Windows 7: TR/Rogue.928372, SwvUpdater, AmiUpdXp, PUP.Optional.Amonetize

Exportierte Ereignisse:

04.08.2013 20:11 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Petra\Downloads\Portforward-Setup-Static-IP-Address.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Rogue.928372' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '54d33622.qua' 
      verschoben!
         

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.04.04

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Petra :: PETRA-PC [Administrator]

04.08.2013 21:22:34
mbam-log-2013-08-04 (21-22-34).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 461569
Laufzeit: 1 Stunde(n), 17 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 6
HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Updater.AmiUpd.1 (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Updater.AmiUpd (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Users\Petra\AppData\Local\SwvUpdater\Updater.exe (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Petra\AppData\Local\Temp\Updater.exe (PUP.Optional.Amonetize) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:05 on 05/08/2013 (Petra)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-08-2013
Ran by Petra (administrator) on 05-08-2013 11:09:24
Running from C:\Users\Petra\Downloads
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Microsoft Corporation) c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NTI, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
() C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Corp.) C:\Program Files (x86)\Acer\Acer TouchPortal\TouchPortalLauncher.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\TouchMovieService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24 Drucker\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2098792 2010-06-22] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324608 2010-06-10] (Alcor Micro Corp.)
HKLM\...\Run: [ODDPwr] - C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe [223264 2010-04-22] (Acer Incorporated)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2097960 2010-04-22] (Synaptics Incorporated)
HKLM\...\Run: [TouchPortal] - C:\Program Files (x86)\Acer\Acer TouchPortal\TouchPortalLauncher.exe [436256 2010-07-08] (Acer Corp.)
HKCU\...\Run: [ShowBatteryBar] - C:\Program Files\BatteryBar\ShowBatteryBar.exe [89600 2009-05-28] ()
HKCU\...\Run: [Device Detection] - C:\Users\Petra\Pictures\Lidl_Fotos\dd.exe [x]
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
MountPoints2: E - E:\Autorun.exe
HKLM-x32\...\Run: [MDS_Menu] - C:\Program Files (x86)\Acer\Acer TouchPortal\MediaShow Espresso\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [TouchMovieService] - C:\Program Files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\TouchMovieService.exe [124136 2010-05-12] (CyberLink Corp.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [968272 2010-06-22] (Dritek System Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24 Drucker\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [111720 2010-07-26] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [100968 2010-07-26] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ACCU-CHEK® 360° – Automatische Erkennung.lnk
ShortcutTarget: ACCU-CHEK® 360° – Automatische Erkennung.lnk -> C:\Program Files (x86)\Roche Diagnostics\ACCU-CHEK 360\Application\ApplicationMain.exe (Roche)
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aol.com/?mtmhp=hyplogusaolp00000019
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5745pg&r=27360711d406l0473z1h5v4731321o
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5745pg&r=27360711d406l0473z1h5v4731321o
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5745pg&r=27360711d406l0473z1h5v4731321o
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5745pg&r=27360711d406l0473z1h5v4731321o
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5745pg&r=27360711d406l0473z1h5v4731321o
URLSearchHook: (No Name) - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} -  No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&q={searchTerms}&s_it=amonetizetest1-ie&s_qt=sb&tb_uuid=5540394A703C4D63BCAB3B4539297CE4&tb_oid=21-04-2013&tb_mrud=21-04-2013
SearchScopes: HKCU - {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&q={searchTerms}&s_it=amonetizetest1-ie&s_qt=sb&tb_uuid=5540394A703C4D63BCAB3B4539297CE4&tb_oid=21-04-2013&tb_mrud=21-04-2013
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: AOL Toolbar Loader - {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll (AOL Inc.)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll (AOL Inc.)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://active.macromedia.com/flash/cabs/swflash.cab
DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.3.1

FireFox:
========
FF ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default
FF user.js: detected! => C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\user.js
FF NewTab: hxxp://www.google.de
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "ftp", "91.212.124.153"
FF NetworkProxy: "ftp_port", 80
FF NetworkProxy: "http", "91.212.124.153"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "91.212.124.153"
FF NetworkProxy: "socks_port", 80
FF NetworkProxy: "ssl", "91.212.124.153"
FF NetworkProxy: "ssl_port", 80
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 - C:\Program Files (x86)\Virtual Earth 3D\ ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/VirtualEarth3D,version=4.0 - C:\Program Files (x86)\Virtual Earth 3D\ ()
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=1.1.11 - C:\Program Files (x86)\VLC Player\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Deutsches Wörterbuch - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\de-DE@dictionaries.addons.mozilla.org
FF Extension: British English Dictionary - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\en-GB@dictionaries.addons.mozilla.org
FF Extension: United States English Spellchecker - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\en-US@dictionaries.addons.mozilla.org
FF Extension: gTranslator - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\jyboy.yy@gmail.com
FF Extension: AOL Toolbar - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\{7affbfae-c4e2-4915-8c0f-00fa3ec610a1}
FF Extension: DownloadHelper - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: extension - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\extension@hidemyass.com.xpi
FF Extension: info - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\info@youtube-mp3.org.xpi
FF Extension: openlinkintab - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\openlinkintab@piro.sakura.ne.jp.xpi
FF Extension: restartless.restart - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\restartless.restart@erikvold.com.xpi
FF Extension: stealthyextension - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\stealthyextension@gmail.com.xpi
FF Extension: youtube2mp3 - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\youtube2mp3@mondayx.de.xpi
FF Extension: No Name - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
FF Extension: No Name - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\4zznlumx.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] C:\Program Files (x86)\Video Converter\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Video Converter\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\

==================== Services (Whitelisted) =================

R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [654392 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [371768 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 MSSQL$ACCUCHEK360; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)
R2 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144640 2010-04-17] (NTI, Inc.)
R2 ODDPwrSvc; C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [171040 2010-04-22] (Acer Incorporated)
R2 RichVideo; C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904 2010-02-24] ()

==================== Drivers (Whitelisted) ====================

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-03-11] ()
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-02-12] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-02-12] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-05] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [270912 2011-10-28] (DT Soft Ltd)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-03-11] ()
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [141920 2012-12-15] (Acronis)
R2 {6E090BD5-4EF5-4bf0-A968-74049E88E935}; C:\Program Files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\000.fcl [146928 2010-05-19] (CyberLink Corp.)
R2 {6E090BD5-4EF5-4bf0-A968-74049E88E935}; C:\Program Files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\000.fcl [146928 2010-05-19] (CyberLink Corp.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-05 11:09 - 2013-08-05 11:09 - 00000000 ____D C:\FRST
2013-08-05 11:06 - 2013-08-05 11:08 - 00000008 _____ C:\Users\Petra\Desktop\defogger_disable.txt
2013-08-05 11:03 - 2013-08-05 11:03 - 00377856 _____ C:\Users\Petra\Downloads\gmer_2.1.19163.exe
2013-08-05 11:01 - 2013-08-05 11:01 - 01788733 _____ (Farbar) C:\Users\Petra\Downloads\FRST64.exe
2013-08-05 10:54 - 2013-08-05 11:05 - 00000472 _____ C:\Users\Petra\Downloads\defogger_disable.log
2013-08-05 10:54 - 2013-08-05 10:54 - 00000168 _____ C:\Users\Petra\defogger_reenable
2013-08-05 10:51 - 2013-08-05 10:51 - 00050477 _____ C:\Users\Petra\Downloads\Defogger.exe
2013-08-04 23:18 - 2013-08-04 23:18 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-04 23:18 - 2013-08-04 23:18 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-04 23:18 - 2013-08-04 23:18 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-04 23:18 - 2013-08-04 23:18 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-04 23:18 - 2013-08-04 23:18 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-04 23:06 - 2013-08-04 23:06 - 00000000 _____ C:\Windows\SysWOW64\sho596C.tmp
2013-08-04 21:20 - 2013-08-04 21:20 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Malwarebytes
2013-08-04 21:19 - 2013-08-04 21:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-04 21:19 - 2013-08-04 21:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-04 21:19 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-04 20:15 - 2013-08-04 20:15 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Petra\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-28 19:22 - 2012-07-26 06:03 - 02205696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll
2013-07-28 13:22 - 2013-07-28 13:28 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-07-10 17:25 - 2013-07-12 18:26 - 00000000 ____D C:\Users\Petra\Desktop\Gitarrenschule
2013-07-08 14:02 - 2013-07-08 14:02 - 00000000 _____ C:\Windows\SysWOW64\shoBFBD.tmp
2013-07-06 21:23 - 2013-07-06 21:23 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Boomzap
2013-07-06 21:20 - 2013-07-06 21:20 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Awakening - Das Himmelsschloss
2013-07-06 21:20 - 2013-07-06 21:20 - 00000000 ____D C:\Program Files (x86)\bfgclient
2013-07-06 21:18 - 2013-07-08 19:20 - 00000000 ____D C:\BigFishGamesCache

==================== One Month Modified Files and Folders =======

2013-08-05 11:08 - 2013-08-05 11:06 - 00000008 _____ C:\Users\Petra\Desktop\defogger_disable.txt
2013-08-05 11:05 - 2013-08-05 10:54 - 00000472 _____ C:\Users\Petra\Downloads\defogger_disable.log
2013-08-05 11:05 - 2009-07-14 06:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-05 11:05 - 2009-07-14 06:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-05 11:03 - 2013-08-05 11:03 - 00377856 _____ C:\Users\Petra\Downloads\gmer_2.1.19163.exe
2013-08-05 11:01 - 2013-08-05 11:01 - 01788733 _____ (Farbar) C:\Users\Petra\Downloads\FRST64.exe
2013-08-05 10:54 - 2013-08-05 10:54 - 00000168 _____ C:\Users\Petra\defogger_reenable
2013-08-05 10:54 - 2011-07-09 12:17 - 00000000 ____D C:\Users\Petra
2013-08-05 10:51 - 2013-08-05 10:51 - 00050477 _____ C:\Users\Petra\Downloads\Defogger.exe
2013-08-05 10:46 - 2012-08-14 17:27 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Skype
2013-08-05 10:43 - 2012-01-08 16:01 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-05 10:38 - 2012-04-21 13:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-05 00:50 - 2012-12-15 12:40 - 00000000 ____D C:\Users\Petra\Desktop\Programme
2013-08-05 00:49 - 2010-09-28 02:41 - 01571735 _____ C:\Windows\WindowsUpdate.log
2013-08-04 23:45 - 2012-01-08 16:01 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-04 23:45 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-04 23:45 - 2009-07-14 06:51 - 00104260 _____ C:\Windows\setupact.log
2013-08-04 23:18 - 2013-08-04 23:18 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-04 23:18 - 2013-08-04 23:18 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-04 23:18 - 2013-08-04 23:18 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-04 23:18 - 2013-08-04 23:18 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-04 23:18 - 2013-08-04 23:18 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-04 23:18 - 2012-09-03 19:13 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-08-04 23:18 - 2011-10-15 18:45 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-08-04 23:07 - 2010-09-28 02:39 - 00243500 _____ C:\Windows\PFRO.log
2013-08-04 23:06 - 2013-08-04 23:06 - 00000000 _____ C:\Windows\SysWOW64\sho596C.tmp
2013-08-04 23:00 - 2013-04-21 18:46 - 00000000 ____D C:\Users\Petra\AppData\Local\SwvUpdater
2013-08-04 22:48 - 2013-06-23 17:46 - 00083456 ___SH C:\Users\Petra\Desktop\Thumbs.db
2013-08-04 21:20 - 2013-08-04 21:20 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Malwarebytes
2013-08-04 21:19 - 2013-08-04 21:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-04 21:19 - 2013-08-04 21:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-04 20:15 - 2013-08-04 20:15 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Petra\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-03 11:38 - 2010-09-28 12:34 - 00744872 _____ C:\Windows\system32\perfh007.dat
2013-08-03 11:38 - 2010-09-28 12:34 - 00166872 _____ C:\Windows\system32\perfc007.dat
2013-08-03 11:38 - 2009-07-14 07:13 - 01748960 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-30 19:26 - 2012-01-08 16:01 - 00000000 ____D C:\Program Files (x86)\Google
2013-07-29 16:10 - 2011-07-09 12:24 - 00000000 ____D C:\Users\Petra\AppData\Roaming\TouchGadget
2013-07-28 19:21 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\spool
2013-07-28 13:44 - 2011-07-09 21:39 - 00000000 ____D C:\Users\Petra\AppData\Local\Adobe
2013-07-28 13:41 - 2012-04-21 13:03 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-28 13:41 - 2012-04-21 13:03 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-28 13:41 - 2011-07-10 00:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-28 13:30 - 2011-12-31 18:28 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-28 13:30 - 2011-12-31 18:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-28 13:28 - 2013-07-28 13:22 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-07-28 13:28 - 2012-08-14 17:14 - 00000000 ____D C:\ProgramData\Skype
2013-07-22 17:18 - 2013-05-18 20:43 - 00000000 ____D C:\Users\Petra\AppData\Roaming\.minecraft
2013-07-17 18:51 - 2012-06-23 15:59 - 00000000 ____D C:\Users\Petra\Documents\Musikgeragogik
2013-07-16 18:26 - 2011-07-10 20:33 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Audacity
2013-07-16 18:03 - 2011-09-19 10:47 - 00000000 ____D C:\Users\Petra\Documents\Josies
2013-07-16 17:08 - 2011-07-11 16:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-16 17:05 - 2011-07-10 00:26 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-14 14:38 - 2012-01-08 16:01 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-14 14:38 - 2012-01-08 16:01 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-12 18:26 - 2013-07-10 17:25 - 00000000 ____D C:\Users\Petra\Desktop\Gitarrenschule
2013-07-10 17:35 - 2011-10-09 20:03 - 00000000 ___RD C:\Users\Petra\Desktop\Games
2013-07-08 19:20 - 2013-07-06 21:18 - 00000000 ____D C:\BigFishGamesCache
2013-07-08 14:03 - 2012-09-13 16:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-08 14:02 - 2013-07-08 14:02 - 00000000 _____ C:\Windows\SysWOW64\shoBFBD.tmp
2013-07-06 21:23 - 2013-07-06 21:23 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Boomzap
2013-07-06 21:20 - 2013-07-06 21:20 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Awakening - Das Himmelsschloss
2013-07-06 21:20 - 2013-07-06 21:20 - 00000000 ____D C:\Program Files (x86)\bfgclient
2013-07-06 21:20 - 2011-07-30 22:59 - 00000000 ____D C:\Program Files (x86)\Spiele

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-14 20:42

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-08-2013
Ran by Petra at 2013-08-05 11:10:00
Running from C:\Users\Petra\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
ACCU-CHEK 360° (x32 Version: 1.0.35)
ACCU-CHEK(R) 360 (x32 Version: 1.0.23)
ACCU-CHEK® 360° – Insulinpumpen-Konfigurationssoftware (x32 Version: 1.0.23)
Acer Backup Manager (x32 Version: 2.0.0.68)
Acer Crystal Eye webcam (x32 Version: 1.0.4.3)
Acer ePower Management (x32 Version: 5.00.3005)
Acer eRecovery Management (x32 Version: 4.05.3013)
Acer GameZone Console (x32 Version: 6.1.0.9)
Acer Registration (x32 Version: 1.03.3003)
Acer ScreenSaver (x32 Version: 1.1.0423.2010)
Acer TouchPortal (x32 Version: 2.00.3007)
Acer TouchPortal (x32 Version: 4.2.8027)
Acer TouchPortal (x32 Version: 9.0.6525)
Acer Updater (x32 Version: 1.02.3001)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 1.5.0.7220)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Airport Mania First Flight (x32)
Alcor Micro USB Card Reader (x32 Version: 1.9.17.06019)
Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17)
Amazonia (x32)
AOL Toolbar (HKCU)
AOL Toolbar (x32)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.31)
Audacity 2.0 (x32)
Avira Internet Security (x32 Version: 13.0.0.3885)
Awakening: Das Himmelsschloss (x32)
Backup Manager Basic (x32 Version: 2.0.0.68)
Big Brain Wolf (x32)
Big Fish Games: Game Manager (x32 Version: 2.0.0.8)
Borland Data Engine (x32 Version: 5.2.0)
Cake Mania (x32)
CDBurnerXP (x32 Version: 4.5.0.3717)
DAEMON Tools Lite (x32 Version: 4.41.3.0173)
Das Schicksal der Marie Antoinette (x32)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Die Siedler II - Die nächste Generation (x32)
Die Siedler IV (x32)
Die Sims Mittelalter Piraten und Edelleute (x32 Version: 2.0.109)
Die*Sims*Mittelalter (x32 Version: 2.0.113)
Download Updater (AOL Inc.) (x32)
Dream Day First Home (x32)
ElsterFormular (x32 Version: 13.3.0.9066)
Farm Frenzy 2 (x32)
Free Sound Recorder v9.4.1 (x32)
Freemake Video Converter Version 2.4.0 (x32 Version: 2.4.0)
Galapago (x32)
Gitarrero Notenmeister (x32)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
Heroes of Hellas (x32)
HP Deskjet 3050 J610 series - Grundlegende Software für das Gerät (Version: 22.50.231.0)
HP Deskjet 3050 J610 series Hilfe (x32 Version: 140.0.63.63)
HP Photo Creations (x32 Version: 1.0.0.3781)
Identity Card (x32 Version: 1.00.3003)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2119)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Rapid Storage Technology (x32 Version: 9.6.0.1014)
Java 7 Update 17 (64-bit) (Version: 7.0.170)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Junk Mail filter update (x32 Version: 14.0.8089.726)
LAME v3.98.3 for Audacity (x32)
Launch Manager (x32 Version: 4.0.12)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
MediaShow Espresso (x32 Version: 5.5.1422_24072)
Mein CEWE FOTOBUCH (x32)
Merriam Websters Spell Jam (x32)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 (x32)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2005 Express Edition (ACCUCHEK360) (x32 Version: 9.4.5000.00)
Microsoft SQL Server 2005 Tools Express Edition (x32 Version: 9.4.5000.00)
Microsoft SQL Server Management Objects Collection  (Version: 9.00.1399.06)
Microsoft SQL Server Native Client (Version: 9.00.5000.00)
Microsoft SQL Server Setup Support Files (English) (x32 Version: 9.00.5000.00)
Microsoft SQL Server VSS Writer (Version: 9.00.5000.00)
Microsoft Touch Pack for Windows 7 (x32 Version: 1.0.40517.00)
Microsoft VC9 runtime libraries (x32 Version: 2.0.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0)
Microsoft XNA Framework Redistributable 3.0 (x32 Version: 3.0.11010.0)
Mozilla Firefox 19.0.2 (x86 de) (x32 Version: 19.0.2)
Mozilla Maintenance Service (x32 Version: 17.0.7)
Mozilla Thunderbird 17.0.7 (x86 de) (x32 Version: 17.0.7)
MSVCRT (x32 Version: 14.0.1468.721)
MuseScore 1.0 MuseScore score typesetter (x32 Version: 1.0.0)
MyWinLocker (x32 Version: 3.1.212.0)
MyWinLocker Suite (x32 Version: 3.1.212.0)
NTI Backup Now 5 (x32 Version: 5.1.2.630)
NTI Backup Now Standard (x32 Version: 5.1.2.630)
NTI Media Maker 8 (x32 Version: 8.0.12.6636)
NVIDIA Display Control Panel (Version: 6.14.12.5912)
NVIDIA Drivers (Version: 1.10.62.40)
NVIDIA PhysX (x32 Version: 9.10.0224)
NVIDIA Updatus (x32 Version: 1.0.3)
Optical Drive Power Management (x32 Version: 1.01.3007)
PDF24 Creator 5.2.0 (x32)
Poker Pop (x32)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6141)
Rossmann Fotowelt Software 4.12.1 (x32 Version: 4.12.1)
Samantha Swift and the Golden Touch (x32 Version: 1.1.0.0)
Samantha Swift and the Hidden Roses of Athena (x32 Version: 1.1.0.0)
Samantha Swift and the Mystery from Atlantis (x32 Version: 1.1.0.0)
Shredder (Version: 2.0.8.3)
Shredder (x32 Version: 2.0.8.3)
Skype™ 6.6 (x32 Version: 6.6.106)
Spin & Win (x32)
SRWare Iron Version SRWare Iron 18.0.1050.0 (x32 Version: SRWare Iron 18.0.1050.0)
StarTopia (x32)
Synaptics Pointing Device Driver (Version: 15.0.18.0)
System Requirements Lab (x32)
TeamViewer 5 Host (x32 Version: 5.1.13999 )
teryBar (remove only)
The Whispered World (x32 Version: 1.01)
Überwachungstool für die Intel® Turbo-Boost-Technik (Version: 1.0.186.6)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2010 (KB2494150) (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Virtual Earth 3D (Beta) (Version: 4.0.903.16005)
VLC media player 1.1.11 (x32 Version: 1.1.11)
Welcome Center (x32 Version: 1.02.3004)
Wildlife Park 2 - Meine Haustiere WildlifePark2_MeineHaustiere_DE_v2.1 (x32)
Wildlife Park 2 (x32 Version: 1.25)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)

==================== Restore Points  =========================

30-05-2013 19:03:21 Geplanter Prüfpunkt
02-06-2013 15:37:00 Installed Java 7 Update 21
13-06-2013 13:51:41 Windows Update
20-06-2013 16:03:53 Geplanter Prüfpunkt
08-07-2013 10:28:36 Geplanter Prüfpunkt
16-07-2013 15:02:25 Windows Update
04-08-2013 21:17:34 Installed Java 7 Update 25

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0AA2B357-9955-4682-B61E-AADAD7533AA0} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {318B6741-F57F-4E34-9AFD-81470A5D13D7} - System32\Tasks\{C4751739-B8F0-4D04-83B4-3AE2960EE878} => C:\Program Files (x86)\FeenvonAvalon-1.0\avalon.exe No File
Task: {588208F0-4C30-43A0-9E98-67BDB4542E40} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {678DDAED-46E8-4E43-A986-08614E868475} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-01-08] (Google Inc.)
Task: {7B820FBD-38BD-4AFA-81DB-18B086F8506B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-01-08] (Google Inc.)
Task: {8A2CB770-CAE6-4F69-B7A4-98151557032C} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2009-07-14] (Microsoft Corporation)
Task: {99478CAE-C68B-4D74-86C6-39F5C285E8B2} - System32\Tasks\{EF91E30F-B79E-46CE-B360-A35091DB9FBA} => G:\setup.exe No File
Task: {BCEE523E-2DF4-4E3D-8262-7D2A7A5BAAE7} - System32\Tasks\{F03AA122-E738-4E2D-92A6-1D4459B6FA3F} => G:\setup.exe No File
Task: {C819D148-2C8C-44D2-A24D-E53CA32DF07A} - System32\Tasks\{CA9F0014-A86F-46ED-A246-977592CA0913} => G:\setup.exe No File
Task: {CC41572C-6F7C-4DAB-BAB8-9AAD2C7BE4AE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-28] (Adobe Systems Incorporated)
Task: {D84209E0-6128-4230-A017-8D249DEA647D} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {F3F60120-6300-4AD3-A046-3EC1763FB482} - System32\Tasks\{58730461-0229-4841-93BB-8BD90851E1AF} => c:\program files (x86)\mozilla firefox\firefox.exe [2013-03-09] (Mozilla Corporation)
Task: {FD42BB78-53B4-4ABC-AA42-94DCE898B9EA} - System32\Tasks\{AC2F52B3-9927-49E5-AD5A-F97A6B2720D0} => C:\Program Files (x86)\FeenvonAvalon-1.0\avalon.exe No File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============

Name: Atheros AR8151 PCI-E Gigabit Ethernet Controller (NDIS 6.20)
Description: Atheros AR8151 PCI-E Gigabit Ethernet Controller (NDIS 6.20)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Atheros
Service: L1C
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/04/2013 07:00:36 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (07/29/2013 04:13:21 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: CLMLSvc.exe, Version: 2.3.2809.0, Zeitstempel: 0x4bc6fe21
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x638ce54b
ID des fehlerhaften Prozesses: 0x1844
Startzeit der fehlerhaften Anwendung: 0xCLMLSvc.exe0
Pfad der fehlerhaften Anwendung: CLMLSvc.exe1
Pfad des fehlerhaften Moduls: CLMLSvc.exe2
Berichtskennung: CLMLSvc.exe3

Error: (07/28/2013 07:20:53 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (07/22/2013 11:58:46 AM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (07/14/2013 08:44:11 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/14/2013 07:35:50 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (07/08/2013 02:50:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: javaw.exe, Version: 7.0.210.11, Zeitstempel: 0x515d68ec
Name des fehlerhaften Moduls: igd10umd32.dll, Version: 8.15.10.2119, Zeitstempel: 0x4bcf3d42
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00054004
ID des fehlerhaften Prozesses: 0x1750
Startzeit der fehlerhaften Anwendung: 0xjavaw.exe0
Pfad der fehlerhaften Anwendung: javaw.exe1
Pfad des fehlerhaften Moduls: javaw.exe2
Berichtskennung: javaw.exe3

Error: (07/08/2013 00:26:13 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (07/08/2013 00:24:43 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/07/2013 10:19:34 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: javaw.exe, Version: 7.0.210.11, Zeitstempel: 0x515d68ec
Name des fehlerhaften Moduls: igd10umd32.dll, Version: 8.15.10.2119, Zeitstempel: 0x4bcf3d42
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00054004
ID des fehlerhaften Prozesses: 0x440
Startzeit der fehlerhaften Anwendung: 0xjavaw.exe0
Pfad der fehlerhaften Anwendung: javaw.exe1
Pfad des fehlerhaften Moduls: javaw.exe2
Berichtskennung: javaw.exe3


System errors:
=============
Error: (08/04/2013 11:46:38 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (08/04/2013 11:08:29 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (08/03/2013 00:16:01 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (08/03/2013 00:15:44 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NTI Backup Now 5 Scheduler Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/03/2013 00:15:44 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst NTI Backup Now 5 Scheduler Service erreicht.

Error: (07/28/2013 07:21:50 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Druckererweiterungen und -benachrichtigungen" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (07/28/2013 01:32:11 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (07/28/2013 01:31:58 PM) (Source: NetBT) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.3.8
registriert werden. Der Computer mit IP-Adresse 192.168.3.4 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (07/16/2013 04:58:12 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (07/08/2013 10:33:34 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.


Microsoft Office Sessions:
=========================
Error: (08/04/2013 07:00:36 PM) (Source: Windows Backup)(User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (07/29/2013 04:13:21 PM) (Source: Application Error)(User: )
Description: CLMLSvc.exe2.3.2809.04bc6fe21unknown0.0.0.000000000c0000005638ce54b184401ce8c65acf725ceC:\Program Files (x86)\Acer\Acer TouchPortal\Acer TouchPortal\Kernel\CLML\CLMLSvc.exeunknown05bb1d74-f859-11e2-86c0-d59becab1c2d

Error: (07/28/2013 07:20:53 PM) (Source: Windows Backup)(User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (07/22/2013 11:58:46 AM) (Source: Windows Backup)(User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (07/14/2013 08:44:11 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (07/14/2013 07:35:50 PM) (Source: Windows Backup)(User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (07/08/2013 02:50:14 PM) (Source: Application Error)(User: )
Description: javaw.exe7.0.210.11515d68ecigd10umd32.dll8.15.10.21194bcf3d42c000000500054004175001ce7bd3a8a24dcfC:\Windows\SysWOW64\javaw.exeC:\Windows\system32\igd10umd32.dllee4976ba-e7cc-11e2-be78-920cf383022b

Error: (07/08/2013 00:26:13 PM) (Source: SideBySide)(User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8

Error: (07/08/2013 00:24:43 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (07/07/2013 10:19:34 PM) (Source: Application Error)(User: )
Description: javaw.exe7.0.210.11515d68ecigd10umd32.dll8.15.10.21194bcf3d42c00000050005400444001ce7b489719e9a6C:\Windows\SysWOW64\javaw.exeC:\Windows\system32\igd10umd32.dll896208e3-e742-11e2-9365-cb34bd24992e


==================== Memory info =========================== 

Percentage of memory in use: 48%
Total physical RAM: 3766.68 MB
Available physical RAM: 1933.33 MB
Total Pagefile: 7531.49 MB
Available Pagefile: 5419.11 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:450.66 GB) (Free:336.4 GB) NTFS (Disk=0 Partition=3)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 80D3A652)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=451 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-05 11:32:10
Windows 6.1.7600  x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Petra\AppData\Local\Temp\kwloapob.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076dc1465 2 bytes [DC, 76]
.text   C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000076dc14bb 2 bytes [DC, 76]
.text   ...                                                                                                                                             * 2
.text   C:\Program Files (x86)\Skype\Phone\Skype.exe[4460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000076dc1465 2 bytes [DC, 76]
.text   C:\Program Files (x86)\Skype\Phone\Skype.exe[4460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     0000000076dc14bb 2 bytes [DC, 76]
.text   ...                                                                                                                                             * 2
.text   C:\Program Files (x86)\Skype\Phone\Skype.exe[4460] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35                                              0000000073bb11a8 2 bytes [BB, 73]
.text   C:\Program Files (x86)\Skype\Phone\Skype.exe[4460] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21                                        0000000073bb13a8 2 bytes [BB, 73]
.text   C:\Program Files (x86)\Skype\Phone\Skype.exe[4460] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21                                            0000000073bb1422 2 bytes [BB, 73]
.text   C:\Program Files (x86)\Skype\Phone\Skype.exe[4460] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19                                     0000000073bb1498 2 bytes [BB, 73]

---- Threads - GMER 2.1 ----

Thread  C:\Windows\Explorer.EXE [524:4804]                                                                                                              000007fef3331ebc
Thread  C:\Windows\Explorer.EXE [524:4392]                                                                                                              000007fef1172118
Thread  C:\Windows\Explorer.EXE [524:4308]                                                                                                              000007fefb032f9c
Thread  C:\Windows\Explorer.EXE [524:3804]                                                                                                              000007fef172a1b8
Thread  C:\Windows\Explorer.EXE [524:1192]                                                                                                              000007fefb032f9c
Thread  C:\Windows\Explorer.EXE [524:3684]                                                                                                              000007fefb032f9c
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2340]                                                         00000000778a2e3e
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2420]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2424]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2428]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2432]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2436]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2440]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2444]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2448]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2452]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2456]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2524]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2528]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2536]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2592]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2600]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2612]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2616]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2668]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2672]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2928]                                                         00000000778a3e59
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:3272]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:3288]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:3316]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:4656]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:5736]                                                         000000006bf91c2f
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:5792]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:1016]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:2664]                                                         00000000778a3e59
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:4132]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:6036]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:5480]                                                         00000000727c29e1
Thread  c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2200:4856]                                                         00000000727c29e1
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2904:2916]                                                       00000000778a3e59
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2904:2920]                                                       0000000076c47587
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2904:2924]                                                       00000000778a2e3e
Thread  c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe [3020:3028]                                                                00000000778a3e59
Thread  c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe [3020:3036]                                                                0000000076c47587
Thread  c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe [3020:3052]                                                                00000000778a2e3e
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3240]                                                      00000000778a3e59
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3244]                                                      0000000076c47587
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3248]                                                      00000000778a2e3e
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3252]                                                      000000007364345e
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3256]                                                      000000007084102d
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3264]                                                      000000007364345e
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3268]                                                      000000007054f1dc
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3308]                                                      000000007054f1dc
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3312]                                                      00000000705455d3
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3348]                                                      000000007364345e
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3384]                                                      00000000707ec159
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3388]                                                      000000007364345e
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3168:3576]                                                      000000007364345e

---- EOF - GMER 2.1 ----