Win 7, Rechner bootete nicht mehr nach Befall - u.a. weißer Bildschirm

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:36 on 13/09/2013 (user)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-09-2013
Ran by user (administrator) on USER-PC on 13-09-2013 12:38:59
Running from C:\Users\user\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
() C:\Program Files\RocketDock\RocketDock.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MouseDriver] - C:\Windows\system32\TiltWheelMouse.exe [241152 2012-12-19] (Pixart Imaging Inc)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-12] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKCU\...\Run: [Google Update] - C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-03] (Google Inc.)
HKCU\...\Run: [RocketDock] - C:\Program Files\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKCU\...\Winlogon: [Shell] explorer.exe <==== ATTENTION 
MountPoints2: {ffb082ce-cab1-11e2-8597-00262285f644} - F:\Autorun.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE69ECB89E889CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=3.5&ts=1370021485157&tguid=46364-3869-1370021485157-D6E976DE7CEED04F2271008123F09D3A
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/my_homepage/0022/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974
HKLM\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=46364&st=home&tid=3869&ver=3.5&ts=1370021485157&tguid=46364-3869-1370021485157-D6E976DE7CEED04F2271008123F09D3A
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.5&ts=1370021485157&tguid=46364-3869-1370021485157-D6E976DE7CEED04F2271008123F09D3A&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.certified-toolbar.com?si=41460&st=bs&tid=3201&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.2&ts=1370021485157&tguid=46364-3869-1370021485157-D6E976DE7CEED04F2271008123F09D3A&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974
SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.2&ts=1370021485157&tguid=46364-3869-1370021485157-D6E976DE7CEED04F2271008123F09D3A&q={searchTerms}
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46364&gid=1&dbCode=1&command={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.2&ts=1370021485157&tguid=46364-3869-1370021485157-D6E976DE7CEED04F2271008123F09D3A&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&affID=122471&babsrc=SP_ss&mntrId=F4B0904CE5293AE5
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=816cc1db-8aeb-4c3c-ac3c-4bb3af7706e3&searchtype=ds&q={searchTerms}&installDate=01/01/1970
BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Help the General-Search Project - {CA4520F3-AE13-4FB1-A513-58E23991C86D} - C:\Users\user\AppData\Roaming\MEDIAF~1\EXTENS~1\GENCRA~1.DLL ()
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} -  No File
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin: @real.com/nppl3260;version=15.0.6.14 - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.6.14 - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=15.0.6.14 - C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\user\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\user\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF Extension: General Crawler - C:\Users\user\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
FF HKLM\...\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKCU\...\Firefox\Extensions: [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] - C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi

Chrome: 
=======
CHR HomePage: hxxp://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974
CHR RestoreOnStartup: "hxxp://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974"
CHR DefaultSearchURL: (qvo6) - hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=WDCXWD3200BEVT-22ZCT0_WD-WXP0A99J9039J9039&ts=1376357974&type=default&q={searchTerms}
CHR DefaultSuggestURL: (qvo6) -       "suggest_url": ""
CHR Plugin: (Shockwave Flash) - C:\Users\user\AppData\Local\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\user\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\user\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (Injovo Extension Plugin) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.557_0\npbrowserext.dll No File
CHR Plugin: (Skype Click to Call) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.3.0.11079_0\npSkypeChromePlugin.dll No File
CHR Plugin: (widdit) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnnkmdadebfapiihcaiajaplpmpfgpnh\2.1_0\npwiddit.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Acrobat3\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Plugin: (Nexon Game Controller) - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (Unity Player) - C:\Users\user\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll No File
CHR Plugin: (Google Update) - C:\Users\user\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Kalydo Player Plugin for Mozilla) - C:\Users\user\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.10) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: () - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab\background.html
CHR Extension: (AdBlock) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.6_0
CHR Extension: (DealPly  Shopping) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hggpkhijoeadmdfmlbdepfbngmhaldci\3.5.3.0_0
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0
CHR Extension: (Amazon-Icon) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg\1.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM\...\Chrome\Extension: [apfdadfinodckpcehhdhjlgiphgnbfci] - C:\Program Files\PutLockerDownloader\putlockerdownloader10.crx
CHR HKLM\...\Chrome\Extension: [dednnpigldgdbpgcdpfppmlcnnbjciel] - C:\Users\user\AppData\Roaming\Media Finder\Extensions\gencrawler_gc.crx
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx
CHR HKLM\...\Chrome\Extension: [lpmkgpnbiojfaoklbkpfneikocaobfai] - C:\Users\user\AppData\Roaming\Media Finder\Extensions\mf_plugin_gc.crx
CHR HKLM\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\user\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
CHR HKLM\...\Chrome\Extension: [pfmopbbadnfoelckkcmjjeaaegjpjjbk] - C:\Program Files\Gophoto.it\gophotoit14.crx

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-12] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-12] (Avira Operations GmbH & Co. KG)
R2 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
S2 SystemStoreService; C:\Program Files\SoftwareUpdater\SystemStore.exe [278016 2013-07-09] ()
S2 HitmanPro37CrusaderBoot; "G:\HitmanPro.exe" /crusader:boot [x]

==================== Drivers (Whitelisted) ====================

S3 apf003; C:\Windows\system32\apf003.sys [13232 2013-05-19] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-09-12] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-06-01] (DT Soft Ltd)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 HPMo4DE3; C:\Windows\System32\DRIVERS\HPMo4DE3.sys [20992 2011-03-09] (TPMX Electronics Ltd.)
S3 HPub4DE3; C:\Windows\System32\Drivers\HPub4DE3.sys [13824 2011-04-12] (TPMX Electronics Ltd.)
S3 SCREAMINGBDRIVER; C:\Windows\System32\drivers\ScreamingBAudio.sys [34896 2010-07-01] (Screaming Bee LLC)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-12] (Avira GmbH)
S3 t_mouse.sys; C:\Windows\System32\DRIVERS\t_mouse.sys [5120 2012-12-19] ()
S3 WinRing0_1_2_0; C:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [14416 2010-11-01] (OpenLibSys.org)
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
S3 taphss; system32\DRIVERS\taphss.sys [x]
S3 taphss6; system32\DRIVERS\taphss6.sys [x]
S3 XDva399; \??\C:\Windows\system32\XDva399.sys [x]
S3 XDva401; \??\C:\Windows\system32\XDva401.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-13 12:38 - 2013-09-13 12:38 - 00000000 ____D C:\FRST
2013-09-13 12:37 - 2013-09-13 12:32 - 00377856 _____ C:\Users\user\Desktop\bpkhnbrj.exe
2013-09-13 12:37 - 2013-09-13 12:28 - 01082459 _____ (Farbar) C:\Users\user\Desktop\FRST.exe
2013-09-13 12:36 - 2013-09-13 12:36 - 00000470 _____ C:\Users\user\Desktop\defogger_disable.log
2013-09-13 12:36 - 2013-09-13 12:36 - 00000000 _____ C:\Users\user\defogger_reenable
2013-09-13 12:36 - 2013-09-13 12:34 - 00050477 _____ C:\Users\user\Desktop\Defogger.exe
2013-09-13 10:22 - 2013-09-13 12:26 - 00000168 _____ C:\Windows\setupact.log
2013-09-13 10:22 - 2013-09-13 10:22 - 00000000 _____ C:\Windows\setuperr.log
2013-09-13 10:21 - 2013-09-13 10:21 - 00348096 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 09:21 - 2013-09-12 09:21 - 00097656 _____ C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-12 01:50 - 2013-09-12 01:50 - 00000000 ____D C:\Windows\system32\Lang
2013-09-12 01:50 - 2009-09-02 11:18 - 00398848 _____ (Intel(R) Corporation) C:\Windows\system32\TVWizudlg.exe
2013-09-12 01:50 - 2009-09-02 11:18 - 00140288 _____ () C:\Windows\system32\igfxtvcx.dll
2013-09-12 01:50 - 2009-09-02 11:16 - 00121232 _____ C:\Windows\system32\IScrNB.bmp
2013-09-12 01:45 - 2012-08-23 16:48 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-09-12 01:45 - 2012-08-23 16:44 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-09-12 01:45 - 2012-08-23 16:40 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-09-12 01:45 - 2012-08-23 16:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-09-12 01:45 - 2012-08-23 16:10 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-09-12 01:45 - 2012-08-23 15:52 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-09-12 01:45 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-09-12 01:45 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-09-12 01:45 - 2012-08-23 15:32 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-09-12 01:45 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-09-12 01:45 - 2012-08-23 13:40 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-09-12 01:45 - 2012-08-23 13:32 - 00317440 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-09-12 01:45 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-09-12 01:45 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-09-12 01:45 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-09-12 01:45 - 2012-08-23 12:08 - 02739712 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-09-12 01:45 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-09-12 01:43 - 2013-09-12 01:43 - 00000000 ____D C:\Windows\system32\x64
2013-09-12 01:43 - 2013-09-12 01:43 - 00000000 ____D C:\Intel
2013-09-12 01:43 - 2009-09-02 18:56 - 01002008 _____ (Intel Corporation) C:\Windows\system32\igxpun.exe
2013-09-12 01:42 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 01:42 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 01:42 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 01:42 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 01:42 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 01:42 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 01:42 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 01:42 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 01:42 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 01:42 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 01:42 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 01:42 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 01:42 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 01:42 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 01:42 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 01:42 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 01:38 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 01:38 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 01:38 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 01:38 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 01:38 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 01:38 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 01:38 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 01:38 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 01:38 - 2012-08-24 19:05 - 00136560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-09-12 01:38 - 2012-08-24 19:02 - 00369856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-09-12 01:38 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-09-12 01:38 - 2012-08-24 18:56 - 01039360 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-09-12 01:38 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-09-12 01:37 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 01:34 - 2013-09-12 01:33 - 00066144 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-12 01:31 - 2013-09-12 01:31 - 00002012 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-12 01:30 - 2013-09-12 01:30 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-12 01:30 - 2013-09-12 01:30 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-12 01:30 - 2013-09-12 01:30 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-12 01:30 - 2013-09-12 01:30 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-09-12 01:11 - 2013-09-12 09:16 - 00000000 ____D C:\Windows\pss
2013-09-12 00:53 - 2013-09-12 01:06 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2013-09-12 00:53 - 2013-09-12 01:06 - 00000340 _____ C:\Windows\system32\.crusader
2013-09-12 00:30 - 2013-09-12 00:54 - 00000000 ____D C:\ProgramData\HitmanPro
2013-09-05 21:13 - 2013-09-11 16:25 - 00000004 _____ C:\Users\user\AppData\Roaming\cache.ini
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (9).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (8).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (7).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (6).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (5).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (4).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (3).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (2).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (1).zip
2013-09-05 21:12 - 2013-09-05 21:12 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv.zip
2013-09-04 22:33 - 2013-09-04 22:36 - 1119874775 _____ C:\Users\user\Desktop\Fusion-Network.zip
2013-09-04 22:26 - 2013-09-04 22:31 - 00000000 ____D C:\Users\user\Desktop\Fusion-Network
2013-09-04 22:25 - 2013-09-04 22:26 - 00000000 ____D C:\Users\user\Desktop\Neuer Ordner
2013-09-04 22:16 - 2013-09-04 22:16 - 05829952 _____ (TeamViewer GmbH) C:\Users\user\Downloads\TeamViewer_Setup_de_8.0.20768.exe
2013-09-02 19:57 - 2013-09-02 19:57 - 00001128 _____ C:\Users\Public\Desktop\Game Booster 3.lnk
2013-09-02 19:56 - 2013-09-02 19:57 - 04344120 _____ (IObit                                                       ) C:\Users\user\Downloads\gb3-4-setup.exe
2013-09-02 15:28 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-02 15:28 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-02 15:28 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-09-02 15:28 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-02 15:28 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-02 15:28 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-02 15:28 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-02 15:28 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-02 15:28 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-02 15:28 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-02 15:28 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-02 15:27 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-17 02:24 - 2013-08-17 02:24 - 00000000 ____D C:\ProgramData\IObit
2013-08-17 02:24 - 2013-08-17 02:24 - 00000000 ____D C:\Program Files\IObit
2013-08-17 00:42 - 2013-08-17 00:42 - 04706130 _____ C:\Users\user\Downloads\3D Cube.zip
2013-08-17 00:24 - 2013-08-17 00:26 - 33130822 _____ C:\Users\user\Downloads\Cube.rar
2013-08-15 18:10 - 2013-08-15 17:57 - 1009950912 _____ C:\Users\user\Desktop\Fusion-Network (2).rar
2013-08-15 17:36 - 2013-08-15 17:57 - 1009950912 _____ C:\Users\user\Downloads\Fusion-Network (2).rar
2013-08-15 17:36 - 2013-08-15 17:57 - 1009950912 _____ C:\Users\user\Downloads\Fusion-Network (1).rar
2013-08-15 14:20 - 2013-08-15 14:20 - 00000000 ____D C:\Users\user\AppData\Roaming\Avira
2013-08-15 14:19 - 2013-08-15 14:19 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-08-15 14:19 - 2013-08-15 14:19 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-08-15 14:17 - 2013-08-15 14:17 - 00000000 ____D C:\ProgramData\Avira
2013-08-15 14:17 - 2013-08-15 14:17 - 00000000 ____D C:\Program Files\Avira

==================== One Month Modified Files and Folders =======

2013-09-13 12:38 - 2013-09-13 12:38 - 00000000 ____D C:\FRST
2013-09-13 12:36 - 2013-09-13 12:36 - 00000470 _____ C:\Users\user\Desktop\defogger_disable.log
2013-09-13 12:36 - 2013-09-13 12:36 - 00000000 _____ C:\Users\user\defogger_reenable
2013-09-13 12:35 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-13 12:34 - 2013-09-13 12:36 - 00050477 _____ C:\Users\user\Desktop\Defogger.exe
2013-09-13 12:33 - 2012-08-27 16:44 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-13 12:33 - 2009-07-14 06:34 - 00025760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-13 12:33 - 2009-07-14 06:34 - 00025760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-13 12:32 - 2013-09-13 12:37 - 00377856 _____ C:\Users\user\Desktop\bpkhnbrj.exe
2013-09-13 12:29 - 2013-08-13 19:58 - 00781776 _____ C:\Windows\WindowsUpdate.log
2013-09-13 12:28 - 2013-09-13 12:37 - 01082459 _____ (Farbar) C:\Users\user\Desktop\FRST.exe
2013-09-13 12:26 - 2013-09-13 10:22 - 00000168 _____ C:\Windows\setupact.log
2013-09-13 12:26 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-13 10:22 - 2013-09-13 10:22 - 00000000 _____ C:\Windows\setuperr.log
2013-09-13 10:22 - 2012-09-03 17:46 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-13 10:21 - 2013-09-13 10:21 - 00348096 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 09:21 - 2013-09-12 09:21 - 00097656 _____ C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-12 09:20 - 2012-09-03 17:46 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-12 09:20 - 2012-09-03 17:46 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-12 09:20 - 2012-08-27 15:25 - 00000000 ____D C:\Windows\Panther
2013-09-12 09:16 - 2013-09-12 01:11 - 00000000 ____D C:\Windows\pss
2013-09-12 09:16 - 2012-12-15 01:12 - 00000000 ____D C:\Users\user\AppData\Roaming\Skype
2013-09-12 01:50 - 2013-09-12 01:50 - 00000000 ____D C:\Windows\system32\Lang
2013-09-12 01:50 - 2012-09-03 20:27 - 00000000 ____D C:\Program Files\Intel
2013-09-12 01:47 - 2009-07-14 10:47 - 00000000 ____D C:\Windows\system32\Drivers\de-DE
2013-09-12 01:47 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-12 01:43 - 2013-09-12 01:43 - 00000000 ____D C:\Windows\system32\x64
2013-09-12 01:43 - 2013-09-12 01:43 - 00000000 ____D C:\Intel
2013-09-12 01:40 - 2013-08-12 03:02 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 01:39 - 2012-09-07 11:10 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 01:33 - 2013-09-12 01:34 - 00066144 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-12 01:31 - 2013-09-12 01:31 - 00002012 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-12 01:30 - 2013-09-12 01:30 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-12 01:30 - 2013-09-12 01:30 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-12 01:30 - 2013-09-12 01:30 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-12 01:30 - 2013-09-12 01:30 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-09-12 01:14 - 2013-02-03 20:00 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-390601350-1865464865-2767028540-1000UA.job
2013-09-12 01:06 - 2013-09-12 00:53 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2013-09-12 01:06 - 2013-09-12 00:53 - 00000340 _____ C:\Windows\system32\.crusader
2013-09-12 01:00 - 2013-08-13 19:41 - 00000000 ____D C:\Program Files\WinZipper
2013-09-12 00:59 - 2012-09-13 16:52 - 00000000 ____D C:\Program Files\DsNET Corp
2013-09-12 00:54 - 2013-09-12 00:30 - 00000000 ____D C:\ProgramData\HitmanPro
2013-09-12 00:53 - 2013-08-13 04:15 - 00000000 ____D C:\Users\user\Desktop\Neuer Ordner (2)
2013-09-12 00:53 - 2013-08-13 03:39 - 00000000 ____D C:\Users\user\AppData\Roaming\Desk 365
2013-09-12 00:53 - 2013-08-13 03:39 - 00000000 ____D C:\ProgramData\eSafe
2013-09-11 16:25 - 2013-09-05 21:13 - 00000004 _____ C:\Users\user\AppData\Roaming\cache.ini
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (9).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (8).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (7).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (6).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (5).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (4).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (3).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (2).zip
2013-09-05 21:13 - 2013-09-05 21:13 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv (1).zip
2013-09-05 21:12 - 2013-09-05 21:12 - 00049281 _____ C:\Users\user\Downloads\movie1080p.mkv.zip
2013-09-05 08:14 - 2013-02-03 20:00 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-390601350-1865464865-2767028540-1000Core.job
2013-09-04 22:36 - 2013-09-04 22:33 - 1119874775 _____ C:\Users\user\Desktop\Fusion-Network.zip
2013-09-04 22:31 - 2013-09-04 22:26 - 00000000 ____D C:\Users\user\Desktop\Fusion-Network
2013-09-04 22:26 - 2013-09-04 22:25 - 00000000 ____D C:\Users\user\Desktop\Neuer Ordner
2013-09-04 22:16 - 2013-09-04 22:16 - 05829952 _____ (TeamViewer GmbH) C:\Users\user\Downloads\TeamViewer_Setup_de_8.0.20768.exe
2013-09-03 04:37 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-09-02 19:57 - 2013-09-02 19:57 - 00001128 _____ C:\Users\Public\Desktop\Game Booster 3.lnk
2013-09-02 19:57 - 2013-09-02 19:56 - 04344120 _____ (IObit                                                       ) C:\Users\user\Downloads\gb3-4-setup.exe
2013-09-02 16:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\wfp
2013-09-02 16:16 - 2013-04-04 19:45 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-09-02 16:16 - 2013-02-03 20:01 - 00000000 ____D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-09-02 16:16 - 2012-12-15 01:12 - 00000000 ___RD C:\Program Files\Skype
2013-09-02 16:16 - 2012-09-14 18:57 - 00000000 ____D C:\Users\user\AppData\Local\Akamai
2013-09-02 16:16 - 2012-09-12 16:27 - 00000000 ____D C:\Program Files\CCleaner
2013-09-02 16:16 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-09-02 16:16 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-09-02 16:14 - 2012-12-15 01:12 - 00000000 ____D C:\ProgramData\Skype
2013-09-02 16:14 - 2012-09-08 10:00 - 00000000 ____D C:\ProgramData\Real
2013-09-02 16:10 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\LogFiles
2013-08-17 02:24 - 2013-08-17 02:24 - 00000000 ____D C:\ProgramData\IObit
2013-08-17 02:24 - 2013-08-17 02:24 - 00000000 ____D C:\Program Files\IObit
2013-08-17 00:42 - 2013-08-17 00:42 - 04706130 _____ C:\Users\user\Downloads\3D Cube.zip
2013-08-17 00:33 - 2012-10-07 12:39 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-08-17 00:33 - 2012-10-07 12:39 - 00000000 ____D C:\Windows\system32\directx
2013-08-17 00:26 - 2013-08-17 00:24 - 33130822 _____ C:\Users\user\Downloads\Cube.rar
2013-08-15 17:57 - 2013-08-15 18:10 - 1009950912 _____ C:\Users\user\Desktop\Fusion-Network (2).rar
2013-08-15 17:57 - 2013-08-15 17:36 - 1009950912 _____ C:\Users\user\Downloads\Fusion-Network (2).rar
2013-08-15 17:57 - 2013-08-15 17:36 - 1009950912 _____ C:\Users\user\Downloads\Fusion-Network (1).rar
2013-08-15 14:20 - 2013-08-15 14:20 - 00000000 ____D C:\Users\user\AppData\Roaming\Avira
2013-08-15 14:19 - 2013-08-15 14:19 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-08-15 14:19 - 2013-08-15 14:19 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-08-15 14:17 - 2013-08-15 14:17 - 00000000 ____D C:\ProgramData\Avira
2013-08-15 14:17 - 2013-08-15 14:17 - 00000000 ____D C:\Program Files\Avira

Files to move or delete:
====================
C:\Users\Alles\NosTale[DE]Lvl,Job Bot.exe
C:\Users\user\jagex_cl_runescape_LIVE.dat
C:\Users\user\random.dat
C:\Users\user\AppData\Roaming\cache.ini

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-12 09:58

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-09-2013
Ran by user at 2013-09-13 12:39:54
Running from C:\Users\user\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Adobe Acrobat Reader 3.0
Adobe Flash Player 11 ActiveX (Version: 11.8.800.168)
Adobe Flash Player 11 Plugin (Version: 11.8.800.94)
Adobe Reader XI (11.0.04) - Deutsch (Version: 11.0.04)
Adobe Shockwave Player 11.6 (Version: 11.6.6.636)
Akamai NetSession Interface
Avira Free Antivirus (Version: 13.0.0.4052)
CCleaner (Version: 4.02)
Command & Conquer Windows 95
DivX-Setup (Version: 2.6.1.22)
Game Booster 3 (Version: 3.4)
Google Chrome (HKCU Version: 29.0.1547.66)
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.1892)
Intel(R) TV Wizard
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
League of Legends (Version: 1.3)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0)
MSXML 4.0 SP3 Parser (KB2758694) (Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (Version: 4.30.2100.0)
Nexon Game Manager
NVIDIA PhysX (Version: 9.10.0129)
Radio.fx
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
RealPlayer (Version: 15.0.6)
RealUpgrade 1.1 (Version: 1.1.0)
RocketDock 1.3.5
RuneScape Launcher 1.2.2 (Version: 1.2.2)
Skype™ 6.5 (Version: 6.5.158)
swMSM (Version: 12.0.0.1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)
Winamp (Version: 5.64 )
WinRAR 4.20 (32-Bit) (Version: 4.20.0)

==================== Restore Points  =========================

03-09-2013 01:00:12 Windows Update
03-09-2013 01:34:18 Windows-Sicherung
11-09-2013 12:17:31 Windows-Sicherung
11-09-2013 23:38:35 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0D9B5D92-3A22-486D-A887-3AA21597CF27} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {0FEBE866-0D45-4BC5-B0E4-32F381A86924} - System32\Tasks\Software Updater Ui => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Ui.exe [2013-07-09] ()
Task: {10D13FE9-DB91-4185-A5C5-00C7643AD394} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-390601350-1865464865-2767028540-1000Core => C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-03] (Google Inc.)
Task: {20E2D111-3877-4DCC-81DE-28D7A3F482FF} - System32\Tasks\Software Updater => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe [2013-07-06] ()
Task: {221A7075-ED51-4A0F-996D-3CB66535EC91} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-390601350-1865464865-2767028540-1000UA => C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-03] (Google Inc.)
Task: {42A3DCCB-3B62-49E0-B9D3-32858D0F956B} - System32\Tasks\Omiga Plus RunAsStdUser => C:\Program Files\Omiga Plus\omigaplus.exe
Task: {49AA6FDC-7B8B-4BC3-AC0B-DDBF86A896AB} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-390601350-1865464865-2767028540-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {5CDD061D-62CA-4CA9-9E69-E1EDD5508E51} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-12] (Adobe Systems Incorporated)
Task: {73A05E22-1452-4654-84DF-5A4C99433BB9} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-390601350-1865464865-2767028540-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {83CF2527-B8D3-43D4-9E45-EA3C0D8C7244} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files\Desk 365\desk365.exe
Task: {8D77BCB9-3E5F-4887-9101-E2F37C80CE50} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files\IObit\Game Booster 3\AutoUpdate.exe [2013-09-02] ()
Task: {90AE8D60-35E9-4DD5-9B75-D7A33FB07D56} - System32\Tasks\DealPlyUpdate => C:\Program
Task: {AE402E78-1860-4EF2-95E7-0BECC5221281} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation)
Task: {AEE18223-E9ED-4464-9249-58B59BFC85C0} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => C:\Program Files\Real\RealPlayer\Update\realsched.exe [2012-11-17] (RealNetworks, Inc.)
Task: {BDC278DC-1449-4352-A238-57EC0D18EC58} - System32\Tasks\Freemium1ClickMaint => C:\Users\user\Downloads\1Click.exe
Task: {C634BB63-6A51-4E45-947E-120DFD16C301} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2012-11-30] ()
Task: {C751AA88-1EAD-4077-BBA4-827450C87A52} - System32\Tasks\Dealply => C:\Users\user\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE
Task: {CED1312B-0E7C-4DD8-BC87-0F858C178994} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {D6B1E253-603D-4295-967A-7696A7310447} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)
Task: {F13D8727-32A2-4321-A51B-746977B3436C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2010-11-20] (Microsoft Corporation)
Task: {FFFC673F-5F30-4681-A8BA-E8138BC16F94} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-03-12] (Oracle Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Dealply.job => C:\Users\user\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-390601350-1865464865-2767028540-1000Core.job => C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-390601350-1865464865-2767028540-1000UA.job => C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-12-19 15:36 - 2007-09-02 14:57 - 00069632 _____ () C:\Program Files\RocketDock\RocketDock.dll
2013-05-17 21:51 - 2012-06-09 19:20 - 00167936 _____ (Alexander Roshal) C:\Program Files\WinRAR\rarext.dll
2009-09-02 18:21 - 2009-09-02 18:21 - 00303616 _____ (Intel Corporation) C:\Windows\system32\igfxrDEU.lrc

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/12/2013 01:01:18 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (09/12/2013 00:56:38 AM) (Source: MsiInstaller) (User: user-PC)
Description: Produkt: Adobe Reader XI - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011004}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127

Error: (09/12/2013 00:55:15 AM) (Source: ESENT) (User: )
Description: taskhost (2224) Versuch, Datei "C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.


System errors:
=============
Error: (09/13/2013 00:26:21 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/13/2013 10:43:37 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/13/2013 10:43:35 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎13.‎09.‎2013 um 10:41:19 unerwartet heruntergefahren.

Error: (09/13/2013 10:22:11 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/12/2013 09:14:39 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/12/2013 01:51:13 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/12/2013 01:51:13 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/12/2013 01:51:13 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/12/2013 01:51:13 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/12/2013 01:49:19 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (09/12/2013 01:01:18 AM) (Source: SideBySide)(User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"G:\HitmanPro_x64.exe

Error: (09/12/2013 00:56:38 AM) (Source: MsiInstaller)(User: user-PC)
Description: Adobe Reader XI - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011004}1625(NULL)(NULL)(NULL)

Error: (09/12/2013 00:55:15 AM) (Source: ESENT)(User: )
Description: taskhost2224C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.


==================== Memory info =========================== 

Percentage of memory in use: 25%
Total physical RAM: 3001.98 MB
Available physical RAM: 2248 MB
Total Pagefile: 6002.24 MB
Available Pagefile: 5075.11 MB
Total Virtual: 2047.88 MB
Available Virtual: 1909.42 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:149.04 GB) (Free:40.69 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:149 GB) (Free:81.65 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 08D908D8)
Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=149 GB) - (Type=0C)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-13 12:57:04
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BEVT-22ZCT0 rev.11.01A11 298,09GB
Running: bpkhnbrj.exe; Driver: C:\Users\user\AppData\Local\Temp\kxldapob.sys


---- System - GMER 2.1 ----

SSDT            8E4A8196                                                                                              ZwCreateSection
SSDT            8E4A81A0                                                                                              ZwRequestWaitReplyPort
SSDT            8E4A819B                                                                                              ZwSetContextThread
SSDT            8E4A81A5                                                                                              ZwSetSecurityObject
SSDT            8E4A81AA                                                                                              ZwSystemDebugControl
SSDT            8E4A8137                                                                                              ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                              82C4BA15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                82C85212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                   82C8C58C 4 Bytes  [96, 81, 4A, 8E]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                   82C8C8E8 4 Bytes  CALL CD4A696F 
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                   82C8C92C 4 Bytes  [9B, 81, 4A, 8E]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                   82C8C9A8 4 Bytes  [A5, 81, 4A, 8E]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                   82C8C9FC 4 Bytes  [AA, 81, 4A, 8E]
.text           ...                                                                                                   

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe[1692] kernel32.dll!SetUnhandledExceptionFilter  7685F4EB 5 Bytes  JMP 0067B780 C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe

---- Devices - GMER 2.1 ----

AttachedDevice  \FileSystem\fastfat \Fat                                                                              fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SOFTWARE\Classes\CLSID\{722b3793-5367-4446-b6bb-db89b05c1f24}\LocalServer32@                     %SystemRoot%\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {722b3793-5367-4446-b6bb-db89b05c1f24}

---- EOF - GMER 2.1 ----