C:\Users\Helmut\AppData\Local\Temp\wpbt0.dll' enthielt einen Virus oder unerwünschtes Programm 'TR/Reveton.N.370' [trojan].

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 00:00 on 18/09/2013 (Helmut)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-09-2013 03
Ran by Helmut at 2013-09-18 00:05:57
Running from C:\Users\Helmut\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Acer Empowering Technology (Version: 3.0.3006)
Acer ePower Management (Version: 3.0.3009)
Acer eRecovery Management (Version: 3.0.3010)
Acer GridVista (Version: 2.72.317)
Acer Mobility Center Plug-In (Version: 3.0.3000)
Acer ScreenSaver (Version: 3.11.0606)
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe Flash Player 11 ActiveX (Version: 11.1.102.55)
Adobe Flash Player 11 Plugin (Version: 11.1.102.55)
Adobe Reader 8.1.0 (Version: 8.1.0)
ALPS Touch Pad Driver
Avira Free Antivirus (Version: 13.0.0.4052)
AVM FRITZ!Box Dokumentation
Broadcom Gigabit Integrated Controller (Version: 11.11.03)
Business Contact Manager für Outlook 2007 SP1 (Version: 3.0.7311.0)
Driver Whiz (Version: 8.0.1)
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
Google Desktop (Version: 5.9.1005.12335)
Google Earth Plug-in (Version: 7.1.1.1888)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4413.1752)
Google Update Helper (Version: 1.3.21.153)
HDAUDIO Soft Data Fax Modem with SmartCP
Intel(R) Graphics Media Accelerator Driver
InterVideo WinDVD 8 (Version: 8.5-B0.7)
Java Auto Updater (Version: 2.0.7.1)
Java(TM) 6 Update 18 (Version: 6.0.180)
Java(TM) 6 Update 31 (Version: 6.0.310)
Launch Manager
LightScribe  1.4.142.1 (Version: 1.4.142.1)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) (Version: 9.1.2047.00)
Microsoft SQL Server Native Client (Version: 9.00.2047.00)
Microsoft SQL Server VSS Writer (Version: 9.00.2047.00)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mozilla Firefox 13.0.1 (x86 de) (Version: 13.0.1)
Mozilla Maintenance Service (Version: 13.0.1)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
NTI Backup Now 5 (Version: 5.1.2.503)
NTI Backup Now Standard (Version: 5.1.2.503)
NTI Media Maker 8 (Version: 8.0.2.6322)
NTI Shadow (Version: 3.7.6.37)
O2Micro Flash Memory Card Reader Driver (x86) (Version: 3.21.1)
OpenOffice.org 3.3 (Version: 3.3.9567)
Realtek Ethernet Controller Driver (Version: 6.250.908.2011)
Realtek High Definition Audio Driver (Version: 6.0.1.5628)
Rechenspiele I (Version: 1.0.6)
Samsung ML-1630W Series
Skype Click to Call (Version: 5.10.9560)
Skype™ 5.8 (Version: 5.8.158)
SOT (Version: 1.0.0)
SyncThru Web Admin Service
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (Version: 9.00.2047.00)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)

==================== Restore Points  =========================

13-08-2013 17:06:52 Windows Update
17-08-2013 09:58:06 Windows Update
18-08-2013 09:27:11 Windows Update
19-08-2013 08:29:41 Windows Update
21-08-2013 17:51:25 Windows Update
22-08-2013 16:20:43 Windows Update
23-08-2013 08:10:24 Windows Update
24-08-2013 13:03:43 Windows Update
26-08-2013 06:11:17 Windows Update
27-08-2013 17:41:23 Windows Update
29-08-2013 10:55:39 Windows Update
30-08-2013 04:09:05 Windows Update
07-09-2013 16:12:05 Windows Update
08-09-2013 08:51:21 Windows Update
12-09-2013 16:09:45 Windows Update
17-09-2013 21:04:00 Windows Update
17-09-2013 21:32:26 Windows Update

==================== Hosts content: ==========================

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {18DFD9FC-082E-4E9B-8285-5F21D2B4EDAE} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {2EF20CEA-F5CB-4029-9465-CFAADC2617FC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-08-19] (Google Inc.)
Task: {39BD6CED-DE63-475C-9EED-099917309D7B} - System32\Tasks\McQcTask => c:\PROGRA~1\mcafee\mqc\QcConsol.exe
Task: {3E6507D3-8262-49E1-91F0-F6E098D06D0C} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-12] (Microsoft Corporation)
Task: {4422708A-C316-4344-A607-54A359424FB6} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4202552596-312612828-80714196-1003Core => C:\Users\Helmut\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {53E91AA0-F848-42C9-BAC6-D139A9912F28} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-08-19] (Google Inc.)
Task: {5916F864-469C-4391-8604-E4EA141A2699} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {60460F69-EDDF-41DB-A8C4-992BBE6D1568} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation)
Task: {77A454FA-4379-491D-8AF9-A1CA09104EE9} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4202552596-312612828-80714196-1003UA => C:\Users\Helmut\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {7C5A51E8-1AD7-48C6-8879-257A8A9609F5} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {8B0E6FAB-F43A-4988-AF0A-A21646C212F0} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {9A7244CF-EC6B-47C7-85E8-215F589135F7} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation)
Task: {9B95D575-12B4-4183-A313-CCFDBCC814EB} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-21] (Microsoft Corp.)
Task: {9D56B283-4CA4-4DED-A3A6-16F1EE389FF3} - System32\Tasks\McDefragTask => c:\PROGRA~1\mcafee\mqc\QcConsol.exe
Task: {9ED703A9-5FFD-40D5-895A-4385EE1509DE} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {F617BB07-69A2-4068-B73C-D9A769D2FD8B} - System32\Tasks\Microsoft\Windows\PLA\System\{2DDCF444-1FD3-41FE-B08A-0C1AEE4F6C71}_System Diagnostics => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation)
Task: {FDAE8F39-B2E9-40FE-AE7B-3ABE2982D89E} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Helmut => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4202552596-312612828-80714196-1003Core.job => C:\Users\Helmut\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4202552596-312612828-80714196-1003UA.job => C:\Users\Helmut\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\McDefragTask.job => C:\Windows\system32\defrag.exe
Task: C:\Windows\Tasks\McQcTask.job => c:\PROGRA~1\mcafee\mqc\QcConsol.exe

==================== Loaded Modules (whitelisted) =============

2011-04-25 12:03 - 2008-04-30 16:00 - 00204800 _____ () C:\Windows\System32\SysHook.dll
2008-04-04 03:00 - 2008-04-04 03:00 - 00003072 _____ () C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTrayLOC.dll
2011-04-25 05:12 - 2008-06-13 04:10 - 00274432 _____ (Intel Corporation) C:\Windows\system32\igfxrDEU.lrc
2011-04-25 05:13 - 2008-01-20 02:53 - 00100546 _____ (Alps Electric Co., Ltd.) C:\Windows\system32\VXDIF.DLL
2011-04-25 05:13 - 2003-06-07 23:30 - 00057344 _____ () C:\Program Files\Launch Manager\PowerUtl.dll
2008-05-26 01:06 - 2008-05-26 01:06 - 00036864 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3006.0__4df5dcab8860d239\Framework.Utility.dll
2008-05-26 01:06 - 2008-05-26 01:06 - 00061440 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3006.0__3036420f80dd6947\Framework.Library.dll
2008-05-26 01:06 - 2008-05-26 01:06 - 00020480 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3006.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll
2011-04-25 12:51 - 2012-06-17 17:22 - 00829920 _____ (sqlite.org) C:\Program Files\Mozilla Firefox\mozsqlite3.dll
2011-04-25 12:51 - 2012-06-17 17:22 - 02042848 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2011-04-25 13:09 - 2012-01-15 18:37 - 08527008 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32.dll

==================== Alternate Data Streams (whitelisted) ==========


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/17/2013 11:52:33 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 10:54:54 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 08:42:55 PM) (Source: Google Update) (User: Helmut-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned

Error: (09/17/2013 08:36:48 PM) (Source: Google Update) (User: Helmut-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned

Error: (09/17/2013 08:35:49 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 08:24:31 PM) (Source: Google Update) (User: Helmut-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned

Error: (09/17/2013 08:24:22 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 08:22:12 PM) (Source: Google Update) (User: Helmut-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned

Error: (09/17/2013 08:22:03 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 08:17:33 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (09/17/2013 11:52:33 PM) (Source: Service Control Manager) (User: )
Description: DgiVecp%%20

Error: (09/17/2013 11:52:33 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (09/17/2013 11:52:04 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: C:\Windows\system32\athihvs.dll126

Error: (09/17/2013 11:34:07 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: 0x80070020Sicherheitsupdate für Windows Vista (KB2753842){8B889D02-09FD-414F-9367-65644C25925A}200

Error: (09/17/2013 11:34:07 PM) (Source: Microsoft-Windows-Servicing) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB2753842 (Security Update) nicht in den Status Aufgelöst(Resolved) setzen.

Error: (09/17/2013 11:34:07 PM) (Source: Microsoft-Windows-Servicing) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB2753842 (Security Update) nicht in den Status Aufgelöst(Resolved) setzen.

Error: (09/17/2013 11:34:07 PM) (Source: Microsoft-Windows-Servicing) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB2753842 (Security Update) nicht in den Status Aufgelöst(Resolved) setzen.

Error: (09/17/2013 11:34:07 PM) (Source: Microsoft-Windows-Servicing) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB2753842 (Security Update) nicht in den Status Aufgelöst(Resolved) setzen.

Error: (09/17/2013 11:10:21 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: 0x80070643Definition Update for Windows Defender - KB915597 (Definition 1.159.53.0){EAC7122F-BBF2-40BE-9F0D-5D56E8AB55D4}200

Error: (09/17/2013 11:06:52 PM) (Source: Service Control Manager) (User: )
Description: Windows-Defender1600001Neustart des Diensts


Microsoft Office Sessions:
=========================
Error: (09/17/2013 11:52:33 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 10:54:54 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 08:42:55 PM) (Source: Google Update)(User: Helmut-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned

Error: (09/17/2013 08:36:48 PM) (Source: Google Update)(User: Helmut-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned

Error: (09/17/2013 08:35:49 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 08:24:31 PM) (Source: Google Update)(User: Helmut-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned

Error: (09/17/2013 08:24:22 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 08:22:12 PM) (Source: Google Update)(User: Helmut-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned

Error: (09/17/2013 08:22:03 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 08:17:33 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2012-11-04 16:13:59.183
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\SysHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-11-04 16:13:58.719
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\SysHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-11-04 16:13:47.106
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\SysHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-11-04 16:13:46.797
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\SysHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 56%
Total physical RAM: 1976.12 MB
Available physical RAM: 865.05 MB
Total Pagefile: 4205.52 MB
Available Pagefile: 2724.55 MB
Total Virtual: 2047.88 MB
Available Virtual: 1918.46 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:69.65 GB) (Free:32.72 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:69.64 GB) (Free:69.55 GB) NTFS
Drive e: (5082601) (CDROM) (Total:0.63 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149 GB) (Disk ID: D4ECA4D0)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=70 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=70 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-09-2013 03
Ran by Helmut (administrator) on HELMUT-PC on 18-09-2013 00:04:58
Running from C:\Users\Helmut\Desktop
Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
() C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
(InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Acer\Mobility Center\MobilityService.exe
(NewTech InfoSystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
() C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(O2Micro International) C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\Samsung Network Printer Utilities\SyncThru Web Admin Service\SWAS.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
() C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Acer Inc.) C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\HidFind.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apntex.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Realtek Semiconductor Corp.) C:\Users\Helmut\AppData\Local\Temp\RtkBtMnt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
() C:\Users\Helmut\Desktop\Defogger.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jucheck.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BkupTray] - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe [34040 2008-04-06] ()
HKLM\...\Run: [Adobe Reader Speed Launcher] - c:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [40048 2007-03-08] (Adobe Systems Incorporated)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2008-01-25] (Alps Electric Co., Ltd.)
HKLM\...\Run: [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe [870920 2008-06-10] (Dritek System Inc.)
HKLM\...\Run: [ePower_DMC] - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [397312 2008-04-30] (Acer Inc.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [WarReg_PopUp] - C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe [303104 2008-01-29] (Acer Incorporated)
HKLM\...\Run: [Google Desktop Search] - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2011-04-25] (Google)
HKLM\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [536576 2008-06-17] ()
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [6144000 2008-05-21] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-11-21] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-17] (Avira Operations GmbH & Co. KG)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess?
HKCU\...\Run: [uniMobileARM] - rundll32.exe 
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [17148552 2012-02-29] (Skype Technologies S.A.)
HKCU\...\Run: [Validator] - C:\Users\Helmut\AppData\Roaming\Google Inc.\{FBF085C0-7ED2-480D-9EFE-44F2DA02B384}\Validator.exe
HKCU\...\Run: [Facebook Update] - C:\Users\Helmut\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKCU\...\Winlogon: [Shell] Explorer.exe <==== ATTENTION 
HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-4202552596-312612828-80714196-1003\$5fe39fe55c5fabd8783c3092b01c6179\n. ATTENTION! ====> ZeroAccess?
MountPoints2: {0278fc17-6f1e-11e0-96c5-806e6f6e6963} - E:\autostart.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-08-21] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-08-21] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.burgdoerfer.eu/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vb32&d=0411&m=extensa_5630
SearchScopes: HKCU - {70D46D94-BF1E-45ED-B567-48701376298E} URL = hxxp://127.0.0.1:4664/search&s=wc1MqxyjBHc9d2JjUAuUbBChRC0?q={searchTerms}
BHO: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} -  No File
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 36 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Helmut\AppData\Roaming\Mozilla\Firefox\Profiles\gx21mruh.default
FF Homepage: hxxp://startsear.ch/?hp=df
FF Keyword.URL: hxxp://startsear.ch/?q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Helmut\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Users\Helmut\AppData\Roaming\Mozilla\Firefox\Profiles\gx21mruh.default\searchplugins\web-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\googledesktop.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Visualisateur 3D de 20-20 - C:\Users\Helmut\AppData\Roaming\Mozilla\Firefox\Profiles\gx21mruh.default\Extensions\2020Player_IKEA@2020Technologies.com
FF Extension: No Name - C:\Users\Helmut\AppData\Roaming\Mozilla\Firefox\Profiles\gx21mruh.default\Extensions\{dd05fd3d-18df-4ce4-ae53-e795339c5f01}.xpi
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKCU\...\Firefox\Extensions: [{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}] - C:\Users\Helmut\AppData\Roaming\13001.027
FF Extension: Java Link Helper - C:\Users\Helmut\AppData\Roaming\13001.027

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-17] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-17] (Avira Operations GmbH & Co. KG)
R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-03-21] ()
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2011-04-25] (Google)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] ()
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072 2008-04-04] ()
R2 o2flash; C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe [65536 2007-02-13] (O2Micro International)
R2 SWAS_Core; C:\Program Files\Samsung Network Printer Utilities\SyncThru Web Admin Service\SWAS.exe [1449984 2008-04-15] ()
S2 AviraUpgradeService; "C:\Windows\TEMP\AVSETUP_52036592\avupgsvc.exe" /TEMPSTART:""C:\Windows\TEMP\AVSETUP_52036592\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE"

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-09-17] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [41984 2007-11-29] (Samsung Electronics Co., Ltd.)
R2 int15; C:\Windows\system32\drivers\int15.sys [15392 2008-03-21] (Acer, Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-17] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-11-29] (Samsung Electronics)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-18 00:04 - 2013-09-18 00:04 - 00000000 ____D C:\FRST
2013-09-18 00:02 - 2013-09-18 00:03 - 01083437 _____ (Farbar) C:\Users\Helmut\Desktop\FRST.exe
2013-09-18 00:00 - 2013-09-18 00:01 - 00000474 _____ C:\Users\Helmut\Desktop\defogger_disable.log
2013-09-18 00:00 - 2013-09-18 00:00 - 00000000 _____ C:\Users\Helmut\defogger_reenable
2013-09-17 23:58 - 2013-09-17 23:58 - 00050477 _____ C:\Users\Helmut\Desktop\Defogger.exe
2013-09-17 23:37 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-17 23:37 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-17 23:37 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-17 23:37 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-17 23:37 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-17 23:37 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-17 23:37 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-17 23:37 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-17 23:37 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-17 23:37 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-17 23:37 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-17 23:37 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-17 23:37 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-17 23:37 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-17 23:37 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-17 23:37 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-17 23:14 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-17 23:14 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-09-17 23:14 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-09-17 23:13 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-17 23:13 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-17 23:13 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2013-09-17 23:13 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-17 23:12 - 2013-09-17 23:12 - 00000000 ____D C:\Users\Helmut\AppData\Roaming\Avira
2013-09-17 23:12 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-17 23:12 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-17 23:12 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-09-17 23:12 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-17 23:06 - 2013-09-17 23:06 - 00001851 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-17 23:05 - 2013-09-17 23:03 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-09-17 23:04 - 2013-09-17 23:06 - 00000000 ____D C:\ProgramData\Avira
2013-09-17 23:04 - 2013-09-17 23:03 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-17 23:04 - 2013-09-17 23:03 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-17 23:04 - 2013-09-17 23:03 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-17 23:04 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-17 23:04 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-17 23:04 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-17 23:04 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-17 22:59 - 2013-09-17 22:59 - 02092792 _____ C:\Users\Helmut\Downloads\avira_free_4052_antivirus.exe

==================== One Month Modified Files and Folders =======

2013-09-18 06:34 - 2006-11-02 13:18 - 00000000 __RSD C:\Windows\Media
2013-09-18 06:34 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2013-09-18 06:34 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-09-18 06:34 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-09-18 06:34 - 2006-11-02 12:22 - 36438016 _____ C:\Windows\system32\config\software_previous
2013-09-18 06:34 - 2006-11-02 12:22 - 18874368 _____ C:\Windows\system32\config\system_previous
2013-09-18 06:33 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\registration
2013-09-18 06:30 - 2012-03-09 14:20 - 00000000 ____D C:\Program Files\Common Files\Java
2013-09-18 06:30 - 2011-04-25 13:20 - 00000000 ____D C:\Program Files\Avira
2013-09-18 06:25 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-09-18 06:25 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-09-18 00:04 - 2013-09-18 00:04 - 00000000 ____D C:\FRST
2013-09-18 00:03 - 2013-09-18 00:02 - 01083437 _____ (Farbar) C:\Users\Helmut\Desktop\FRST.exe
2013-09-18 00:02 - 2006-11-02 14:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-18 00:02 - 2006-11-02 14:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-18 00:01 - 2013-09-18 00:00 - 00000474 _____ C:\Users\Helmut\Desktop\defogger_disable.log
2013-09-18 00:00 - 2013-09-18 00:00 - 00000000 _____ C:\Users\Helmut\defogger_reenable
2013-09-18 00:00 - 2011-04-25 11:46 - 00000000 ____D C:\Users\Helmut
2013-09-17 23:59 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-17 23:58 - 2013-09-17 23:58 - 00050477 _____ C:\Users\Helmut\Desktop\Defogger.exe
2013-09-17 23:58 - 2011-04-25 11:30 - 01319975 _____ C:\Windows\WindowsUpdate.log
2013-09-17 23:54 - 2011-08-19 19:56 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-17 23:53 - 2011-04-25 12:04 - 00000000 _____ C:\Windows\system32\LogConfigTemp.xml
2013-09-17 23:52 - 2008-05-26 01:02 - 00000147 _____ C:\Windows\system32\agent.log
2013-09-17 23:52 - 2006-11-02 14:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-17 23:51 - 2006-11-02 14:44 - 00396600 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-17 23:49 - 2008-01-21 05:02 - 00028134 _____ C:\Windows\PFRO.log
2013-09-17 23:49 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-17 23:48 - 2006-11-02 14:58 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-17 23:42 - 2006-11-02 12:33 - 01617090 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-17 23:38 - 2011-08-19 19:56 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-17 23:36 - 2013-08-18 11:46 - 00000000 ____D C:\Windows\system32\MRT
2013-09-17 23:12 - 2013-09-17 23:12 - 00000000 ____D C:\Users\Helmut\AppData\Roaming\Avira
2013-09-17 23:06 - 2013-09-17 23:06 - 00001851 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-17 23:06 - 2013-09-17 23:04 - 00000000 ____D C:\ProgramData\Avira
2013-09-17 23:03 - 2013-09-17 23:05 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-09-17 23:03 - 2013-09-17 23:04 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-17 23:03 - 2013-09-17 23:04 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-17 23:03 - 2013-09-17 23:04 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-17 22:59 - 2013-09-17 22:59 - 02092792 _____ C:\Users\Helmut\Downloads\avira_free_4052_antivirus.exe
2013-09-17 20:24 - 2006-11-02 12:22 - 34865152 _____ C:\Windows\system32\config\components_previous
2013-09-17 20:24 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-09-17 20:18 - 2012-04-08 17:08 - 00001356 _____ C:\Users\Helmut\AppData\Local\d3d9caps.dat
2013-09-01 16:57 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-27 19:38 - 2011-04-25 12:14 - 00000000 ____D C:\Users\Helmut\AppData\Local\Google

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-4202552596-312612828-80714196-1003\$5fe39fe55c5fabd8783c3092b01c6179

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$5fe39fe55c5fabd8783c3092b01c6179

Files to move or delete:
====================
C:\ProgramData\0tbpw.pad


Some content of TEMP:
====================
C:\Users\Helmut\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Helmut\AppData\Local\Temp\JavaIC.dll
C:\Users\Helmut\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Helmut\AppData\Local\Temp\msscct32.dll
C:\Users\Helmut\AppData\Local\Temp\RtkBtMnt.exe
C:\Users\Helmut\AppData\Local\Temp\SymcPCCUInstaller.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-17 23:56

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-18 00:33:47
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-1 Hitachi_HTS543216L9A300 rev.FB2OC40C 149,05GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Helmut\AppData\Local\Temp\kwdirpoc.sys


---- System - GMER 2.1 ----

SSDT            8A05B9CE                                                                               ZwCreateSection
SSDT            8A05B9D8                                                                               ZwRequestWaitReplyPort
SSDT            8A05B9D3                                                                               ZwSetContextThread
SSDT            8A05B9DD                                                                               ZwSetSecurityObject
SSDT            8A05B9E2                                                                               ZwSystemDebugControl
SSDT            8A05B96F                                                                               ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!KeSetEvent + 215                                                          81EFA860 4 Bytes  [CE, B9, 05, 8A]
.text           ntkrnlpa.exe!KeSetEvent + 539                                                          81EFAB84 4 Bytes  [D8, B9, 05, 8A]
.text           ntkrnlpa.exe!KeSetEvent + 56D                                                          81EFABB8 4 Bytes  [D3, B9, 05, 8A]
.text           ntkrnlpa.exe!KeSetEvent + 5D1                                                          81EFAC1C 4 Bytes  [DD, B9, 05, 8A]
.text           ntkrnlpa.exe!KeSetEvent + 619                                                          81EFAC64 4 Bytes  [E2, B9, 05, 8A]
.text           ...                                                                                    

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Mozilla Firefox\firefox.exe[2504] ntdll.dll!LdrLoadDll                77A79378 5 Bytes  JMP 649FFA35 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2504] kernel32.dll!MapViewOfFile          77396AD0 5 Bytes  JMP 64CA079E C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2504] kernel32.dll!VirtualAlloc           7739AF55 5 Bytes  JMP 64CA07C5 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2504] GDI32.dll!CreateDIBSection          76ED7461 5 Bytes  JMP 64CA0728 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[4332] USER32.dll!GetWindowInfo   76F3428E 5 Bytes  JMP 64B7AEF3 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[4332] USER32.dll!TrackPopupMenu  76F414F3 5 Bytes  JMP 64B7B50D C:\Program Files\Mozilla Firefox\xul.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \FileSystem\fastfat \Fat                                                               fltmgr.sys

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                                                  unknown MBR code

---- EOF - GMER 2.1 ----