Windows 7: Computer plötzlich langsam/Fehlermeldungen tauchen auf

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:55 on 03/09/2013 (*****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-09-2013
Ran by **** at 2013-09-03 15:00:32
Running from C:\Users\****\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
ActiveCheck component for HP Active Support Library (Version: 3.0.0.2)
Adobe Flash Player 11 ActiveX (Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (Version: 11.8.800.94)
Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7)
Adobe Shockwave Player (Version: 11.0)
AMD USB Audio Driver Filter (Version: 1.0.7.0031)
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
Atheros Driver Installation Program (Version: 5.0)
ATI Catalyst Install Manager (Version: 3.0.691.0)
Avira Free Antivirus (Version: 13.0.0.4045)
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Core Implementation (Version: 2008.0917.337.4556)
Catalyst Control Center Graphics Full Existing (Version: 2008.0917.337.4556)
Catalyst Control Center Graphics Full New (Version: 2008.0917.337.4556)
Catalyst Control Center Graphics Light (Version: 2008.0917.337.4556)
Catalyst Control Center Graphics Previews Common (Version: 2008.0917.337.4556)
Catalyst Control Center Graphics Previews Vista (Version: 2008.0917.337.4556)
Catalyst Control Center InstallProxy (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Chinese Standard (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Chinese Traditional (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Czech (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Danish (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Dutch (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Finnish (Version: 2008.0917.337.4556)
Catalyst Control Center Localization French (Version: 2008.0917.337.4556)
Catalyst Control Center Localization German (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Greek (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Hungarian (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Italian (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Japanese (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Korean (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Norwegian (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Polish (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Portuguese (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Russian (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Spanish (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Swedish (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Thai (Version: 2008.0917.337.4556)
Catalyst Control Center Localization Turkish (Version: 2008.0917.337.4556)
CCC Help Chinese Standard (Version: 2008.0917.0336.4556)
CCC Help Chinese Traditional (Version: 2008.0917.0336.4556)
CCC Help Czech (Version: 2008.0917.0336.4556)
CCC Help Danish (Version: 2008.0917.0336.4556)
CCC Help Dutch (Version: 2008.0917.0336.4556)
CCC Help English (Version: 2008.0917.0336.4556)
CCC Help Finnish (Version: 2008.0917.0336.4556)
CCC Help French (Version: 2008.0917.0336.4556)
CCC Help German (Version: 2008.0917.0336.4556)
CCC Help Greek (Version: 2008.0917.0336.4556)
CCC Help Hungarian (Version: 2008.0917.0336.4556)
CCC Help Italian (Version: 2008.0917.0336.4556)
CCC Help Japanese (Version: 2008.0917.0336.4556)
CCC Help Korean (Version: 2008.0917.0336.4556)
CCC Help Norwegian (Version: 2008.0917.0336.4556)
CCC Help Polish (Version: 2008.0917.0336.4556)
CCC Help Portuguese (Version: 2008.0917.0336.4556)
CCC Help Russian (Version: 2008.0917.0336.4556)
CCC Help Spanish (Version: 2008.0917.0336.4556)
CCC Help Swedish (Version: 2008.0917.0336.4556)
CCC Help Thai (Version: 2008.0917.0336.4556)
CCC Help Turkish (Version: 2008.0917.0336.4556)
ccc-core-static (Version: 2008.0917.337.4556)
ccc-utility (Version: 2008.0917.337.4556)
Cisco EAP-FAST Module (Version: 2.1.6)
Cisco LEAP Module (Version: 1.0.12)
Cisco PEAP Module (Version: 1.0.13)
Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000)
CyberLink DVD Suite (Version: 6.0.2126)
DivX-Setup (Version: 2.6.1.44)
ESU for Microsoft Vista (Version: 1.0.0)
Google Update Helper (Version: 1.3.21.153)
GPL Ghostscript 8.71
HP Active Support Library (Version: 3.1.6.1)
HP Customer Experience Enhancements (Version: 5.7.0.2664)
HP Doc Viewer (Version: 1.03.0001)
HP Help and Support (Version: 2.1.0.0)
HP MediaSmart DVD (Version: 2.0.2126)
HP MediaSmart Music/Photo/Video (Version: 2.0.2125)
HP MediaSmart SmartMenu (Version: 2.0.9)
HP MediaSmart Webcam (Version: 2.0.0926)
HP Quick Launch Buttons 6.40 J1 (Version: 6.40 J1)
HP Total Care Advisor (Version: 2.4.4941.2798)
HP Update (Version: 4.000.010.008)
HP User Guides 0128 (Version: 1.00.0000)
HP Wireless Assistant (Version: 3.00 K2)
HPAsset component for HP Active Support Library (Version: 3.0.2.2)
HPNetworkAssistant (Version: 1.1.70)
HPTCSSetup (Version: 1.1.1963.2799)
IDT Audio (Version: 1.0.6087.0)
iTunes (Version: 11.0.5.5)
Java 2 Runtime Environment Standard Edition v1.3.1
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Java(TM) 6 Update 22 (Version: 6.0.220)
Java(TM) 6 Update 31 (Version: 6.0.310)
Java(TM) 6 Update 7 (Version: 1.6.0.70)
JavaFX 2.1.1 (Version: 2.1.1)
JMicron JMB38X Flash Media Controller (Version: 1.00.18.07)
LabelPrint (Version: 2.5.0919)
LightScribe System Software  1.14.17.1 (Version: 1.14.17.1)
LightScribe Template Designs - Art Pack 1 (Version: 1.10.16.1)
LightScribe Template Labeler (Version: 1.18.15.1)
Malwarebytes' Anti-Malware Version 1.51.2.1300 (Version: 1.51.2.1300)
McAfee Security Scan Plus (Version: 3.0.318.3)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Works (Version: 9.7.0621)
Mozilla Firefox 23.0.1 (x86 de) (Version: 23.0.1)
Mozilla Maintenance Service (Version: 23.0.1)
Mozilla Thunderbird 17.0.8 (x86 de) (Version: 17.0.8)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
My HP Games (Version: 1.0.0.62)
OpenOffice.org 3.3 (Version: 3.3.9567)
Picasa 3 (Version: 3.9)
ProtectSmart Hard Drive Protection (Version: 3.10 A7)
QuickTime (Version: 7.74.80.86)
RealDownloader (Version: 1.3.2)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0)
Realtek 8169 8168 8101E 8102E Ethernet Driver (Version: 1.00.0000)
RealUpgrade 1.1 (Version: 1.1.0)
RedMon - Redirection Port Monitor
Riding Star
Skins (Version: 2008.0917.337.4556)
Skype Click to Call (Version: 5.9.9216)
Skype™ 6.5 (Version: 6.5.158)
Spotify (HKCU Version: 0.9.1.57.ge7405149)
Synaptics Pointing Device Driver (Version: 15.3.29.0)
Tuned!
Uninstall 1.0.0.1
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
v2011.build.44 (Version: v2011.build.44)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)
Windows-Treiberpaket - ENE (enecir) HIDClass  (09/04/2008 2.6.0.0) (Version: 09/04/2008 2.6.0.0)
 

==================== Restore Points  =========================

26-08-2013 10:20:05 Windows Update
30-08-2013 09:16:57 Windows Update

==================== Hosts content: ==========================

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {07BB0040-0092-4F37-81D9-F2942B95941B} - System32\Tasks\Registration => C:\Program Files\Hewlett-Packard\HP TCS\RemEngine.exe [2008-10-01] ()
Task: {0D9B5D92-3A22-486D-A887-3AA21597CF27} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => start w32time task_started
Task: {13468E21-033B-4636-9D99-BB4C0E1E5EAB} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {17A20BC9-E9C1-4352-82EC-D3194B34FD2A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-21] (Adobe Systems Incorporated)
Task: {18B25E74-17D3-4E81-B806-BC7BA722792A} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {19EA7286-7041-45AE-8777-D44C908C9A1B} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {1ADBD7CF-F31C-448D-904A-28A86A7840E5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-05-23] (Google Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {4109B1E4-6FCF-4852-BC21-5AD60F40822D} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3123067234-1252295722-1380579481-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {5244F16D-0FE6-4835-A32B-EAA9C12A6C9A} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3123067234-1252295722-1380579481-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {561375CB-FF5A-417B-B297-BA73DE149581} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs No File
Task: {81E49E3F-B3A6-4B9C-BDB6-34226F3DFA34} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3123067234-1252295722-1380579481-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {CF761036-FF5F-413C-8CE5-B43A239C8B86} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3123067234-1252295722-1380579481-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs No File
Task: {EE1F4EB0-0F9C-46F1-AAED-8C2794740647} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-06-16] (Hewlett-Packard)
Task: {F4DA6EC3-20F9-4808-9590-E4E643EBE6FA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-05-23] (Google Inc.)
Task: {FED9D612-DDC0-42D6-8BC7-E5036ACE5C79} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2010-11-20] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2009-07-14 00:09 - 2009-08-18 03:31 - 02469888 _____ (ATI Technologies Inc. ) C:\Windows\system32\atidxx32.dll
2008-10-03 10:49 - 2008-10-03 10:49 - 00016688 _____ ( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP MediaSmart\HPShared32.dll
2012-09-16 21:07 - 2012-09-16 21:07 - 03781960 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfc90u.dll
2012-09-16 21:07 - 2012-09-16 21:07 - 00063312 _____ (Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_49768ef57548175e\MFC90DEU.DLL
2011-06-11 01:58 - 2011-06-11 01:58 - 04422992 _____ (Microsoft Corporation) C:\Windows\system32\mfc100u.dll
2011-06-11 01:58 - 2011-06-11 01:58 - 00773968 _____ (Microsoft Corporation) C:\Windows\system32\MSVCR100.dll
2011-06-11 01:58 - 2011-06-11 01:58 - 00421200 _____ (Microsoft Corporation) C:\Windows\system32\MSVCP100.dll
2011-06-11 01:58 - 2011-06-11 01:58 - 00064336 _____ (Microsoft Corporation) C:\Windows\system32\MFC100DEU.DLL
2011-04-08 13:46 - 2010-11-20 14:20 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\SPPC.DLL
2009-07-14 02:07 - 2009-07-14 03:14 - 00064000 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm
2010-05-27 22:31 - 2011-10-14 04:36 - 00177448 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll
2011-10-14 04:36 - 2011-10-14 04:36 - 00173352 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll
2008-08-06 16:27 - 2008-11-03 08:10 - 00505392 _____ (Microsoft Corporation) C:\Windows\system32\MSVCP71.dll
2008-08-06 16:29 - 2008-11-03 08:10 - 00353840 _____ (Microsoft Corporation) C:\Windows\system32\MSVCR71.dll
2008-09-25 19:42 - 2008-09-25 19:42 - 00881960 _____ () C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
2009-02-26 16:45 - 2009-02-26 16:45 - 00043392 _____ (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL
2011-04-08 13:46 - 2010-11-20 14:08 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.dll
2008-11-03 08:10 - 2008-11-03 08:10 - 01053232 _____ (Microsoft Corporation) C:\Windows\system32\MFC71U.DLL
2008-11-03 07:26 - 2008-09-05 13:19 - 00300336 _____ (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBSERVICE.DLL
2013-07-10 18:00 - 2013-04-24 00:57 - 05932696 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
2013-07-10 22:42 - 2013-07-10 22:42 - 11499520 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll
2009-07-13 22:46 - 2009-06-10 23:23 - 00074064 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
2013-08-17 22:37 - 2013-08-17 22:37 - 07989760 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll
2013-08-17 22:37 - 2013-08-17 22:37 - 03348480 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1f6f220f9efe936d1158c79b9d4b451f\WindowsBase.ni.dll
2013-08-17 22:38 - 2013-08-17 22:38 - 12238336 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\585b8f6cc7ba86886462d0dc9753c98f\PresentationCore.ni.dll
2013-08-17 22:38 - 2013-08-17 22:38 - 14340096 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\930e99b2f62cea8c4aa070527d15f748\PresentationFramework.ni.dll
2013-07-10 18:00 - 2013-04-20 00:55 - 01737376 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\wpfgfx_v0300.dll
2013-01-15 12:44 - 2012-10-05 12:53 - 00364656 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
2009-06-10 23:19 - 2009-08-18 03:20 - 03105280 _____ (ATI Technologies Inc. ) C:\Windows\system32\atiumdag.dll
2009-07-14 00:09 - 2009-08-18 03:05 - 02868736 _____ (ATI Technologies Inc. ) C:\Windows\system32\atiumdva.dll
2013-07-10 22:46 - 2013-07-10 22:46 - 00368128 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a2920ed81e097f8551231a9350697bbd\PresentationFramework.Aero.ni.dll
2009-08-06 23:57 - 2009-08-06 23:57 - 00249856 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
2013-08-17 22:45 - 2013-08-17 22:45 - 01670144 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\27ea7ac7d265bd9fb73f1b43da0f4569\Microsoft.VisualBasic.ni.dll
2013-08-17 22:38 - 2013-08-17 22:38 - 01593344 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll
2013-08-17 22:38 - 2013-08-17 22:38 - 12436480 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\28ea347a952d20959ac6ae02d7457d39\System.Windows.Forms.ni.dll
2013-08-17 22:37 - 2013-08-17 22:37 - 05464064 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll
2011-04-14 13:42 - 2010-11-13 01:19 - 00315392 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
2013-08-17 22:37 - 2013-08-17 22:37 - 00978432 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\8f7d83126a3cf283e5ac97f2d6d99f12\System.Configuration.ni.dll
2008-10-03 10:53 - 2008-10-03 10:53 - 00020784 _____ (TODO: <Company name>) C:\Program Files\Hewlett-Packard\HP MediaSmart\ShareVol32.dll
2013-08-17 22:39 - 2013-08-17 22:39 - 06611456 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\764054efc88f51b54c8d7e44df26b671\System.Data.ni.dll
2011-04-08 13:47 - 2010-11-05 03:58 - 02927616 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
2009-08-06 23:56 - 2009-08-06 23:56 - 00061440 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll
2009-08-06 23:57 - 2009-08-06 23:57 - 00110592 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll
2009-07-14 02:35 - 2009-06-10 23:14 - 00778096 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2009-07-14 01:26 - 2009-07-14 03:15 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\msctfui.dll
2010-01-10 16:49 - 2010-03-23 14:53 - 03354624 _____ (IDT, Inc.) C:\Program Files\IDT\WDM\STLang.dll
2010-03-23 14:53 - 2010-03-23 14:53 - 00527872 _____ (IDT, Inc.) C:\Windows\system32\stapi32.dll
2013-02-13 04:38 - 2013-02-13 04:38 - 00100688 _____ () C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 00053024 _____ (Open Source Software community project) C:\Program Files\Common Files\Apple\Apple Application Support\pthreadVC2.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01291552 _____ (The ICU Project) C:\Program Files\Common Files\Apple\Apple Application Support\libicuin.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 00922912 _____ (The ICU Project) C:\Program Files\Common Files\Apple\Apple Application Support\libicuuc.dll
2011-09-27 07:22 - 2011-09-27 07:22 - 16303976 _____ (The ICU Project) C:\Program Files\Common Files\Apple\Apple Application Support\icudt46.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-08-15 00:02 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-04-06 22:38 - 2013-04-06 22:38 - 01988096 _____ (Microsoft Corporation) C:\Windows\system32\D3D10Warp.dll
2009-07-14 01:28 - 2009-07-14 03:15 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\D3DIM700.DLL
2009-07-14 02:02 - 2009-07-14 03:15 - 01415168 _____ (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InkObj.dll
2013-08-17 23:36 - 2013-08-17 23:36 - 03551640 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-07-23 01:59 - 2013-07-23 01:59 - 16166280 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll
2013-08-07 09:41 - 2013-08-07 09:41 - 02244504 _____ () C:\Program Files\Mozilla Thunderbird\mozjs.dll
2013-08-07 09:41 - 2013-08-07 09:41 - 00158104 _____ () C:\Program Files\Mozilla Thunderbird\NSLDAP32V60.dll
2013-08-07 09:41 - 2013-08-07 09:41 - 00022424 _____ () C:\Program Files\Mozilla Thunderbird\NSLDAPPR32V60.dll
2013-08-07 09:41 - 2013-08-07 09:41 - 00579480 _____ (sqlite.org) C:\Program Files\Mozilla Thunderbird\mozsqlite3.dll

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\Users\****\Thumbs.db:encryptable
AlternateDataStreams: C:\Users\****\Documents\Thumbs.db:encryptable

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/03/2013 02:29:48 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/03/2013 02:29:38 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xfe0
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (09/02/2013 07:15:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00011380
ID des fehlerhaften Prozesses: 0xb20
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (09/02/2013 07:14:38 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2013 10:41:20 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00011380
ID des fehlerhaften Prozesses: 0xfd4
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (09/02/2013 10:40:41 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/01/2013 07:47:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00011380
ID des fehlerhaften Prozesses: 0xc60
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (09/01/2013 07:45:39 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/31/2013 11:15:56 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/30/2013 05:11:50 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00011380
ID des fehlerhaften Prozesses: 0xf34
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3


System errors:
=============
Error: (09/03/2013 02:29:45 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/03/2013 02:29:44 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.

Error: (09/03/2013 02:28:14 PM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (09/03/2013 02:28:14 PM) (Source: atikmdag) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (09/02/2013 07:13:05 PM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (09/02/2013 07:13:05 PM) (Source: atikmdag) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (09/02/2013 01:55:52 PM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (09/02/2013 11:41:45 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (09/02/2013 11:41:45 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (09/02/2013 11:41:45 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 3069.84 MB
Available physical RAM: 1739.29 MB
Total Pagefile: 6137.96 MB
Available Pagefile: 4534.66 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.95 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:287.49 GB) (Free:130.77 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:10.6 GB) (Free:1.79 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 71D96AAA)
Partition 1: (Active) - (Size=287 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=11 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-09-2013
Ran by **** (administrator) on STAPLES-PC on 03-09-2013 14:58:29
Running from C:\Users\****\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(CyberLink Corp.) C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Spotify Ltd) C:\Users\****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
() C:\Program Files\SMINST\BLService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
() C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [CLMLServer for HP TouchSmart] - C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [189736 2008-09-25] (CyberLink)
HKLM\...\Run: [DVDAgent] - C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe [1148200 2008-09-26] (CyberLink Corp.)
HKLM\...\Run: [HP Health Check Scheduler] - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [75008 2008-06-16] (Hewlett-Packard)
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM\...\Run: [hpWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [488752 2008-04-15] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [QlbCtrl.exe] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [206128 2008-09-05] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [SmartMenu] - C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [912688 2008-10-03] (Hewlett-Packard)
HKLM\...\Run: [TSMAgent] - C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe [1152296 2008-09-25] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] - C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM\...\Run: [UpdateLBPShortCut] - C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] - C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2008-09-26] (CyberLink Corp.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [495708 2010-03-23] (IDT, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [DivXMediaServer] - C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-05-20] (DivX, LLC)
HKLM\...\Run: [DivXUpdate] - C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [TkBellExe] - c:\program files\real\realplayer\Update\realsched.exe [295512 2013-06-15] (RealNetworks, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [144384 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-10] (Spotify Ltd)
HKU\staples\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2008-06-09] (Hewlett-Packard Company)
HKU\staples\...\Run: [HPAdvisor] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [ 2008-09-30] (Hewlett-Packard)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
SearchScopes: HKLM - DefaultScope {C6B4804F-7101-4AD6-96E3-4BEBA5045EE9} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM - {75D6318D-D0EC-4D3C-9AD0-689B2E6FB7E6} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM - {A43F9121-F1E4-4ABE-B427-D928A440C0E9} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM - {C6B4804F-7101-4AD6-96E3-4BEBA5045EE9} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKCU - DefaultScope {C6B4804F-7101-4AD6-96E3-4BEBA5045EE9} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKCU - {75D6318D-D0EC-4D3C-9AD0-689B2E6FB7E6} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - {A43F9121-F1E4-4ABE-B427-D928A440C0E9} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKCU - {C6B4804F-7101-4AD6-96E3-4BEBA5045EE9} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\kju4kjm5.default
FF user.js: detected! => C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\kju4kjm5.default\user.js
FF Homepage: hxxp://facehunter.blogspot.com/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=16.0.2.32 - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.2.32 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Linda\AppData\Roaming\Mozilla\Firefox\Profiles\kju4kjm5.default\Extensions\foxsplitter@piro.sakura.ne.jp
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Linda\AppData\Roaming\Mozilla\Firefox\Profiles\kju4kjm5.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: No Name - C:\Users\Linda\AppData\Roaming\Mozilla\Firefox\Profiles\kju4kjm5.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup:       "urls_to_restore_on_startup": [  ]
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-06-16] (Hewlett-Packard)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] ()
R2 Recovery Service for Windows; C:\Program Files\SMINST\BLService.exe [365952 2008-10-06] ()
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe [229458 2010-03-23] (IDT, Inc.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-24] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-24] (Avira GmbH)
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl [59376 2008-09-26] (Cyberlink Corp.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-03 14:57 - 2013-09-03 14:57 - 01084685 _____ (Farbar) C:\Users\****\Desktop\FRST.exe
2013-09-03 14:55 - 2013-09-03 14:55 - 00000472 _____ C:\Users\****\Desktop\defogger_disable.log
2013-09-03 14:55 - 2013-09-03 14:55 - 00000000 _____ C:\Users\****\defogger_reenable
2013-09-03 14:54 - 2013-09-03 14:54 - 00050477 _____ C:\Users\****\Desktop\Defogger.exe
2013-09-03 14:29 - 2013-09-03 14:29 - 95587704 _____ C:\Windows\system32\㕒៦ᵌb
2013-09-02 00:14 - 2013-09-02 00:14 - 00003749 _____ C:\Users\****\Downloads\BAfoEG_Formblatt6_Linda_Huke.dgef
2013-09-01 20:33 - 2013-09-01 20:34 - 00000000 ____D C:\Users\****\Desktop\*****
2013-09-01 20:33 - 2013-09-01 20:33 - 00003301 _____ C:\Users\****\Downloads\******.dgef
2013-09-01 20:28 - 2013-09-01 20:28 - 00007717 _____ C:\Users\****\Downloads\*****.dgef
2013-08-20 11:15 - 2013-08-20 11:16 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-20 11:15 - 2013-08-20 11:16 - 00000000 ____D C:\Program Files\iTunes
2013-08-20 11:15 - 2013-08-20 11:15 - 00000000 ____D C:\Program Files\iPod
2013-08-19 12:09 - 2013-09-02 20:30 - 00018330 _____ C:\Users\****\Desktop\*****.odt
2013-08-17 23:36 - 2013-08-17 23:36 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-15 00:09 - 2013-08-17 22:31 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 00:02 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 00:02 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 00:02 - 2013-07-26 05:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 00:02 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 00:02 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 00:02 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 00:02 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 00:02 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 00:02 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 00:02 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 00:02 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 00:02 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 00:02 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 00:02 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 00:01 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 00:01 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 13:09 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 13:09 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 13:09 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 13:09 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 13:09 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 13:09 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 13:09 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 13:09 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 13:08 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 13:08 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 13:08 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 13:08 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 16:51 - 2013-08-13 16:51 - 00356935 _____ C:\Users\Linda\Downloads\CaroLeila-16-Kazimierz.m4r
2013-08-07 09:41 - 2013-08-07 16:28 - 00000000 ____D C:\Program Files\Mozilla Thunderbird

==================== One Month Modified Files and Folders =======

2013-09-03 14:58 - 2013-09-03 14:58 - 00000000 ____D C:\FRST
2013-09-03 14:57 - 2013-09-03 14:57 - 01084685 _____ (Farbar) C:\Users\****\Desktop\FRST.exe
2013-09-03 14:55 - 2013-09-03 14:55 - 00000472 _____ C:\Users\****\Desktop\defogger_disable.log
2013-09-03 14:55 - 2013-09-03 14:55 - 00000000 _____ C:\Users\****\defogger_reenable
2013-09-03 14:55 - 2010-01-10 16:52 - 00000000 ____D C:\Users\****
2013-09-03 14:54 - 2013-09-03 14:54 - 00050477 _____ C:\Users\****\Desktop\Defogger.exe
2013-09-03 14:41 - 2012-04-03 21:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-03 14:40 - 2010-05-23 17:47 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-03 14:36 - 2010-01-10 16:48 - 00011440 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 14:36 - 2010-01-10 16:48 - 00011440 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 14:32 - 2010-01-10 18:01 - 01371570 _____ C:\Windows\WindowsUpdate.log
2013-09-03 14:29 - 2013-09-03 14:29 - 95587704 _____ C:\Windows\system32\㕒៦ᵌb
2013-09-03 14:28 - 2010-05-23 17:47 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-03 14:28 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-03 14:28 - 2009-07-14 06:39 - 10385326 _____ C:\Windows\setupact.log
2013-09-02 20:30 - 2013-08-19 12:09 - 00018330 _____ C:\Users\****\Desktop\****.odt
2013-09-02 00:14 - 2013-09-02 00:14 - 00003749 _____ C:\Users\****\Downloads\*****.dgef
2013-09-01 20:34 - 2013-09-01 20:33 - 00000000 ____D C:\Users\****\Desktop\*****
2013-09-01 20:33 - 2013-09-01 20:33 - 00003301 _____ C:\Users\****\Downloads\*****.dgef
2013-09-01 20:28 - 2013-09-01 20:28 - 00007717 _____ C:\Users\****\Downloads\*****.dgef
2013-09-01 19:52 - 2010-01-10 18:14 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-30 18:27 - 2009-12-03 19:11 - 00000000 ____D C:\Users\****\AppData\Roaming\Skype
2013-08-30 17:19 - 2012-10-17 16:23 - 00000000 ____D C:\Users\****\****
2013-08-30 11:31 - 2010-05-21 07:24 - 00007608 _____ C:\Users\Linda\AppData\Local\Resmon.ResmonCfg
2013-08-26 12:14 - 2011-05-03 11:20 - 00000000 ____D C:\Users\****\****
2013-08-22 10:01 - 2010-01-10 17:44 - 00027818 _____ C:\Windows\PFRO.log
2013-08-22 09:20 - 2008-11-03 07:09 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-08-22 09:17 - 2008-11-03 08:10 - 00000000 ____D C:\Program Files\CyberLink
2013-08-22 09:11 - 2009-11-24 20:10 - 00000000 ____D C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-08-22 09:09 - 2008-11-03 08:10 - 00000000 ____D C:\ProgramData\CyberLink
2013-08-22 09:05 - 2008-11-03 07:30 - 00000000 ____D C:\ProgramData\WildTangent
2013-08-22 09:05 - 2008-11-03 07:30 - 00000000 ____D C:\Program Files\HP Games
2013-08-22 08:58 - 2010-02-14 18:37 - 00000000 ____D C:\Program Files\Google
2013-08-22 08:57 - 2011-03-14 21:11 - 00000000 ____D C:\Program Files\Acro Software
2013-08-21 17:41 - 2012-04-03 21:20 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-08-21 17:41 - 2011-05-19 16:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-08-21 12:47 - 2009-05-20 12:34 - 00000052 _____ C:\Windows\system32\DOErrors.log
2013-08-20 11:16 - 2013-08-20 11:15 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-20 11:16 - 2013-08-20 11:15 - 00000000 ____D C:\Program Files\iTunes
2013-08-20 11:15 - 2013-08-20 11:15 - 00000000 ____D C:\Program Files\iPod
2013-08-20 11:15 - 2010-01-10 23:29 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-08-20 11:02 - 2013-05-07 19:07 - 00066144 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-20 11:02 - 2013-04-25 22:38 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-20 11:02 - 2013-04-25 22:38 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-19 19:23 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-08-19 11:59 - 2012-05-08 19:27 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-18 11:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-08-17 23:36 - 2013-08-17 23:36 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-17 23:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-17 22:31 - 2013-08-15 00:09 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 00:08 - 2010-01-22 19:15 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-15 00:08 - 2008-11-03 08:01 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-14 22:04 - 2011-11-14 00:56 - 00000000 ____D C:\Program Files\Common Files\DivX Shared
2013-08-14 22:04 - 2011-03-03 00:48 - 00000000 ____D C:\Program Files\DivX
2013-08-14 22:04 - 2011-03-03 00:47 - 00000000 ____D C:\ProgramData\DivX
2013-08-14 22:02 - 2013-06-24 10:19 - 00000000 _____ C:\END
2013-08-13 16:51 - 2013-08-13 16:51 - 00356935 _____ C:\Users\Linda\Downloads\CaroLeila-16-Kazimierz.m4r
2013-08-08 17:17 - 2013-05-06 10:02 - 00000000 ____D C:\Users\****\AppData\Roaming\Spotify
2013-08-07 16:28 - 2013-08-07 09:41 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-08-07 09:18 - 2011-03-14 21:13 - 00000000 ____D C:\Users\****\AppData\Local\CutePDF Writer
2013-08-05 15:36 - 2013-05-06 10:03 - 00000000 ____D C:\Users\****\AppData\Local\Spotify
2013-08-04 11:23 - 2009-07-14 06:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

Files to move or delete:
====================
C:\Users\****\AppData\Local\Temp\AskSLib.dll
C:\Users\****\AppData\Local\Temp\contentDATs.exe
C:\Users\****\AppData\Local\Temp\DivXSetup.exe
C:\Users\****\AppData\Local\Temp\DWPUpgradeInstaller.exe
C:\Users\****\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\****\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\****\AppData\Local\Temp\jre-1.6.0_20-windows-i586-iftw.exe_90744722.exe
C:\Users\****\AppData\Local\Temp\jre-6u20-windows-i586-jinstall_uac.exe
C:\Users\****\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\****\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\****\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe
C:\Users\****\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\****\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\****\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\****\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\****\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\***\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\jre-7u5-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\n3kmzlww.dll
C:\Users\****\AppData\Local\Temp\PicasaUpdater_4e92.exe
C:\Users\****\AppData\Local\Temp\PicasaUpdater_6b96.exe
C:\Users\****\AppData\Local\Temp\RealPlayer.exe
C:\Users\****\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\****\AppData\Local\Temp\SkypeSetup.exe
C:\Users\*****\AppData\Local\Temp\stubhelper.dll
C:\Users\****\AppData\Local\Temp\ytb.exe
C:\Users\****\AppData\Local\Temp\~rnsetup\GEMSETUP\pnrs3260.dll
C:\Users\****\AppData\Local\Temp\~rnsetu0\GEMSETUP\msvcr100.dll
C:\Users\****\AppData\Local\Temp\~rnsetu0\GEMSETUP\pnrs3260.dll
C:\Users\****\AppData\Local\Temp\{AC76BA86-7AD7-1031-7B44-A92000000001}\FixTransforms.exe
C:\Users\****\AppData\Local\Temp\{070FD5E9-E894-42CE-99AF-95C73ADA6BD9}\ICQ7.exe
C:\Users\****\AppData\Local\Temp\Temp1_MySpaceLoader_Free_Version.zip\MySpaceLoader.exe
C:\Users\****\AppData\Local\Temp\I1300286662\Windows\install_tuned.exe
C:\Users\****\AppData\Local\Temp\I1300286662\Windows\resource\iawin32.dll
C:\Users\****\AppData\Local\Temp\I1300286662\Windows\resource\remove.exe
C:\Users\****\AppData\Local\Temp\I1300286662\Windows\resource\ZGWin32LaunchHelper.exe
C:\Users\****\AppData\Local\Temp\F5C4.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\ct3297265\ism.exe
C:\Users\****\AppData\Local\Temp\C0B0.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\BBEF.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\A5E0.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\8EF6.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\8C38.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\5C53.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\5A9E.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\56E6.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\3885.tmp\remove.exe
C:\Users\****\AppData\Local\Temp\363D.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\335F.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\251.dir\InstallFlashPlayer.exe
C:\Users\****\AppData\Local\Temp\._msige52\GoogleEarth.exe
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\plugin\earthps.dll
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\plugin\geplugin.exe
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\plugin\ge_expat.dll
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\plugin\googleearth_free.dll
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\plugin\msvcp80.dll
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\plugin\msvcr80.dll
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\plugin\npgeplugin.dll
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\plugin\plugin_ax.dll
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\client\earthflashsol.exe
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\client\earthps.dll
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\client\googleearth.exe
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\client\gpsbabel.exe
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\client\libexpatw.dll
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\client\msvcp80.dll
C:\Users\****\AppData\Local\Temp\._msige52\program files\Google\Google Earth\client\msvcr80.dll
C:\Users\staples\AppData\Local\Temp\HPQSi.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-02 11:08

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-03 15:29:36
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BEVT-60ZCT1 rev.13.01A13 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Linda\AppData\Local\Temp\pwtirfoc.sys


---- System - GMER 2.1 ----

SSDT            90EE820E                                                                                              ZwCreateSection
SSDT            90EE8218                                                                                              ZwRequestWaitReplyPort
SSDT            90EE8213                                                                                              ZwSetContextThread
SSDT            90EE821D                                                                                              ZwSetSecurityObject
SSDT            90EE8222                                                                                              ZwSystemDebugControl
SSDT            90EE81AF                                                                                              ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                              83044A15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                8307E212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                   8308558C 4 Bytes  [0E, 82, EE, 90] {PUSH CS; SUB DH, 0x90}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                   830858E8 4 Bytes  [18, 82, EE, 90]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                   8308592C 4 Bytes  [13, 82, EE, 90]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                   830859A8 4 Bytes  [1D, 82, EE, 90]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                   830859FC 4 Bytes  [22, 82, EE, 90]
.text           ...                                                                                                   
.text           C:\Windows\system32\DRIVERS\atikmdag.sys                                                              section is writeable [0x91A1A000, 0x2D5378, 0xE8000020]
                C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl                                                    entry point in "" section [0xB52F541C]
.clc            C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl                                                    unknown last code section [0xB52F6000, 0x1000, 0xE0000020]

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Real\RealPlayer\Update\realsched.exe[2596] kernel32.dll!SetUnhandledExceptionFilter  762DF4FB 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                               Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                               Wdf01000.sys

---- EOF - GMER 2.1 ----