrowser ] *****
 

-\\ Internet Explorer v11.0.9600.17689
 
 

-\\ Mozilla Firefox v37.0.1 (x86 de)
 
 

-\\ Google Chrome v41.0.2272.118
 
 

-\\ Opera v0.0.0.0
 
 

*************************
 

AdwCleaner[R4].txt - [9263 Bytes] - [06/04/2015 11:28:16]

AdwCleaner[R5].txt - [994 Bytes] - [06/04/2015 11:51:41]

AdwCleaner[R6].txt - [1157 Bytes] - [07/04/2015 12:42:05]

AdwCleaner[S2].txt - [8624 Bytes] - [06/04/2015 11:31:41]

AdwCleaner[S3].txt - [1022 Bytes] - [07/04/2015 12:44:27]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1081  Bytes] ##########

--- --- ---
AdwCleaner Logfile:

Code:

# AdwCleaner v4.200 - Bericht erstellt 06/04/2015 um 11:31:41

# Aktualisiert 29/03/2015 von Xplode

# Datenbank : 2015-03-29.1 [Server]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)

# Benutzername : Holger Carlson - FRIDOLIN

# Gestarted von : C:\Users\Holger Carlson\Documents\alles was geschrieben wird\Downloads\adwcleaner_4.200.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

[#] Dienst Gelöscht : IHProtect Service

[#] Dienst Gelöscht : WindowsMangerProtect

[#] Dienst Gelöscht : vToolbarUpdater18.4.0
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\AVG Secure Search

Ordner Gelöscht : C:\ProgramData\AVG Security Toolbar

Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect

Ordner Gelöscht : C:\ProgramData\IHProtectUpDate

Ordner Gelöscht : C:\ProgramData\e6ad6c22000030b3

Ordner Gelöscht : C:\Program Files (x86)\XTab

Ordner Gelöscht : C:\Program Files (x86)\Common Files\AVG Secure Search

Ordner Gelöscht : C:\Users\Holger Carlson\AppData\Roaming\istartsurf

Ordner Gelöscht : C:\Users\Holger Carlson\Documents\Optimizer Pro

Datei Gelöscht : C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml

Datei Gelöscht : C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\user.js
 

***** [ Geplante Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 

Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

Verknüpfung Desinfiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Verknüpfung Desinfiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

Verknüpfung Desinfiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

Verknüpfung Desinfiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk

Verknüpfung Desinfiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine

Schlüssel Gelöscht : HKLM\SOFTWARE\b2653df3-3c30-976c-1931-a2cc61ebdd00

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}

Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Schlüssel Gelöscht : HKCU\Software\Optimizer Pro

Schlüssel Gelöscht : HKCU\Software\DriverTuner_Init

Schlüssel Gelöscht : HKCU\Software\DriverTuner

Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp
 

***** [ Internetbrowser ] *****
 

-\\ Internet Explorer v11.0.9600.17689
 
 

-\\ Mozilla Firefox v36.0.4 (x86 de)
 

[ekdrwrk5.default\prefs.js] - Zeile Gelöscht : user_pref("Zapp_24069.global.CurrentSearchEngineSelection", "US: United States of America");

[ekdrwrk5.default\prefs.js] - Zeile Gelöscht : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");

[ekdrwrk5.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "istartsurf");

[ekdrwrk5.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.enable_search1", false);

[ekdrwrk5.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
 

-\\ Opera v0.0.0.0
 
 

*************************
 

AdwCleaner[R4].txt - [9263 Bytes] - [06/04/2015 11:28:16]

AdwCleaner[S2].txt - [8441 Bytes] - [06/04/2015 11:31:41]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [8500  Bytes] ##########

--- --- ---
AdwCleaner Logfile:

Code:

# AdwCleaner v4.200 - Bericht erstellt 06/04/2015 um 11:51:41

# Aktualisiert 29/03/2015 von Xplode

# Datenbank : 2015-03-29.1 [Server]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)

# Benutzername : Holger Carlson - FRIDOLIN

# Gestarted von : C:\Users\Holger Carlson\Documents\alles was geschrieben wird\Downloads\adwcleaner_4.200(2).exe

# Option : Suchlauf
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Geplante Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Internetbrowser ] *****
 

-\\ Internet Explorer v11.0.9600.17689
 
 

-\\ Mozilla Firefox v36.0.4 (x86 de)
 
 

-\\ Opera v0.0.0.0
 
 

*************************
 

AdwCleaner[R4].txt - [9263 Bytes] - [06/04/2015 11:28:16]

AdwCleaner[R5].txt - [799 Bytes] - [06/04/2015 11:51:41]

AdwCleaner[S2].txt - [8624 Bytes] - [06/04/2015 11:31:41]
 

########## EOF - C:\AdwCleaner\AdwCleaner[R5].txt - [916 Bytes] ##########

--- --- ---
AdwCleaner Logfile:

Code:

# AdwCleaner v4.200 - Bericht erstellt 06/04/2015 um 11:28:16

# Aktualisiert 29/03/2015 von Xplode

# Datenbank : 2015-03-29.1 [Server]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)

# Benutzername : Holger Carlson - FRIDOLIN

# Gestarted von : C:\Users\Holger Carlson\Documents\alles was geschrieben wird\Downloads\adwcleaner_4.200.exe

# Option : Suchlauf
 

***** [ Dienste ] *****
 

Dienst Gefunden : IHProtect Service

Dienst Gefunden : WindowsMangerProtect

Dienst Gefunden : vToolbarUpdater18.4.0
 

***** [ Dateien / Ordner ] *****
 

Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml

Datei Gefunden : C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\user.js

Datei Gefunden : C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb

Ordner Gefunden : C:\Program Files (x86)\Common Files\AVG Secure Search

Ordner Gefunden : C:\Program Files (x86)\XTab

Ordner Gefunden : C:\ProgramData\AVG Secure Search

Ordner Gefunden : C:\ProgramData\AVG Security Toolbar

Ordner Gefunden : C:\ProgramData\e6ad6c22000030b3

Ordner Gefunden : C:\ProgramData\IHProtectUpDate

Ordner Gefunden : C:\ProgramData\WindowsMangerProtect

Ordner Gefunden : C:\Users\Holger Carlson\AppData\Roaming\istartsurf

Ordner Gefunden : C:\Users\Holger Carlson\Documents\Optimizer Pro
 

***** [ Geplante Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 

Verknüpfung Infiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

Verknüpfung Infiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Verknüpfung Infiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

Verknüpfung Infiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

Verknüpfung Infiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk

Verknüpfung Infiziert : C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gefunden : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gefunden : HKCU\Software\DriverTuner

Schlüssel Gefunden : HKCU\Software\DriverTuner_Init

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}

Schlüssel Gefunden : HKCU\Software\Optimizer Pro

Schlüssel Gefunden : [x64] HKCU\Software\DriverTuner

Schlüssel Gefunden : [x64] HKCU\Software\DriverTuner_Init

Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}

Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}

Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}

Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}

Schlüssel Gefunden : [x64] HKCU\Software\Optimizer Pro

Schlüssel Gefunden : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gefunden : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Schlüssel Gefunden : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

Schlüssel Gefunden : HKLM\SOFTWARE\b2653df3-3c30-976c-1931-a2cc61ebdd00

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\S

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Schlüssel Gefunden : HKLM\SOFTWARE\SupDp

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}

Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
 

***** [ Internetbrowser ] *****
 

-\\ Internet Explorer v11.0.9600.17689
 
 

-\\ Mozilla Firefox v36.0.4 (x86 de)
 

[ekdrwrk5.default] - Zeile Gefunden : user_pref("Zapp_24069.global.CurrentSearchEngineSelection", "US: United States of America");

[ekdrwrk5.default] - Zeile Gefunden : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");

[ekdrwrk5.default] - Zeile Gefunden : user_pref("browser.search.selectedEngine", "istartsurf");

[ekdrwrk5.default] - Zeile Gefunden : user_pref("extensions.quick_start.enable_search1", false);

[ekdrwrk5.default] - Zeile Gefunden : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
 

-\\ Opera v0.0.0.0
 
 

*************************
 

AdwCleaner[R4].txt - [9053 Bytes] - [06/04/2015 11:28:16]
 

########## EOF - C:\AdwCleaner\AdwCleaner[R4].txt - [9112 Bytes] ##########

--- --- ---
[/CODE]

1. Schritt: Malwarebytes (MBAM)

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

ich habe Addition.txt nicht gefunden und weiß nicht ob das bei JRT richtig ist?

1. Schritt: MBAM

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 12.04.2015

Suchlauf-Zeit: 08:59:18

Logdatei: Ergebnisse Bedrohungssuchlauf.txt

Administrator: Ja
 

Version: 2.01.4.1018

Malware Datenbank: v2015.04.11.08

Rootkit Datenbank: v2015.03.31.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: Holger Carlson
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 418984

Verstrichene Zeit: 33 Min, 57 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Aktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(Keine schädliche Elemente gefunden)
 

Module: 0

(Keine schädliche Elemente gefunden)
 

Registrierungsschlüssel: 0

(Keine schädliche Elemente gefunden)
 

Registrierungswerte: 1

PUP.Optional.IStartSurf.A, HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|TopResultURL, hxxp://www.istartsurf.com/web/?type=ds&ts=1428220662&from=pcs&uid=ST9320325AS_6VD6MB83XXXX6VD6MB83&q={searchTerms}, , [9db74724f298e155549c4b078e777d83]
 

Registrierungsdaten: 0

(Keine schädliche Elemente gefunden)
 

Ordner: 0

(Keine schädliche Elemente gefunden)
 

Dateien: 1

PUP.Optional.Somoto.SID.A, C:\Users\Holger Carlson\Documents\OLIVETTI_downloader-QaZJ7date.exe, , [ca8ae58601891a1cdcaba09bac5a2dd3], 
 

Physische Sektoren: 0

(Keine schädliche Elemente gefunden)
 
 

(end)

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by Holger Carlson (administrator) on FRIDOLIN on 12-04-2015 12:53:40

Running from H:\

Loaded Profiles: Holger Carlson (Available profiles: Holger Carlson)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser not detected!)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1928976 2010-03-05] (Intel(R) Corporation)

HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-06] (Avast Software s.r.o.)

HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-08-12] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2015-03-30] (Glarysoft Ltd)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)

ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll ()

ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll ()

ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File

ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll ()

ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll ()

BootExecute: autocheck autochk *  

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.

ProxyServer: [.DEFAULT] => http=127.0.0.1:56939;https=127.0.0.1:56939

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01

SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}

SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP8803837A-1DA4-472E-BAE6-FF0BFD270EFC&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&q={searchTerms}

BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files\Windows Live\Family Safety\fssbho.dll [2008-12-08] (Microsoft Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-06] (Avast Software s.r.o.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-06] (Avast Software s.r.o.)

BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17] (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {534D542D-5637-006A-76A7-7A786E7484D7} -  No File

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

Tcpip\..\Interfaces\{42264728-0917-4958-91BA-C18941410592}: [NameServer] 0.0.0.0

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF ProfilePath: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default

FF SearchEngineOrder.1: Google (avast)

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-04-06] ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-04-06] ()

FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll [2008-10-15] (CANON INC.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2008-12-04] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\bing-avast.xml [2014-11-16]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-avast.xml [2015-02-01]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-images.xml [2014-10-14]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-maps.xml [2014-10-14]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\yahoo-avast.xml [2014-09-19]

FF Extension: Avira Browser Safety - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\abs@avira.com [2015-03-31]

FF Extension: WEB.DE MailCheck - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\toolbar@web.de [2015-04-05]

FF Extension: OkayFreedom - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\{DB981CCA-088E-4731-A4A2-2FE218703C0E}.xpi [2015-04-05]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-06]

FF HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 

Chrome: 

=======

CHR StartupUrls: Default -> "hxxp://www.google.com/"

CHR Profile: C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-06]

CHR Extension: (Google Docs) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-06]

CHR Extension: (Google Drive) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-06]

CHR Extension: (YouTube) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-06]

CHR Extension: (Google Search) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-06]

CHR Extension: (Google Sheets) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-06]

CHR Extension: (Avast Online Security) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-06]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-06]

CHR Extension: (Google Wallet) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-06]

CHR Extension: (Gmail) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-06]

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - No Path Or update_url value

CHR HKLM-x32\...\Chrome\Extension: [fknfdieimobmimhdkfkheeejenmdjhoe] - C:\Program Files (x86)\pandasecuritytb\chrome-newtab-search.crx [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-06]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 ADSMService; C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [File not signed]

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-06] (Avast Software s.r.o.)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)

R2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [File not signed]

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()

S3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-04-06] () [File not signed]

S2 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [File not signed]

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-23] ()

S2 TomTomHOMEService; "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-06] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-06] (Avast Software s.r.o.)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-06] (Avast Software s.r.o.)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-06] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-06] (Avast Software s.r.o.)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-06] (Avast Software s.r.o.)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-06] (Avast Software s.r.o.)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-06] ()

S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2014-11-14] ()

R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2015-04-03] (Glarysoft Ltd)

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()

S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA64.sys [649984 2009-09-01] (eMPIA Technology, Inc.) [File not signed]

S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM64.sys [626688 2009-09-02] (eMPIA Technology, Inc.) [File not signed]

S3 dgderdrv; System32\drivers\dgderdrv.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]

U3 tmlwf; No ImagePath

U3 tmwfp; No ImagePath
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-12 12:51 - 2015-04-12 12:51 - 00000634 _____ () C:\Users\Holger Carlson\Desktop\JRT.txt

2015-04-12 12:46 - 2015-04-12 12:46 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-FRIDOLIN-Windows-7-Home-Premium-(64-bit).dat

2015-04-12 12:46 - 2015-04-12 12:46 - 00000000 ____D () C:\RegBackup

2015-04-08 17:40 - 2015-04-08 17:40 - 00000000 ____D () C:\Users\Holger Carlson\Documents\ASUS

2015-04-07 18:57 - 2015-04-07 18:57 - 00000000 ____D () C:\ProgramData\GlarySoft

2015-04-07 18:44 - 2015-04-07 18:59 - 00000000 ___HD () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled

2015-04-07 18:43 - 2015-04-07 18:44 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup-Disabled

2015-04-06 18:57 - 2015-04-06 18:57 - 00001884 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk

2015-04-06 18:56 - 2015-04-06 18:56 - 00356232 _____ (Dropbox, Inc.) C:\Users\Public\Desktop\DropboxInstallerAvast.exe

2015-04-06 18:56 - 2015-04-06 17:55 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe

2015-04-06 18:01 - 2015-04-06 18:01 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\AVAST Software

2015-04-06 17:59 - 2015-04-06 23:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software

2015-04-06 17:59 - 2015-04-06 18:01 - 00002037 _____ () C:\Users\Public\Desktop\Avast Premier.lnk

2015-04-06 17:59 - 2015-04-06 17:59 - 00001944 _____ () C:\Users\Public\Desktop\Avast SafeZone.lnk

2015-04-06 17:58 - 2015-04-12 08:58 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2015-04-06 17:56 - 2015-04-06 17:55 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2015-04-06 17:56 - 2015-04-06 17:55 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2015-04-06 17:55 - 2015-04-06 17:55 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr

2015-04-06 17:52 - 2015-04-06 17:52 - 00000000 ____D () C:\Program Files\AVAST Software

2015-04-06 17:11 - 2015-04-06 17:11 - 00000000 ____D () C:\Olivetti

2015-04-06 11:28 - 2015-04-07 12:44 - 00000000 ____D () C:\AdwCleaner

2015-04-06 10:27 - 2015-04-11 15:04 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\CrashDumps

2015-04-05 09:52 - 2015-04-05 10:03 - 00000000 ____D () C:\ProgramData\Informer Technologies, Inc

2015-04-05 09:51 - 2015-04-05 09:51 - 03568824 _____ (Informer Technologies, Inc. ) C:\Users\Holger Carlson\Documents\siinst.exe

2015-04-05 09:45 - 2015-04-06 09:42 - 00000000 ____D () C:\ProgramData\{95f4c13f-5638-faae-95f4-4c13f56304fd}

2015-04-05 09:45 - 2015-04-05 09:45 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Drivers et Pilotes

2015-04-05 09:44 - 2015-04-05 10:03 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos

2015-04-05 09:44 - 2015-04-05 09:44 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos VPN

2015-04-05 09:23 - 2015-04-05 09:24 - 00000000 ___SD () C:\Windows\system32\GWX

2015-04-05 09:23 - 2015-04-05 09:23 - 00000000 ___SD () C:\Windows\SysWOW64\GWX

2015-04-04 17:35 - 2015-04-04 17:36 - 00000000 ____D () C:\Users\Holger Carlson\Documents\Wondershare Video Editor

2015-04-03 19:25 - 2015-04-03 19:25 - 00002950 _____ () C:\Windows\System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8}

2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB}

2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D}

2015-04-03 18:43 - 2015-04-03 18:43 - 00001534 _____ () C:\Users\Holger Carlson\Desktop\Buchliebhaber.lnk

2015-04-03 18:42 - 2015-04-03 18:43 - 00000000 ____D () C:\Buchliebhaber1

2015-04-03 18:12 - 2015-04-03 18:12 - 00003050 _____ () C:\Windows\System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E}

2015-04-03 17:59 - 2015-04-12 11:51 - 00000352 _____ () C:\Windows\Tasks\GlaryInitialize 5.job

2015-04-03 17:59 - 2015-04-12 11:50 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5

2015-04-03 17:59 - 2015-04-03 17:59 - 00020160 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys

2015-04-03 17:59 - 2015-04-03 17:59 - 00002990 _____ () C:\Windows\System32\Tasks\GU5SkipUAC

2015-04-03 17:59 - 2015-04-03 17:59 - 00002666 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5

2015-04-03 17:59 - 2015-04-03 17:59 - 00001909 _____ () C:\GUDownLoaddebug.txt

2015-04-03 17:59 - 2015-04-03 17:59 - 00001054 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk

2015-04-03 17:59 - 2015-04-03 17:59 - 00001042 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk

2015-04-03 17:59 - 2015-04-03 17:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5

2015-04-03 17:58 - 2015-04-03 17:58 - 04737952 _____ () C:\Users\Holger Carlson\Documents\ausetup.exe

2015-04-03 13:06 - 2015-04-03 13:06 - 00000000 ____D () C:\Program Files\DIFX

2015-04-03 13:04 - 2015-04-03 13:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My NPS Files

2015-04-03 12:54 - 2015-04-03 12:54 - 00003050 _____ () C:\Windows\System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F}

2015-04-03 12:50 - 2015-04-03 12:55 - 00001103 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\MindManager Viewer 2002.lnk

2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MindManager 2002

2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\Program Files (x86)\Mindjet

2015-04-02 13:02 - 2015-04-02 13:02 - 00000000 ____D () C:\Users\Holger Carlson\Documents\TomTom

2015-03-29 13:32 - 2015-03-29 13:33 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\CANON INC

2015-03-29 13:14 - 2015-04-07 23:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-03-28 11:32 - 2015-03-28 11:32 - 00013703 _____ () C:\Users\Holger Carlson\Documents\~WRD3122.tmp

2015-03-26 19:35 - 2015-03-26 19:35 - 00015595 _____ () C:\Users\Holger Carlson\Documents\Hapimag.htm

2015-03-25 08:28 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-03-25 08:28 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-03-25 08:28 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-03-25 08:28 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-03-25 08:28 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2015-03-25 08:28 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2015-03-25 08:28 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2015-03-25 08:28 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-03-24 10:56 - 2015-03-24 10:56 - 00221029 _____ () C:\Users\Holger Carlson\Documents\ohne tan.xps

2015-03-17 20:28 - 2015-03-17 20:30 - 100632535 _____ (Igor Pavlov) C:\Users\Holger Carlson\Documents\firmware_eBook-Reader_3-0_v-eBR30_1.0.8_20120106.exe

2015-03-17 20:14 - 2015-03-18 19:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Kindle Content

2015-03-17 20:14 - 2015-03-17 20:14 - 00002276 _____ () C:\Users\Holger Carlson\Desktop\Kindle.lnk

2015-03-17 20:14 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2015-03-17 20:13 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Amazon

2015-03-17 20:12 - 2015-03-17 20:13 - 40891792 _____ (Amazon.com) C:\Users\Holger Carlson\Documents\KindleForPC-installer.exe

2015-03-17 00:47 - 2015-03-17 00:49 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Digital Editions

2015-03-17 00:47 - 2015-03-17 00:47 - 00002152 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.0.lnk

2015-03-17 00:47 - 2015-03-17 00:47 - 00002140 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 4.0.lnk

2015-03-17 00:46 - 2015-03-17 00:46 - 08132576 _____ (Adobe Systems Incorporated) C:\Users\Holger Carlson\Documents\ADE_4.0_Installer.exe

2015-03-17 00:32 - 2015-03-17 00:32 - 13245728 _____ () C:\Users\Holger Carlson\Documents\Update.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-12 12:53 - 2014-02-02 17:36 - 00000000 ____D () C:\FRST

2015-04-12 12:53 - 2009-08-04 11:51 - 00734178 _____ () C:\Windows\system32\perfh007.dat

2015-04-12 12:53 - 2009-08-04 11:51 - 00158606 _____ () C:\Windows\system32\perfc007.dat

2015-04-12 12:53 - 2009-07-14 07:13 - 01701722 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-04-12 12:47 - 2012-01-25 17:34 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-04-12 12:11 - 2014-02-08 19:23 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-04-12 12:00 - 2015-01-30 17:35 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-04-12 11:56 - 2014-03-22 13:03 - 01320131 _____ () C:\Windows\WindowsUpdate.log

2015-04-12 11:56 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-04-12 11:56 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-04-12 11:49 - 2014-08-15 08:33 - 00826178 _____ () C:\Windows\PFRO.log

2015-04-12 11:49 - 2014-08-12 16:34 - 00011314 _____ () C:\Windows\setupact.log

2015-04-12 11:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-04-11 19:46 - 2014-07-24 19:21 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\GlarySoft

2015-04-11 19:24 - 2012-09-04 17:54 - 00006144 ____H () C:\Users\Holger Carlson\Documents\photothumb.db

2015-04-11 19:14 - 2011-04-15 19:24 - 00015360 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-04-08 15:47 - 2013-03-03 13:04 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Deployment

2015-04-08 15:23 - 2015-01-30 17:34 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-04-08 15:23 - 2015-01-30 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-04-08 15:23 - 2015-01-30 17:34 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-04-08 00:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2015-04-08 00:16 - 2011-03-12 10:24 - 00045056 _____ () C:\Windows\system32\acovcnt.exe

2015-04-08 00:13 - 2014-05-13 11:11 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%

2015-04-07 18:59 - 2014-11-21 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Driver Updater

2015-04-07 18:59 - 2011-03-26 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WritePro

2015-04-07 18:32 - 2010-10-08 20:33 - 00000000 ____D () C:\Program Files (x86)\Google

2015-04-06 18:33 - 2011-02-13 19:44 - 00013030 _____ () C:\Windows\PDOXUSRS.NET

2015-04-06 18:12 - 2014-02-08 19:23 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-04-06 18:12 - 2013-08-18 17:45 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-04-06 18:12 - 2013-08-18 17:45 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-04-06 18:02 - 2011-02-11 13:02 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Google

2015-04-06 17:51 - 2012-04-03 12:21 - 00000000 ____D () C:\ProgramData\AVAST Software

2015-04-06 11:31 - 2015-01-20 11:53 - 00000975 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-04-05 10:09 - 2010-10-08 21:00 - 00004200 _____ () C:\Windows\system32\AutoRunFilter.ini

2015-04-05 09:53 - 2015-01-30 16:55 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\dlg

2015-04-03 19:08 - 2013-09-28 13:18 - 00000000 ____D () C:\backup

2015-04-03 18:43 - 2014-08-19 14:14 - 00001564 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Buchliebhaber.lnk

2015-04-03 18:43 - 2011-02-13 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Buchliebhaber

2015-04-03 18:42 - 2011-02-15 14:16 - 00000000 ____D () C:\ProgramData\Paradox

2015-04-03 17:59 - 2014-07-24 19:20 - 00001232 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk

2015-04-03 17:59 - 2014-07-24 19:20 - 00001220 _____ () C:\Users\Public\Desktop\Absolute Uninstaller.lnk

2015-04-03 13:42 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD

2015-04-03 13:35 - 2011-09-06 09:09 - 00000000 ____D () C:\Program Files (x86)\Samsung

2015-04-03 13:34 - 2015-02-11 18:19 - 00024652 _____ () C:\Windows\DPINST.LOG

2015-04-03 13:04 - 2011-09-06 09:10 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Samsung

2015-04-03 13:04 - 2010-10-08 20:22 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2015-03-29 13:34 - 2015-03-12 15:10 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-03-26 13:16 - 2014-09-09 16:34 - 00000000 ____D () C:\Buchliebhaber

2015-03-26 12:06 - 2010-10-08 21:00 - 00002391 _____ () C:\Windows\system32\ServiceFilter.ini

2015-03-26 12:01 - 2014-12-12 15:04 - 00000000 ____D () C:\Windows\system32\appraiser

2015-03-26 12:01 - 2014-07-25 16:01 - 00525312 _____ () C:\Users\Holger Carlson\Documents\Outlook.pst

2015-03-26 12:01 - 2014-05-08 09:46 - 00000000 ___SD () C:\Windows\system32\CompatTel

2015-03-24 19:37 - 2014-02-08 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung

2015-03-24 12:27 - 2015-02-27 11:16 - 00000348 _____ () C:\Windows\Tasks\0215tbUpdateInfo.job

2015-03-24 12:27 - 2015-02-27 11:16 - 00000000 ____D () C:\ProgramData\Avg_Update_0215tb

2015-03-24 10:54 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

2015-03-23 11:39 - 2015-02-09 11:33 - 00000000 ____D () C:\Program Files (x86)\AVG Web TuneUp

2015-03-17 06:15 - 2015-01-30 17:34 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-03-17 06:15 - 2015-01-30 17:34 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-03-17 06:15 - 2015-01-30 17:34 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-03-17 00:49 - 2011-02-11 13:08 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Adobe

2015-03-17 00:47 - 2012-11-17 20:50 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Adobe_Systems_Incorporate

2015-03-17 00:47 - 2012-01-03 16:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe

2015-03-17 00:47 - 2010-10-08 20:32 - 00000000 ____D () C:\Program Files (x86)\Adobe

2015-03-15 16:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
 

==================== Files in the root of some directories =======
 

2013-12-03 17:59 - 2013-12-03 17:59 - 23288584 _____ (Mozilla) C:\Program Files\Firefox_Setup [1].exe

2014-07-13 19:39 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch (1).exe

2014-07-13 19:38 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch.exe

2007-06-12 18:34 - 2007-06-12 18:34 - 0035822 _____ () C:\Program Files (x86)\Common Files\ASPG_icon.ico

2008-05-22 17:35 - 2008-05-22 17:35 - 0051962 _____ () C:\Program Files (x86)\Common Files\banner.jpg

2009-04-08 19:31 - 2009-04-08 19:31 - 0106496 _____ () C:\Program Files (x86)\Common Files\CPInstallAction.dll

2008-08-12 06:45 - 2008-08-12 06:45 - 0155648 _____ (ASUS) C:\Program Files (x86)\Common Files\MSIactionall.dll

2013-12-19 10:19 - 2014-01-10 11:59 - 0000102 _____ () C:\Users\Holger Carlson\AppData\Roaming\WB.CFG

2011-04-15 19:24 - 2015-04-11 19:14 - 0015360 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-01-31 20:19 - 2015-02-01 12:37 - 0000025 _____ () C:\Users\Holger Carlson\AppData\Local\gt-props

2014-02-10 18:03 - 2014-02-10 18:03 - 0001679 _____ () C:\Users\Holger Carlson\AppData\Local\recently-used.xbel

2012-04-27 10:44 - 2012-04-27 10:44 - 0000017 _____ () C:\Users\Holger Carlson\AppData\Local\resmon.resmoncfg

2014-12-04 13:47 - 2014-12-04 13:47 - 0000000 _____ () C:\Users\Holger Carlson\AppData\Local\{C0180386-8014-4674-B1B2-C6CB0EB6F63F}

2011-02-21 18:31 - 2011-02-21 18:31 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

2015-01-17 18:18 - 2015-01-17 18:18 - 0005045 _____ () C:\ProgramData\wmzddnmb.cix
 

Files to move or delete:

====================

C:\Users\Holger Carlson\Firefox Setup Stub 33.0.2.exe
 
 

Some content of TEMP:

====================

C:\Users\Holger Carlson\AppData\Local\Temp\avgnt.exe

C:\Users\Holger Carlson\AppData\Local\Temp\Quarantine.exe

C:\Users\Holger Carlson\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-04-05 11:03
 

==================== End Of Log ============================

--- --- ---

--- --- ---

2. Schritt JRM

JRT

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.5.3 (04.07.2015:1)

OS: Windows 7 Home Premium x64

Ran by Holger Carlson on 12.04.2015 at 12:46:17,20

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 12.04.2015 at 12:51:09,06

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Zukünftig bitte beachten:

Zitat:

Running from H:\

Leider hast du unsere Anleitung nicht richtig befolgt:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind.
Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen.
Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter.

Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.

http://saved.im/mtg0mjy4yjlu/2014-04...ryscantool.png

:dankeschoen:

ich habe avast Free Antivirus + AVG Web TuneUp + Wondershare Video Editor+ Glary Utilities + Anti-Twin deinstalliert, weil auch mein letzter Browser :Internet Exporer, nicht mehr wollte.

Malewarebytes

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 13.04.2015

Suchlauf-Zeit: 09:57:54

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.01.4.1018

Malware Datenbank: v2015.04.13.03

Rootkit Datenbank: v2015.03.31.01

Lizenz: Testversion

Malware Schutz: Aktiviert

Bösartiger Webseiten Schutz: Aktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: Holger Carlson
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 417851

Verstrichene Zeit: 1 Std, 29 Min, 48 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Aktiviert

Heuristik: Aktiviert

PUP: Warnen

PUM: Warnen
 

Prozesse: 0

(Keine schädliche Elemente gefunden)
 

Module: 0

(Keine schädliche Elemente gefunden)
 

Registrierungsschlüssel: 0

(Keine schädliche Elemente gefunden)
 

Registrierungswerte: 0

(Keine schädliche Elemente gefunden)
 

Registrierungsdaten: 0

(Keine schädliche Elemente gefunden)
 

Ordner: 3

PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 

PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI\Installr, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 

PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI\Installr\2.bin, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 
 

Dateien: 3

PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI\Installr\2.bin\8hEIPlug.dll, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 

PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI\Installr\2.bin\8hEZSETP.dll, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 

PUP.Optional.MindSpark.A, C:\Program Files (x86)\Allin1Convert_8hEI\Installr\2.bin\NP8hEISb.dll, In Quarantäne, [8b8c303c90faae8815c710804ab93ec2], 
 

Physische Sektoren: 0

(Keine schädliche Elemente gefunden)
 
 

(end)

JRT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.3 (04.07.2015:1)
OS: Windows 7 Home Premium x64
Ran by Holger Carlson on 13.04.2015 at 11:52:12,27
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.04.2015 at 11:56:50,25
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST
FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-04-2015

Ran by Holger Carlson (administrator) on FRIDOLIN on 13-04-2015 12:00:27

Running from C:\Users\Holger Carlson\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XF329JBY

Loaded Profiles: Holger Carlson (Available profiles: Holger Carlson)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser not detected!)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1928976 2010-03-05] (Intel(R) Corporation)

HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-08-12] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll ()

ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll ()

ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File

ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll ()

ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll ()

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.

ProxyServer: [.DEFAULT] => http=127.0.0.1:56939;https=127.0.0.1:56939

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01

SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}

SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP8803837A-1DA4-472E-BAE6-FF0BFD270EFC&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&q={searchTerms}

BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files\Windows Live\Family Safety\fssbho.dll [2008-12-08] (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17] (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {534D542D-5637-006A-76A7-7A786E7484D7} -  No File

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

Tcpip\..\Interfaces\{42264728-0917-4958-91BA-C18941410592}: [NameServer] 0.0.0.0

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF ProfilePath: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default

FF SearchEngineOrder.1: Google (avast)

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-04-06] ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-04-06] ()

FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll [2008-10-15] (CANON INC.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2008-12-04] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\bing-avast.xml [2014-11-16]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-avast.xml [2015-02-01]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-images.xml [2014-10-14]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\google-maps.xml [2014-10-14]

FF SearchPlugin: C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\searchplugins\yahoo-avast.xml [2014-09-19]

FF Extension: Avira Browser Safety - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\abs@avira.com [2015-03-31]

FF Extension: WEB.DE MailCheck - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\toolbar@web.de [2015-04-05]

FF Extension: OkayFreedom - C:\Users\Holger Carlson\AppData\Roaming\Mozilla\Firefox\Profiles\ekdrwrk5.default\Extensions\{DB981CCA-088E-4731-A4A2-2FE218703C0E}.xpi [2015-04-05]

FF HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [Not Found]

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 

Chrome: 

=======

CHR StartupUrls: Default -> "hxxp://www.google.com/"

CHR Profile: C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-06]

CHR Extension: (Google Docs) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-06]

CHR Extension: (Google Drive) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-06]

CHR Extension: (YouTube) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-06]

CHR Extension: (Google Search) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-06]

CHR Extension: (Google Sheets) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-06]

CHR Extension: (Avast Online Security) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-06]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-06]

CHR Extension: (Google Wallet) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-06]

CHR Extension: (Gmail) - C:\Users\Holger Carlson\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-06]

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - No Path Or update_url value

CHR HKLM-x32\...\Chrome\Extension: [fknfdieimobmimhdkfkheeejenmdjhoe] - C:\Program Files (x86)\pandasecuritytb\chrome-newtab-search.crx [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 ADSMService; C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [File not signed]

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)

R2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [File not signed]

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()

S3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-04-06] () [File not signed]

S2 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [File not signed]

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-23] ()

S2 TomTomHOMEService; "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2014-11-14] ()

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-13] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()

S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA64.sys [649984 2009-09-01] (eMPIA Technology, Inc.) [File not signed]

S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM64.sys [626688 2009-09-02] (eMPIA Technology, Inc.) [File not signed]

S3 dgderdrv; System32\drivers\dgderdrv.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]

U3 tmlwf; No ImagePath

U3 tmwfp; No ImagePath
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-13 12:00 - 2015-04-13 12:00 - 00000000 ____D () C:\FRST

2015-04-13 11:56 - 2015-04-13 11:56 - 00000634 _____ () C:\Users\Holger Carlson\Desktop\JRT.txt

2015-04-13 11:49 - 2015-04-13 11:49 - 00001981 _____ () C:\mbam.txt

2015-04-13 09:55 - 2015-04-13 11:47 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-04-13 09:54 - 2015-04-13 09:57 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-04-13 09:54 - 2015-04-13 09:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-04-13 09:54 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-04-13 09:54 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-04-13 09:54 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-04-12 13:41 - 2015-04-12 13:41 - 00003132 _____ () C:\Windows\System32\Tasks\{69024FA6-BE33-473D-B9A3-EE1A4D9E4625}

2015-04-12 12:46 - 2015-04-12 12:46 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-FRIDOLIN-Windows-7-Home-Premium-(64-bit).dat

2015-04-12 12:46 - 2015-04-12 12:46 - 00000000 ____D () C:\RegBackup

2015-04-08 17:40 - 2015-04-08 17:40 - 00000000 ____D () C:\Users\Holger Carlson\Documents\ASUS

2015-04-07 18:57 - 2015-04-13 09:45 - 00000000 ____D () C:\ProgramData\GlarySoft

2015-04-07 18:44 - 2015-04-07 18:59 - 00000000 ___HD () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled

2015-04-07 18:43 - 2015-04-07 18:44 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup-Disabled

2015-04-06 18:57 - 2015-04-06 18:57 - 00001884 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk

2015-04-06 18:56 - 2015-04-06 18:56 - 00356232 _____ (Dropbox, Inc.) C:\Users\Public\Desktop\DropboxInstallerAvast.exe

2015-04-06 17:59 - 2015-04-06 18:01 - 00002037 _____ () C:\Users\Public\Desktop\Avast Premier.lnk

2015-04-06 17:59 - 2015-04-06 17:59 - 00001944 _____ () C:\Users\Public\Desktop\Avast SafeZone.lnk

2015-04-06 17:11 - 2015-04-06 17:11 - 00000000 ____D () C:\Olivetti

2015-04-06 10:27 - 2015-04-12 18:55 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\CrashDumps

2015-04-05 09:52 - 2015-04-05 10:03 - 00000000 ____D () C:\ProgramData\Informer Technologies, Inc

2015-04-05 09:51 - 2015-04-05 09:51 - 03568824 _____ (Informer Technologies, Inc. ) C:\Users\Holger Carlson\Documents\siinst.exe

2015-04-05 09:45 - 2015-04-06 09:42 - 00000000 ____D () C:\ProgramData\{95f4c13f-5638-faae-95f4-4c13f56304fd}

2015-04-05 09:45 - 2015-04-05 09:45 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Drivers et Pilotes

2015-04-05 09:44 - 2015-04-05 10:03 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos

2015-04-05 09:44 - 2015-04-05 09:44 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Steganos VPN

2015-04-05 09:23 - 2015-04-05 09:24 - 00000000 ___SD () C:\Windows\system32\GWX

2015-04-05 09:23 - 2015-04-05 09:23 - 00000000 ___SD () C:\Windows\SysWOW64\GWX

2015-04-04 17:35 - 2015-04-04 17:36 - 00000000 ____D () C:\Users\Holger Carlson\Documents\Wondershare Video Editor

2015-04-03 19:25 - 2015-04-03 19:25 - 00002950 _____ () C:\Windows\System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8}

2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB}

2015-04-03 19:24 - 2015-04-03 19:24 - 00002950 _____ () C:\Windows\System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D}

2015-04-03 18:43 - 2015-04-03 18:43 - 00001534 _____ () C:\Users\Holger Carlson\Desktop\Buchliebhaber.lnk

2015-04-03 18:42 - 2015-04-03 18:43 - 00000000 ____D () C:\Buchliebhaber1

2015-04-03 18:12 - 2015-04-03 18:12 - 00003050 _____ () C:\Windows\System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E}

2015-04-03 17:58 - 2015-04-03 17:58 - 04737952 _____ () C:\Users\Holger Carlson\Documents\ausetup.exe

2015-04-03 13:06 - 2015-04-03 13:06 - 00000000 ____D () C:\Program Files\DIFX

2015-04-03 13:04 - 2015-04-03 13:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My NPS Files

2015-04-03 12:54 - 2015-04-03 12:54 - 00003050 _____ () C:\Windows\System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F}

2015-04-03 12:50 - 2015-04-03 12:55 - 00001103 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\MindManager Viewer 2002.lnk

2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MindManager 2002

2015-04-03 12:50 - 2015-04-03 12:50 - 00000000 ____D () C:\Program Files (x86)\Mindjet

2015-04-02 13:02 - 2015-04-02 13:02 - 00000000 ____D () C:\Users\Holger Carlson\Documents\TomTom

2015-03-29 13:32 - 2015-03-29 13:33 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\CANON INC

2015-03-29 13:14 - 2015-04-12 17:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-03-28 11:32 - 2015-03-28 11:32 - 00013703 _____ () C:\Users\Holger Carlson\Documents\~WRD3122.tmp

2015-03-26 19:35 - 2015-03-26 19:35 - 00015595 _____ () C:\Users\Holger Carlson\Documents\Hapimag.htm

2015-03-25 08:28 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-03-25 08:28 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-03-25 08:28 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-03-25 08:28 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-03-25 08:28 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2015-03-25 08:28 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2015-03-25 08:28 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2015-03-25 08:28 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-03-24 10:56 - 2015-03-24 10:56 - 00221029 _____ () C:\Users\Holger Carlson\Documents\ohne tan.xps

2015-03-17 20:28 - 2015-03-17 20:30 - 100632535 _____ (Igor Pavlov) C:\Users\Holger Carlson\Documents\firmware_eBook-Reader_3-0_v-eBR30_1.0.8_20120106.exe

2015-03-17 20:14 - 2015-03-18 19:04 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Kindle Content

2015-03-17 20:14 - 2015-03-17 20:14 - 00002276 _____ () C:\Users\Holger Carlson\Desktop\Kindle.lnk

2015-03-17 20:14 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon

2015-03-17 20:13 - 2015-03-17 20:14 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Amazon

2015-03-17 20:12 - 2015-03-17 20:13 - 40891792 _____ (Amazon.com) C:\Users\Holger Carlson\Documents\KindleForPC-installer.exe

2015-03-17 00:47 - 2015-03-17 00:49 - 00000000 ____D () C:\Users\Holger Carlson\Documents\My Digital Editions

2015-03-17 00:47 - 2015-03-17 00:47 - 00002152 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.0.lnk

2015-03-17 00:47 - 2015-03-17 00:47 - 00002140 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 4.0.lnk

2015-03-17 00:46 - 2015-03-17 00:46 - 08132576 _____ (Adobe Systems Incorporated) C:\Users\Holger Carlson\Documents\ADE_4.0_Installer.exe

2015-03-17 00:32 - 2015-03-17 00:32 - 13245728 _____ () C:\Users\Holger Carlson\Documents\Update.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-04-13 11:53 - 2014-03-22 13:03 - 01411689 _____ () C:\Windows\WindowsUpdate.log

2015-04-13 11:53 - 2012-01-25 17:34 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-04-13 11:53 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-04-13 11:53 - 2009-07-14 06:45 - 00018832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-04-13 11:51 - 2009-08-04 11:51 - 00734178 _____ () C:\Windows\system32\perfh007.dat

2015-04-13 11:51 - 2009-08-04 11:51 - 00158606 _____ () C:\Windows\system32\perfc007.dat

2015-04-13 11:51 - 2009-07-14 07:13 - 01701722 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-04-13 11:46 - 2014-08-15 08:33 - 01185266 _____ () C:\Windows\PFRO.log

2015-04-13 11:46 - 2014-08-12 16:34 - 00011650 _____ () C:\Windows\setupact.log

2015-04-13 11:46 - 2012-04-03 12:21 - 00000000 ____D () C:\ProgramData\AVAST Software

2015-04-13 11:46 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-04-13 11:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system

2015-04-13 11:11 - 2014-02-08 19:23 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-04-13 09:57 - 2015-01-30 17:34 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-04-13 09:47 - 2015-02-14 12:26 - 00000000 ____D () C:\Program Files (x86)\AntiTwin

2015-04-13 09:45 - 2014-07-24 19:21 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\GlarySoft

2015-04-13 09:42 - 2014-07-13 19:49 - 00000000 ____D () C:\Program Files\Pixum

2015-04-13 09:35 - 2011-03-12 10:24 - 00045056 _____ () C:\Windows\system32\acovcnt.exe

2015-04-12 17:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2015-04-12 17:53 - 2011-02-11 12:49 - 00000000 ____D () C:\Users\Holger Carlson

2015-04-12 13:40 - 2012-09-04 17:54 - 00006144 ____H () C:\Users\Holger Carlson\Documents\photothumb.db

2015-04-11 19:14 - 2011-04-15 19:24 - 00015360 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-04-08 15:47 - 2013-03-03 13:04 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Deployment

2015-04-08 00:13 - 2014-05-13 11:11 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%

2015-04-07 18:59 - 2014-11-21 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Driver Updater

2015-04-07 18:59 - 2011-03-26 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WritePro

2015-04-07 18:32 - 2010-10-08 20:33 - 00000000 ____D () C:\Program Files (x86)\Google

2015-04-06 18:12 - 2014-02-08 19:23 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-04-06 18:12 - 2013-08-18 17:45 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-04-06 18:12 - 2013-08-18 17:45 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-04-06 18:02 - 2011-02-11 13:02 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Google

2015-04-06 11:31 - 2015-01-20 11:53 - 00000975 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-04-05 10:09 - 2010-10-08 21:00 - 00004200 _____ () C:\Windows\system32\AutoRunFilter.ini

2015-04-05 09:53 - 2015-01-30 16:55 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\dlg

2015-04-03 19:08 - 2013-09-28 13:18 - 00000000 ____D () C:\backup

2015-04-03 18:43 - 2014-08-19 14:14 - 00001564 _____ () C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Buchliebhaber.lnk

2015-04-03 18:43 - 2011-02-13 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Buchliebhaber

2015-04-03 18:42 - 2011-02-15 14:16 - 00000000 ____D () C:\ProgramData\Paradox

2015-04-03 17:59 - 2014-07-24 19:20 - 00001232 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk

2015-04-03 17:59 - 2014-07-24 19:20 - 00001220 _____ () C:\Users\Public\Desktop\Absolute Uninstaller.lnk

2015-04-03 13:42 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD

2015-04-03 13:35 - 2011-09-06 09:09 - 00000000 ____D () C:\Program Files (x86)\Samsung

2015-04-03 13:34 - 2015-02-11 18:19 - 00024652 _____ () C:\Windows\DPINST.LOG

2015-04-03 13:04 - 2011-09-06 09:10 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Samsung

2015-04-03 13:04 - 2010-10-08 20:22 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2015-03-29 13:34 - 2015-03-12 15:10 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-03-26 13:16 - 2014-09-09 16:34 - 00000000 ____D () C:\Buchliebhaber

2015-03-26 12:06 - 2010-10-08 21:00 - 00002391 _____ () C:\Windows\system32\ServiceFilter.ini

2015-03-26 12:01 - 2014-12-12 15:04 - 00000000 ____D () C:\Windows\system32\appraiser

2015-03-26 12:01 - 2014-07-25 16:01 - 00525312 _____ () C:\Users\Holger Carlson\Documents\Outlook.pst

2015-03-26 12:01 - 2014-05-08 09:46 - 00000000 ___SD () C:\Windows\system32\CompatTel

2015-03-24 19:37 - 2014-02-08 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung

2015-03-24 12:27 - 2015-02-27 11:16 - 00000348 _____ () C:\Windows\Tasks\0215tbUpdateInfo.job

2015-03-24 12:27 - 2015-02-27 11:16 - 00000000 ____D () C:\ProgramData\Avg_Update_0215tb

2015-03-24 10:54 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

2015-03-23 11:39 - 2015-02-09 11:33 - 00000000 ____D () C:\Program Files (x86)\AVG Web TuneUp

2015-03-17 00:49 - 2011-02-11 13:08 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Roaming\Adobe

2015-03-17 00:47 - 2012-11-17 20:50 - 00000000 ____D () C:\Users\Holger Carlson\AppData\Local\Adobe_Systems_Incorporate

2015-03-17 00:47 - 2012-01-03 16:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe

2015-03-17 00:47 - 2010-10-08 20:32 - 00000000 ____D () C:\Program Files (x86)\Adobe

2015-03-15 16:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
 

==================== Files in the root of some directories =======
 

2013-12-03 17:59 - 2013-12-03 17:59 - 23288584 _____ (Mozilla) C:\Program Files\Firefox_Setup [1].exe

2014-07-13 19:39 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch (1).exe

2014-07-13 19:38 - 2014-07-13 19:39 - 1631072 _____ () C:\Program Files\setup_Pixum_Fotobuch.exe

2007-06-12 18:34 - 2007-06-12 18:34 - 0035822 _____ () C:\Program Files (x86)\Common Files\ASPG_icon.ico

2008-05-22 17:35 - 2008-05-22 17:35 - 0051962 _____ () C:\Program Files (x86)\Common Files\banner.jpg

2009-04-08 19:31 - 2009-04-08 19:31 - 0106496 _____ () C:\Program Files (x86)\Common Files\CPInstallAction.dll

2008-08-12 06:45 - 2008-08-12 06:45 - 0155648 _____ (ASUS) C:\Program Files (x86)\Common Files\MSIactionall.dll

2013-12-19 10:19 - 2014-01-10 11:59 - 0000102 _____ () C:\Users\Holger Carlson\AppData\Roaming\WB.CFG

2011-04-15 19:24 - 2015-04-11 19:14 - 0015360 _____ () C:\Users\Holger Carlson\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-01-31 20:19 - 2015-02-01 12:37 - 0000025 _____ () C:\Users\Holger Carlson\AppData\Local\gt-props

2014-02-10 18:03 - 2014-02-10 18:03 - 0001679 _____ () C:\Users\Holger Carlson\AppData\Local\recently-used.xbel

2012-04-27 10:44 - 2012-04-27 10:44 - 0000017 _____ () C:\Users\Holger Carlson\AppData\Local\resmon.resmoncfg

2014-12-04 13:47 - 2014-12-04 13:47 - 0000000 _____ () C:\Users\Holger Carlson\AppData\Local\{C0180386-8014-4674-B1B2-C6CB0EB6F63F}

2011-02-21 18:31 - 2011-02-21 18:31 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

2015-01-17 18:18 - 2015-01-17 18:18 - 0005045 _____ () C:\ProgramData\wmzddnmb.cix
 

Some content of TEMP:

====================

C:\Users\Holger Carlson\AppData\Local\Temp\avgnt.exe

C:\Users\Holger Carlson\AppData\Local\Temp\Quarantine.exe

C:\Users\Holger Carlson\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-04-05 11:03
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-04-2015

Ran by Holger Carlson at 2015-04-13 12:01:35

Running from C:\Users\Holger Carlson\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XF329JBY

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Absolute Uninstaller 5.3.1.20 (HKLM-x32\...\Absolute Uninstaller) (Version: 5.3.1.20 - Glarysoft Ltd)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 17.0.0.124 - Adobe Systems Incorporated)

Adobe Digital Editions 4.0 (HKLM-x32\...\Adobe Digital Editions 4.0) (Version: 4.0.3 - Adobe Systems Incorporated)

Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.134 - Adobe Systems Incorporated)

Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Alle meine Adressen 1.20 (HKLM-x32\...\AllemeineAdressen) (Version:  - )

Amazon Kindle (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\Amazon Kindle) (Version:  - Amazon)

ASUS FancyStart (HKLM-x32\...\{2B81872B-A054-48DA-BE3B-FA5C164C303A}) (Version:  - )

AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)

Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)

Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden

Buchliebhaber 9.1.0 (HKLM-x32\...\Buchliebhaber_is1) (Version:  - Matthies & Klock GmbH)

GMX MediaCenter 1.5.2192.0 (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\GMX Application {sync-000021}) (Version: 1.5.2192.0 - 1&1 Mail & Media GmbH)

GMX Softwareaktualisierung CE (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.1.0 - 1&1 Mail & Media GmbH)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden

Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)

McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)

MD Adressbuch 2012 (HKLM-x32\...\MD Adressbuch 2012_is1) (Version:  - Stefan Göppert Softwareentwicklung)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)

MyDriveConnect 3.3.0.1756 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)

MyFreeCodec (HKU\S-1-5-21-171592873-1656066399-1947005370-1000\...\MyFreeCodec) (Version:  - )

paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)

SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version:  - )

Samsung Mobile Modem Device Software (HKLM\...\Samsung Mobile Modem Device) (Version:  - )

SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version:  - )

Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )

SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version:  - )

SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version:  - )

SAMSUNG USB Mobile Device Software (HKLM\...\SAMSUNG USB Mobile Device) (Version:  - )

TomTom HOME (HKLM-x32\...\{BB05590A-6602-43F3-A400-77EA0976BC0A}) (Version: 2.9.8 - Ihr Firmenname)

TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version:  - )

Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)

WinZip Driver Updater (HKLM-x32\...\{9854A5C4-5BE5-46E2-A989-352DD8B37E20}_is1) (Version: 1.0.648.16298 - WinZip Computing, S.L. (WinZip Computing))

XnView 2.25 (HKLM-x32\...\XnView_is1) (Version: 2.25 - Gougelet Pierre-e)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

12-04-2015 18:04:34 Wiederherstellungsvorgang

12-04-2015 18:22:53 Uniblue PC Mechanic installation

13-04-2015 09:37:37 avast! antivirus system restore point

13-04-2015 09:45:54 Windows-Sicherung
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2014-12-04 14:19 - 00000860 ____N C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

::1 localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {08B758AF-1A52-432B-8127-90EC4AA3A965} - System32\Tasks\{F2C2A228-7128-4269-BFD6-1BA7B353163D} => C:\Program Files (x86)\Matthies &amp; Klock GmbH\Buchliebhaber\PR9\pdxrwn32.exe

Task: {098E8135-34F9-4A64-934D-CB129E5D2CDC} - \Google Updater and Installer No Task File <==== ATTENTION

Task: {0CE00D12-17CE-4495-BF65-180B9826F70C} - \{61A08136-196D-4297-89AD-D497D9417337} No Task File <==== ATTENTION

Task: {0D02835E-8E5B-471D-B8DD-C212A01D96EC} - \{D04405DF-9CCA-470D-B397-4843D8B97AF0} No Task File <==== ATTENTION

Task: {0D85BDAC-E5C7-468D-B749-BB89C6043C0C} - \{5287E865-8199-49E9-9791-D1D1C8255AD2} No Task File <==== ATTENTION

Task: {11951C30-7772-4873-A9C8-E7D79EC20876} - \{D8737E18-1D23-477D-AAC7-5336054949A5} No Task File <==== ATTENTION

Task: {13F363A7-DAF8-481E-B4FE-FE9B141B5AA3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)

Task: {25201061-4215-47D1-9AD4-34EA219B3820} - System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F} => pcalua.exe -a E:\setup.exe -d E:\

Task: {28C6FF84-FF3C-482A-9DE2-C1E1A727942B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-06] (Adobe Systems Incorporated)

Task: {290FA810-6486-498B-959B-EF77EE05DD0F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)

Task: {2B0BE8B0-825F-4CBB-8C4D-91671BCB9A6A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {2FC8335C-FA90-4CEE-A686-C6B49483A403} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)

Task: {3210E7F8-FB59-421F-B199-67709A46C787} - \{A6277D21-0A69-4926-8537-03083BD82DC4} No Task File <==== ATTENTION

Task: {334ED6C7-1F98-49AE-8A05-3E3B9A21315B} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)

Task: {358F7EC5-6965-40B1-864E-007E2DF9341F} - System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)

Task: {38A8F2A8-F514-4C70-A1BB-A5D46267F1FB} - \{F46C64DF-4E00-4451-B8AB-B1BD2B03A5D6} No Task File <==== ATTENTION

Task: {38ADF97D-C025-44B4-8A28-255AF09F87BD} - \{9623FEA8-9F14-41C1-B13F-5E2F1DDF2973} No Task File <==== ATTENTION

Task: {3B3ABEC6-C5C7-4317-98AA-0E6A0A2CCF4B} - \{9DB39282-3B31-400F-9105-DE5FB32A8625} No Task File <==== ATTENTION

Task: {3D5A7F1A-A836-46DC-9849-9F87B83A84A3} - System32\Tasks\ASPG => C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe [2009-06-29] (ASUS)

Task: {3DFA3AE3-36A5-43EE-86FD-5CFEE82FD09E} - \{010EC50E-DEBC-4DDF-818F-D8FD586C6441} No Task File <==== ATTENTION

Task: {40210CAF-8AA2-4DD1-BDF5-BB204B73FB6C} - System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)

Task: {413B067F-3B28-4DF2-8F92-254BE963B97C} - System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D} => C:\Buchliebhaber\PR9\pdxrwn32.exe [2000-03-13] (Corel Corporation)

Task: {41E4A974-3CB9-486E-B66F-D3F72922F49D} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-05-28] (ATK)

Task: {442B4BA7-EBD3-4530-973F-E7CC01346952} - \{BA46EF16-D5AD-455B-A934-5EFCEB3A4388} No Task File <==== ATTENTION

Task: {44B27208-7DF9-417C-85BA-311F6EE0FE37} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17] (ASUS)

Task: {46897D9B-08E1-407A-86D2-588D7ABBE189} - \{BE03A807-43D0-45D8-9633-BA1E5A2BF85C} No Task File <==== ATTENTION

Task: {47F29D00-B56D-4D0B-A245-F110AC103BA3} - \{DCE86621-269D-478F-9FAC-AF30D2697486} No Task File <==== ATTENTION

Task: {4A29309C-5F1C-4521-B5A3-74342AD4D434} - System32\Tasks\avastBCLRestartS-1-5-21-171592873-1656066399-1947005370-1000 => Chrome.exe 

Task: {4ABBB83F-8527-455B-839D-0E31E9921ABF} - \{414946E3-07AA-4AF3-BB0D-E22440C7BAAE} No Task File <==== ATTENTION

Task: {4DB12196-A5A6-455A-A31E-8A8F9CDA048F} - \{00D6677F-309E-4218-BCA8-4C50017C8BFD} No Task File <==== ATTENTION

Task: {4E55F6B2-D76F-46DA-85CA-851B04EA102C} - System32\Tasks\4805 => Wscript.exe C:\Users\HOLGER~1\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION

Task: {536019A5-4DF9-4D2A-AB12-D4F97B46565A} - \{3542F023-1538-411B-9E77-ACAF5E3DCF29} No Task File <==== ATTENTION

Task: {570F0731-82FB-4801-9764-13133948D30D} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {61DA3565-D65E-4727-A79B-CFF46B7C83D0} - \{515B0C8B-D302-490D-B011-1690D5CB8DA8} No Task File <==== ATTENTION

Task: {67253C4B-AA19-4D28-A2C4-ACB82A1E8FB3} - \{8715223C-93FC-489B-A4F9-497C1B06356D} No Task File <==== ATTENTION

Task: {689876BF-828C-4CAC-B3C8-96B7A34B374C} - \{E27BA60A-F9D1-4950-AADD-E4C8BB8E3AE7} No Task File <==== ATTENTION

Task: {6B054A5F-A0E3-42EF-B939-199ECAD09EEE} - \Registration 1und1 Task No Task File <==== ATTENTION

Task: {73E334A0-2C62-4488-842A-B6047FD36A67} - \{4C3D4C4C-3DD2-436D-B415-CC9B34C519DA} No Task File <==== ATTENTION

Task: {75B32520-AE21-407C-924A-BD972FD0ED7F} - System32\Tasks\{69024FA6-BE33-473D-B9A3-EE1A4D9E4625} => pcalua.exe -a C:\Olivetti\MY_WAY_PLUS\Setup.EXE -d C:\Olivetti\MY_WAY_PLUS

Task: {7687468C-FCB9-4157-98A5-29F118266571} - \{80C774A3-BC4E-4FEF-B262-A5578F350E85} No Task File <==== ATTENTION

Task: {7D065A65-864E-4237-909F-B37C27ECC63A} - \{A86E51F0-822F-4FC6-9962-851362E69E65} No Task File <==== ATTENTION

Task: {813A7F73-0382-4A15-BA6D-549796A8A795} - \{A3123A1E-2B47-4121-992C-63487F1CE1F3} No Task File <==== ATTENTION

Task: {8280F3EA-A247-4A48-8F40-7F948D87EB49} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe

Task: {833E3160-FE17-4A2E-8B96-5ACA617F1334} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31] (ASUS)

Task: {83C4C39B-F484-45E4-B677-EFBBD3E1183A} - \{7874A9A9-C312-459B-A16C-50B15C6AE000} No Task File <==== ATTENTION

Task: {8B51862B-900B-4C95-A7D5-29D974D8EE26} - \{4BA2B75B-115C-4BCA-B45A-BD110E15FEF3} No Task File <==== ATTENTION

Task: {8E7BFA22-A9BF-4269-B793-D870D24D60C2} - System32\Tasks\0215tbUpdateInfo => C:\ProgramData\Avg_Update_0215tb\0215tb_{9AC9BD6A-EC15-4AF2-B2E9-45B20221802C}.exe [2015-02-27] ()

Task: {8F72ADBE-9038-41E9-86A7-8381B850A01F} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2009-07-23] (ATK)

Task: {933153D3-FF7D-4F2F-93DB-4EE18AEC267A} - \{58E9C4A2-89D5-4097-9A1D-3C7212CC100A} No Task File <==== ATTENTION

Task: {95298E87-8CFD-4CCA-890F-8B7D7730CF74} - \{E2D6ACFE-B61E-4447-AE80-4B0CA9F20914} No Task File <==== ATTENTION

Task: {961A4741-EA5F-4FD4-9F58-9824862E1432} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION

Task: {9AA4F3F3-6B2F-4EA6-B81B-1EA4DF38689E} - \{F99ED12E-E280-47FF-9CC7-4FA9874C09B4} No Task File <==== ATTENTION

Task: {A7177D9F-E795-4EEA-9386-C0AB9B1E6555} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {AB825B6B-2DF7-408C-A17E-B405E72C327C} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()

Task: {ABE155A8-22A7-4F41-A3D7-35B367212640} - \{8EE0BDD3-D87C-4147-865B-EF850579BBB3} No Task File <==== ATTENTION

Task: {B35D3966-C1EC-4ABB-BAC5-D82790C11C3F} - \{E3C1408B-870F-4E8E-863D-53964BB8AC89} No Task File <==== ATTENTION

Task: {B39D560A-BEBE-44B2-BB96-2FB0031EFCB1} - System32\Tasks\{5F6DAA4F-722D-4B6E-9C1D-E206E1B3507A} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{F193FC0E-9E18-40FC-A974-509A1BDD240A}\setup.exe" -c -runfromtemp -l0x0407 -removeonly

Task: {B3C1DDB0-DE41-4A0A-BF91-DBEDCF91283A} - \{579791C6-84C4-4514-8990-62DE88C0F405} No Task File <==== ATTENTION

Task: {B4381734-38BC-4416-BA34-AD5B873F9C57} - \Java Update Scheduler No Task File <==== ATTENTION

Task: {B4906D30-8E70-438F-ACE2-F49B1DBE7445} - \{94AA3650-9FB1-4CD9-A08A-C903E473EBCE} No Task File <==== ATTENTION

Task: {B967227B-B6FD-4E2D-8835-423AB6A11D89} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)

Task: {BE3C31CF-63BD-4BBF-B1EC-7B0AD8E1475C} - \{766A2B2A-5AE1-40C4-B5D1-3ACEE3EDB174} No Task File <==== ATTENTION

Task: {BF27F29A-158B-4BB3-8BCE-76285F22E1E8} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe

Task: {C070E538-D27F-40CE-A149-1F519DE498C9} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)

Task: {C9922EB1-0689-4006-9DE5-EC7322657A2E} - \{3A7AA56D-B373-4984-B360-5A49D81838B3} No Task File <==== ATTENTION

Task: {D10B95EB-9C87-4E4B-B2A9-7995BACE3748} - System32\Tasks\ASUSControlDeck => C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe [2010-06-09] (asus)

Task: {D3A8949A-66C0-404E-A951-6D81347CC413} - \{5F42D548-089A-4880-B17A-030133EB09AE} No Task File <==== ATTENTION

Task: {D3DCDC2E-0597-4E10-B9B2-DA8A9D0B8184} - \{C8855EFF-1C49-474C-8EC9-A88A46937291} No Task File <==== ATTENTION

Task: {D79B06A8-69BD-44AF-A4F9-51F90B02F5F9} - \{010E4118-67B1-49F2-B0A9-AEBEB8C22ED8} No Task File <==== ATTENTION

Task: {D804B95C-2E56-41A3-BA15-CBFF3F453270} - \{D1412BBD-3329-445E-BAAC-11DAA3F957DE} No Task File <==== ATTENTION

Task: {D97583DC-E996-4394-9850-866EE5071AA3} - \{54761E2D-0F8D-4150-9BAF-A6C950ABC57C} No Task File <==== ATTENTION

Task: {DCCEAEA3-B771-45EF-B482-A5AF7C257613} - \{F268C70D-1377-46B5-B8EF-B0F597A319DD} No Task File <==== ATTENTION

Task: {DD20FA04-E2E5-4565-BC1F-EF251B8CF767} - \{017BCEFC-6CC0-4438-9C8C-8201389B3A60} No Task File <==== ATTENTION

Task: {DF172056-6ED6-443A-A038-9148CCA273FB} - System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E} => pcalua.exe -a E:\setup.exe -d E:\

Task: {E4FADBEF-BD70-4875-9F9E-1F514FAE9ACE} - \{428451EA-30BB-4D09-B88F-21C45644BDDD} No Task File <==== ATTENTION

Task: {EBAEA87A-60D8-457D-B7BE-FDDEE0C029B6} - \{E72F77B1-78E7-4B59-A542-303E6C370E31} No Task File <==== ATTENTION

Task: {EBC17C4A-B399-454D-880A-2B7927689200} - System32\Tasks\{B499114B-BC27-40FC-98B1-F18D60669500} => pcalua.exe -a C:\ProgramData\ZombieInvasion\uninstall.exe -c /kb=y /ic=1

Task: {EBDB75AC-DD2E-4374-8CA6-CA615964EFDF} - System32\Tasks\{F24AA02C-94D0-40B1-9DB0-D88D09B26BA3} => C:\Program Files (x86)\Matthies &amp; Klock GmbH\Buchliebhaber\PR9\pdxrwn32.exe

Task: {F088DE68-E8E0-404D-A03F-71D270529CAA} - \{C9155B3B-9625-4BCA-8DC8-57E7BE8F3A16} No Task File <==== ATTENTION

Task: {F291C6EE-C628-4432-9AA6-72AB2B105BB0} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe

Task: {F2C3A777-E8AA-4F3A-BAFD-9404E1BEA2BA} - \SidebarExecute No Task File <==== ATTENTION

Task: {FCC576CF-4869-4F53-B945-CC818F71D6F7} - \{A56BDF5A-F4F1-4A50-8871-D8B38E0FE432} No Task File <==== ATTENTION

Task: C:\Windows\Tasks\0215tbUpdateInfo.job => C:\ProgramData\Avg_Update_0215tb\0215tb_{9AC9BD6A-EC15-4AF2-B2E9-45B20221802C}.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) ==============
 

2007-06-15 19:28 - 2007-06-15 19:28 - 00104960 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll

2007-06-02 01:52 - 2007-06-02 01:52 - 00159744 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\Temp:AD022376
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Software\Classes\exefile:  <===== ATTENTION!
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Holger Carlson\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.2.1
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupreg: ADSMTray => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe

MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe

MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"

MSCONFIG\startupreg: RemoteControl9 => "C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe"

MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-171592873-1656066399-1947005370-500 - Administrator - Disabled)

Gast (S-1-5-21-171592873-1656066399-1947005370-501 - Limited - Disabled)

Holger Carlson (S-1-5-21-171592873-1656066399-1947005370-1000 - Administrator - Enabled) => C:\Users\Holger Carlson

HomeGroupUser$ (S-1-5-21-171592873-1656066399-1947005370-1002 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft-Teredo-Tunneling-Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Processor: Intel(R) Pentium(R) CPU P6100 @ 2.00GHz

Percentage of memory in use: 53%

Total physical RAM: 2924.57 MB

Available physical RAM: 1358.21 MB

Total Pagefile: 6147.32 MB

Available Pagefile: 4240.17 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:72.69 GB) (Free:7.6 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive d: (Data) (Fixed) (Total:205.87 GB) (Free:3.94 GB) NTFS

Drive f: (INTENSO USB) (Removable) (Total:3.84 GB) (Free:3.61 GB) FAT32

Drive g: (CNMemory Festplatte) (Fixed) (Total:698.63 GB) (Free:605.38 GB) NTFS

Drive s: (EX SPEICHER) (Removable) (Total:7.51 GB) (Free:4.24 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 0237A506)

Partition 1: (Not Active) - (Size=19.5 GB) - (Type=1C)

Partition 2: (Active) - (Size=72.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=205.9 GB) - (Type=OF Extended)
 

========================================================

Disk: 1 (Size: 7.5 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type.
 

========================================================

Disk: 2 (Size: 3.8 GB) (Disk ID: 6DA16B7B)

Partition 1: (Active) - (Size=3.8 GB) - (Type=0B)
 

========================================================

Disk: 3 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: F359C74D)

Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Das müsste jetzt alles sein.
Gruß und danke für deine Geduld

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

CHR HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

HKU\S-1-5-21-171592873-1656066399-1947005370-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP8803837A-1DA4-472E-BAE6-FF0BFD270EFC&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

SearchScopes: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&q={searchTerms}

Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKU\S-1-5-21-171592873-1656066399-1947005370-1000 -> No Name - {534D542D-5637-006A-76A7-7A786E7484D7} -  No File

CHR HKLM-x32\...\Chrome\Extension: [fknfdieimobmimhdkfkheeejenmdjhoe] - C:\Program Files (x86)\pandasecuritytb\chrome-newtab-search.crx [Not Found]

C:\Windows\System32\Tasks\{69024FA6-BE33-473D-B9A3-EE1A4D9E4625}

C:\ProgramData\{95f4c13f-5638-faae-95f4-4c13f56304fd}

C:\Windows\System32\Tasks\{A2F92AC1-AFA1-4E86-8E4F-4320AF8CAFC8}

C:\Windows\System32\Tasks\{42DB7226-BD17-443B-9B46-0B981C090BEB}

C:\Windows\System32\Tasks\{379D7A1C-5990-4F7B-8D7F-93DBB093395D}

C:\Users\Holger Carlson\Desktop\Buchliebhaber.lnk

C:\Buchliebhaber1

C:\Windows\System32\Tasks\{31DF2CAA-6FE5-4163-BE60-BDF22507129E}

C:\Windows\System32\Tasks\{7BE02FCA-D2BD-4C97-AEEF-BEAB652E047F}

Task: {098E8135-34F9-4A64-934D-CB129E5D2CDC} - \Google Updater and Installer No Task File <==== ATTENTION

Task: {0CE00D12-17CE-4495-BF65-180B9826F70C} - \{61A08136-196D-4297-89AD-D497D9417337} No Task File <==== ATTENTION

Task: {0D02835E-8E5B-471D-B8DD-C212A01D96EC} - \{D04405DF-9CCA-470D-B397-4843D8B97AF0} No Task File <==== ATTENTION

Task: {0D85BDAC-E5C7-468D-B749-BB89C6043C0C} - \{5287E865-8199-49E9-9791-D1D1C8255AD2} No Task File <==== ATTENTION

Task: {11951C30-7772-4873-A9C8-E7D79EC20876} - \{D8737E18-1D23-477D-AAC7-5336054949A5} No Task File <==== ATTENTION

Task: {3210E7F8-FB59-421F-B199-67709A46C787} - \{A6277D21-0A69-4926-8537-03083BD82DC4} No Task File <==== ATTENTION

Task: {38A8F2A8-F514-4C70-A1BB-A5D46267F1FB} - \{F46C64DF-4E00-4451-B8AB-B1BD2B03A5D6} No Task File <==== ATTENTION

Task: {38ADF97D-C025-44B4-8A28-255AF09F87BD} - \{9623FEA8-9F14-41C1-B13F-5E2F1DDF2973} No Task File <==== ATTENTION

Task: {3B3ABEC6-C5C7-4317-98AA-0E6A0A2CCF4B} - \{9DB39282-3B31-400F-9105-DE5FB32A8625} No Task File <==== ATTENTION

Task: {3DFA3AE3-36A5-43EE-86FD-5CFEE82FD09E} - \{010EC50E-DEBC-4DDF-818F-D8FD586C6441} No Task File <==== ATTENTION

Task: {442B4BA7-EBD3-4530-973F-E7CC01346952} - \{BA46EF16-D5AD-455B-A934-5EFCEB3A4388} No Task File <==== ATTENTION

Task: {46897D9B-08E1-407A-86D2-588D7ABBE189} - \{BE03A807-43D0-45D8-9633-BA1E5A2BF85C} No Task File <==== ATTENTION

Task: {47F29D00-B56D-4D0B-A245-F110AC103BA3} - \{DCE86621-269D-478F-9FAC-AF30D2697486} No Task File <==== ATTENTION

Task: {4ABBB83F-8527-455B-839D-0E31E9921ABF} - \{414946E3-07AA-4AF3-BB0D-E22440C7BAAE} No Task File <==== ATTENTION

Task: {4DB12196-A5A6-455A-A31E-8A8F9CDA048F} - \{00D6677F-309E-4218-BCA8-4C50017C8BFD} No Task File <==== ATTENTION

Task: {4E55F6B2-D76F-46DA-85CA-851B04EA102C} - System32\Tasks\4805 => Wscript.exe C:\Users\HOLGER~1\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION

Task: {536019A5-4DF9-4D2A-AB12-D4F97B46565A} - \{3542F023-1538-411B-9E77-ACAF5E3DCF29} No Task File <==== ATTENTION

Task: {61DA3565-D65E-4727-A79B-CFF46B7C83D0} - \{515B0C8B-D302-490D-B011-1690D5CB8DA8} No Task File <==== ATTENTION

Task: {67253C4B-AA19-4D28-A2C4-ACB82A1E8FB3} - \{8715223C-93FC-489B-A4F9-497C1B06356D} No Task File <==== ATTENTION

Task: {689876BF-828C-4CAC-B3C8-96B7A34B374C} - \{E27BA60A-F9D1-4950-AADD-E4C8BB8E3AE7} No Task File <==== ATTENTION

Task: {6B054A5F-A0E3-42EF-B939-199ECAD09EEE} - \Registration 1und1 Task No Task File <==== ATTENTION

Task: {73E334A0-2C62-4488-842A-B6047FD36A67} - \{4C3D4C4C-3DD2-436D-B415-CC9B34C519DA} No Task File <==== ATTENTION

Task: {7687468C-FCB9-4157-98A5-29F118266571} - \{80C774A3-BC4E-4FEF-B262-A5578F350E85} No Task File <==== ATTENTION

Task: {7D065A65-864E-4237-909F-B37C27ECC63A} - \{A86E51F0-822F-4FC6-9962-851362E69E65} No Task File <==== ATTENTION

Task: {813A7F73-0382-4A15-BA6D-549796A8A795} - \{A3123A1E-2B47-4121-992C-63487F1CE1F3} No Task File <==== ATTENTION

Task: {83C4C39B-F484-45E4-B677-EFBBD3E1183A} - \{7874A9A9-C312-459B-A16C-50B15C6AE000} No Task File <==== ATTENTION

Task: {8B51862B-900B-4C95-A7D5-29D974D8EE26} - \{4BA2B75B-115C-4BCA-B45A-BD110E15FEF3} No Task File <==== ATTENTION

Task: {933153D3-FF7D-4F2F-93DB-4EE18AEC267A} - \{58E9C4A2-89D5-4097-9A1D-3C7212CC100A} No Task File <==== ATTENTION

Task: {95298E87-8CFD-4CCA-890F-8B7D7730CF74} - \{E2D6ACFE-B61E-4447-AE80-4B0CA9F20914} No Task File <==== ATTENTION

Task: {961A4741-EA5F-4FD4-9F58-9824862E1432} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION

Task: {9AA4F3F3-6B2F-4EA6-B81B-1EA4DF38689E} - \{F99ED12E-E280-47FF-9CC7-4FA9874C09B4} No Task File <==== ATTENTION

Task: {ABE155A8-22A7-4F41-A3D7-35B367212640} - \{8EE0BDD3-D87C-4147-865B-EF850579BBB3} No Task File <==== ATTENTION

Task: {B35D3966-C1EC-4ABB-BAC5-D82790C11C3F} - \{E3C1408B-870F-4E8E-863D-53964BB8AC89} No Task File <==== ATTENTION

Task: {B3C1DDB0-DE41-4A0A-BF91-DBEDCF91283A} - \{579791C6-84C4-4514-8990-62DE88C0F405} No Task File <==== ATTENTION

Task: {B4381734-38BC-4416-BA34-AD5B873F9C57} - \Java Update Scheduler No Task File <==== ATTENTION

Task: {B4906D30-8E70-438F-ACE2-F49B1DBE7445} - \{94AA3650-9FB1-4CD9-A08A-C903E473EBCE} No Task File <==== ATTENTION

Task: {BE3C31CF-63BD-4BBF-B1EC-7B0AD8E1475C} - \{766A2B2A-5AE1-40C4-B5D1-3ACEE3EDB174} No Task File <==== ATTENTION

Task: {C9922EB1-0689-4006-9DE5-EC7322657A2E} - \{3A7AA56D-B373-4984-B360-5A49D81838B3} No Task File <==== ATTENTION

Task: {D3A8949A-66C0-404E-A951-6D81347CC413} - \{5F42D548-089A-4880-B17A-030133EB09AE} No Task File <==== ATTENTION

Task: {D3DCDC2E-0597-4E10-B9B2-DA8A9D0B8184} - \{C8855EFF-1C49-474C-8EC9-A88A46937291} No Task File <==== ATTENTION

Task: {D79B06A8-69BD-44AF-A4F9-51F90B02F5F9} - \{010E4118-67B1-49F2-B0A9-AEBEB8C22ED8} No Task File <==== ATTENTION

Task: {D804B95C-2E56-41A3-BA15-CBFF3F453270} - \{D1412BBD-3329-445E-BAAC-11DAA3F957DE} No Task File <==== ATTENTION

Task: {D97583DC-E996-4394-9850-866EE5071AA3} - \{54761E2D-0F8D-4150-9BAF-A6C950ABC57C} No Task File <==== ATTENTION

Task: {DCCEAEA3-B771-45EF-B482-A5AF7C257613} - \{F268C70D-1377-46B5-B8EF-B0F597A319DD} No Task File <==== ATTENTION

Task: {DD20FA04-E2E5-4565-BC1F-EF251B8CF767} - \{017BCEFC-6CC0-4438-9C8C-8201389B3A60} No Task File <==== ATTENTION

Task: {E4FADBEF-BD70-4875-9F9E-1F514FAE9ACE} - \{428451EA-30BB-4D09-B88F-21C45644BDDD} No Task File <==== ATTENTION

Task: {EBAEA87A-60D8-457D-B7BE-FDDEE0C029B6} - \{E72F77B1-78E7-4B59-A542-303E6C370E31} No Task File <==== ATTENTION

Task: {F088DE68-E8E0-404D-A03F-71D270529CAA} - \{C9155B3B-9625-4BCA-8DC8-57E7BE8F3A16} No Task File <==== ATTENTION

Task: {F2C3A777-E8AA-4F3A-BAFD-9404E1BEA2BA} - \SidebarExecute No Task File <==== ATTENTION

Task: {FCC576CF-4869-4F53-B945-CC818F71D6F7} - \{A56BDF5A-F4F1-4A50-8871-D8B38E0FE432} No Task File <==== ATTENTION

RemoveProxy:

EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

wenn ich FRST wieder geladen habe und dann auf Fix drücke, findet er die Fixlist nicht.
No fixlist.txt found.
The fixlist.txt should be in the same Folder/directory the tool is located.

Ich habe den Text in den Firstlist-Editor kopiert und wie folgt gespeichert:
unter Bibliotheken
Dokumente
Firstlist.txt.
Textdateien(*txt)
Codierung: ANSI
Was mache ich falsch???

Das kommt weil du meinen eindringlichen Hinweis, die FRST.exe nur auf dem Desktop zu speichern, offensichtlich ignoriert hast:

Zitat:

Running from C:\Users\Holger Carlson\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XF329JBY

aus dem Temp oder Browsercache-Ordner FRST zu starten ist völliger Murks

ich war so sicher, dass ich alle Anweisungen wie vorgegeben befolgt habe.
Im Moment gelingt es mir nicht einmal mehr, FRST neu zu downloaden. Deshalb werde ich jetzt alles erst einmal wieder alles löschen und den Laptop in Ruhe lassen. :crazy:

Dann werde ich es erneut versuchen und nach den drei Schritten vorgehen:
1. MBAM
2. JRT
3. Frisches Log mit FRST

Ich weiß, dass Du dir große Mühe gegeben hast und ich bedanke mich noch einmal für Deinen Langmut.
Da ich nicht weiß, was ich falsch gemacht habe und demnach auch nicht weiß, was ich ändern soll, brauche erst einmal Abstand, damit ich wieder in meinen Spiegel schauen kann.
Bis dahin:dankeschoen:
beste Grüße
Klavitter831... Holger Carlson