Windows 7: Rechner hat Virenbefall. Avira meldet services.exe bei jedem Start!

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by dhushan (administrator) on ZULU on 02-10-2013 10:13:57
Running from C:\Users\dhushan\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

() C:\Windows\system32\services.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
() C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\AppIntegrator64.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
() D:\Programme\phonostar-Player\phonostarTimer.exe
() C:\Program Files (x86)\dradio-Recorder\phonostarTimer.exe
(Nikon Corporation) C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
() C:\Program Files (x86)\Northstar\SmartCopy\SmartCopy.exe
(North Star com.) C:\Program Files (x86)\Northstar\SmartLauncher\SmartLauncher.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(COMPANYVERS_NAME) C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(VER_COMPANY_NAME) C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe
() C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [VideoDownloadConverter Home Page Guard 64 bit] - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\AppIntegrator64.exe [548936 2013-09-14] ()
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-10-13] (Google Inc.)
HKCU\...\Run: [phonostarTimer] - D:\Programme\phonostar-Player\phonostarTimer.exe [39936 2010-04-01] ()
HKCU\...\Run: [dradio-RecorderTimer] - C:\Program Files (x86)\dradio-Recorder\phonostarTimer.exe [40960 2011-06-20] ()
HKCU\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\dhushan\AppData\Local\{b522f2dd-e2eb-b5e4-d4b7-50bbc394d728}\n. ATTENTION! ====> ZeroAccess?
MountPoints2: {9f30dee6-244a-11df-9fc9-00016c6fa9f5} - H:\LaunchU3.exe -a
HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-08-12] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [629280 2009-08-18] ()
HKLM-x32\...\Run: [EgisTecLiveUpdate] - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] - C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-09-29] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] - C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-09-29] (Acer Corp.)
HKLM-x32\...\Run: [GrooveMonitor] - D:\Programme\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-08-10] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421160 2010-09-01] (Apple Inc.)
HKLM-x32\...\Run: [AdobeCS4ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [611712 2008-08-14] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogitechQuickCamRibbon] - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2780432 2009-05-08] ()
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [VideoDownloadConverter Search Scope Monitor] - C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zsrchmn.exe [44784 2013-09-14] (MindSpark)
HKLM-x32\...\Run: [VideoDownloadConverter_4z Browser Plugin Loader] - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe [30096 2013-09-14] (VER_COMPANY_NAME)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spiegel.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210qn06973154u15yh9l3cl3q
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210qn06973154u15yh9l3cl3q
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210qn06973154u15yh9l3cl3q
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210qn06973154u15yh9l3cl3q
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m7810&r=17360210qn06973154u15yh9l3cl3q
URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
URLSearchHook: (No Name) - {93a3111f-4f74-4ed8-895e-d9708497629e} -  No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=10588
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ALSV5&o=1665&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=AU&apn_dtid=YYYYYYYYDE&apn_uid=C2A619C6-40B6-4F55-AE90-3612902B5ACB&apn_sauid=B8DC1356-5D95-4991-8C74-E50827BC7CED
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Toolbar BHO - {312f84fb-8970-4fd3-bddb-7012eac4afc9} - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbar.dll (MindSpark)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Search Assistant BHO - {c547c6c2-561b-4169-a2a5-20ba771ca93b} - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll (MindSpark)
BHO-x32: Auslogics Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Auslogics Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - VideoDownloadConverter - {48586425-6bb7-4f51-8dc6-38c88e3ebb58} - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbar.dll (MindSpark)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU -  No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Handler-x32: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\dhushan\AppData\Roaming\Mozilla\Firefox\Profiles\m9z85dj0.default
FF Homepage: hxxp://www.spiegel.de/
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.4 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @VideoDownloadConverter_4z.com/Plugin - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll (MindSpark)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-04] (Avira Operations GmbH & Co. KG)
S3 Microsoft Office Groove Audit Service; D:\Programme\Microsoft Office\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)
R2 VideoDownloadConverter_4zService; C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbarsvc.exe [42504 2013-09-14] (COMPANYVERS_NAME)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-30] (Avira Operations GmbH & Co. KG)
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-04-30] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-04-30] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-02 10:13 - 2013-10-02 10:13 - 00000000 ____D C:\FRST
2013-10-02 10:12 - 2013-10-02 10:12 - 01953880 _____ (Farbar) C:\Users\dhushan\Desktop\FRST64.exe
2013-10-02 10:11 - 2013-10-02 10:11 - 00000476 _____ C:\Users\dhushan\Desktop\defogger_disable.log
2013-10-02 10:11 - 2013-10-02 10:11 - 00000000 _____ C:\Users\dhushan\defogger_reenable
2013-10-02 10:10 - 2013-10-02 10:10 - 00050477 _____ C:\Users\dhushan\Desktop\Defogger.exe
2013-10-02 09:26 - 2013-10-02 09:26 - 98712514 _____ C:\Windows\SysWOW64\䫚躏轜S
2013-10-01 18:37 - 2013-10-01 18:37 - 98609570 _____ C:\Windows\SysWOW64\ᕗ灍轜š
2013-09-30 11:56 - 2013-10-02 10:05 - 00001478 _____ C:\Windows\PFRO.log
2013-09-30 11:56 - 2013-10-02 10:05 - 00000280 _____ C:\Windows\setupact.log
2013-09-30 11:56 - 2013-09-30 11:56 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 18:03 - 2013-09-29 18:03 - 98466785 _____ C:\Windows\SysWOW64\줵ᴰ轜š
2013-09-27 15:14 - 2013-09-27 15:14 - 98267320 _____ C:\Windows\SysWOW64\＂韜轜™
2013-09-25 19:26 - 2013-09-25 19:26 - 97787360 _____ C:\Windows\SysWOW64\悎핼轜¢
2013-09-25 13:26 - 2013-09-25 13:26 - 97729025 _____ C:\Windows\SysWOW64\曤ĕ轜–
2013-09-24 14:05 - 2013-09-24 14:05 - 97531747 _____ C:\Windows\SysWOW64\஼䚗轜‹
2013-09-23 14:13 - 2013-09-23 14:13 - 98646441 _____ C:\Windows\SysWOW64\齖䬔轜N
2013-09-22 11:40 - 2013-09-22 11:40 - 98586517 _____ C:\Windows\SysWOW64\뗏ꤿ轜)
2013-09-20 14:01 - 2013-09-20 14:01 - 98474815 _____ C:\Windows\SysWOW64\᳕ߌ轜[
2013-09-19 14:25 - 2013-09-19 14:25 - 98378485 _____ C:\Windows\SysWOW64\膗⮚轜@
2013-09-18 13:16 - 2013-09-18 13:16 - 98123923 _____ C:\Windows\SysWOW64\陇珎轜˜
2013-09-16 12:22 - 2013-09-16 18:22 - 97787879 _____ C:\Windows\SysWOW64\⟟踠轜™
2013-09-14 17:43 - 2013-09-14 17:43 - 00000000 ____D C:\Program Files (x86)\Video Download Converter
2013-09-14 17:42 - 2013-09-14 17:42 - 00000000 ____D C:\Program Files (x86)\VideoDownloadConverter_4z
2013-09-11 09:22 - 2013-09-11 09:22 - 97063418 _____ C:\Windows\SysWOW64\熫鴳轜S
2013-09-10 18:32 - 2013-09-10 18:32 - 96985259 _____ C:\Windows\SysWOW64\︕䕂轜C
2013-09-09 18:29 - 2013-09-09 18:29 - 96732368 _____ C:\Windows\SysWOW64\瀒霕轜‘
2013-09-07 17:28 - 2013-09-07 17:28 - 96511910 _____ C:\Windows\SysWOW64\⡨�轜I
2013-09-06 10:40 - 2013-09-06 10:40 - 96304236 _____ C:\Windows\SysWOW64\Ẋ電轜”

==================== One Month Modified Files and Folders =======

2013-10-02 10:13 - 2013-10-02 10:13 - 00000000 ____D C:\FRST
2013-10-02 10:13 - 2009-07-14 06:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-02 10:13 - 2009-07-14 06:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-02 10:12 - 2013-10-02 10:12 - 01953880 _____ (Farbar) C:\Users\dhushan\Desktop\FRST64.exe
2013-10-02 10:11 - 2013-10-02 10:11 - 00000476 _____ C:\Users\dhushan\Desktop\defogger_disable.log
2013-10-02 10:11 - 2013-10-02 10:11 - 00000000 _____ C:\Users\dhushan\defogger_reenable
2013-10-02 10:11 - 2010-02-14 14:24 - 00000000 ____D C:\Users\dhushan
2013-10-02 10:10 - 2013-10-02 10:10 - 00050477 _____ C:\Users\dhushan\Desktop\Defogger.exe
2013-10-02 10:06 - 2010-03-02 19:22 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-02 10:05 - 2013-09-30 11:56 - 00001478 _____ C:\Windows\PFRO.log
2013-10-02 10:05 - 2013-09-30 11:56 - 00000280 _____ C:\Windows\setupact.log
2013-10-02 10:05 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-02 09:54 - 2010-03-02 19:22 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-02 09:42 - 2013-02-25 11:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-02 09:33 - 2010-02-26 13:41 - 00000000 ____D C:\Users\dhushan\AppData\Roaming\UseNeXT
2013-10-02 09:30 - 2010-07-19 10:49 - 00000020 ____H C:\ProgramData\PKP_DLdw.DAT
2013-10-02 09:26 - 2013-10-02 09:26 - 98712514 _____ C:\Windows\SysWOW64\䫚躏轜S
2013-10-01 19:03 - 2010-11-05 17:46 - 00000000 ____D C:\Users\dhushan\Documents\UseNeXT
2013-10-01 18:49 - 2009-12-16 12:40 - 00643628 _____ C:\Windows\system32\perfh007.dat
2013-10-01 18:49 - 2009-12-16 12:40 - 00126188 _____ C:\Windows\system32\perfc007.dat
2013-10-01 18:49 - 2009-07-14 07:13 - 01471828 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-01 18:37 - 2013-10-01 18:37 - 98609570 _____ C:\Windows\SysWOW64\ᕗ灍轜š
2013-09-30 14:52 - 2010-11-21 16:32 - 00000236 _____ C:\Users\dhushan\AppData\Roaming\default.rss
2013-09-30 14:52 - 2010-06-24 13:20 - 00000069 _____ C:\Windows\NeroDigital.ini
2013-09-30 14:28 - 2010-02-26 16:06 - 00000000 ____D C:\Users\dhushan\AppData\Roaming\vlc
2013-09-30 11:56 - 2013-09-30 11:56 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 18:03 - 2013-09-29 18:03 - 98466785 _____ C:\Windows\SysWOW64\줵ᴰ轜š
2013-09-27 15:14 - 2013-09-27 15:14 - 98267320 _____ C:\Windows\SysWOW64\＂韜轜™
2013-09-25 19:26 - 2013-09-25 19:26 - 97787360 _____ C:\Windows\SysWOW64\悎핼轜¢
2013-09-25 13:26 - 2013-09-25 13:26 - 97729025 _____ C:\Windows\SysWOW64\曤ĕ轜–
2013-09-24 14:05 - 2013-09-24 14:05 - 97531747 _____ C:\Windows\SysWOW64\஼䚗轜‹
2013-09-23 14:13 - 2013-09-23 14:13 - 98646441 _____ C:\Windows\SysWOW64\齖䬔轜N
2013-09-22 11:40 - 2013-09-22 11:40 - 98586517 _____ C:\Windows\SysWOW64\뗏ꤿ轜)
2013-09-20 14:42 - 2013-02-25 11:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-20 14:42 - 2013-02-25 11:20 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-20 14:42 - 2011-08-29 11:32 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-20 14:01 - 2013-09-20 14:01 - 98474815 _____ C:\Windows\SysWOW64\᳕ߌ轜[
2013-09-19 14:25 - 2013-09-19 14:25 - 98378485 _____ C:\Windows\SysWOW64\膗⮚轜@
2013-09-18 13:16 - 2013-09-18 13:16 - 98123923 _____ C:\Windows\SysWOW64\陇珎轜˜
2013-09-16 18:22 - 2013-09-16 12:22 - 97787879 _____ C:\Windows\SysWOW64\⟟踠轜™
2013-09-14 17:43 - 2013-09-14 17:43 - 00000000 ____D C:\Program Files (x86)\Video Download Converter
2013-09-14 17:42 - 2013-09-14 17:42 - 00000000 ____D C:\Program Files (x86)\VideoDownloadConverter_4z
2013-09-11 09:22 - 2013-09-11 09:22 - 97063418 _____ C:\Windows\SysWOW64\熫鴳轜S
2013-09-10 18:32 - 2013-09-10 18:32 - 96985259 _____ C:\Windows\SysWOW64\︕䕂轜C
2013-09-09 18:29 - 2013-09-09 18:29 - 96732368 _____ C:\Windows\SysWOW64\瀒霕轜‘
2013-09-07 17:28 - 2013-09-07 17:28 - 96511910 _____ C:\Windows\SysWOW64\⡨�轜I
2013-09-06 10:40 - 2013-09-06 10:40 - 96304236 _____ C:\Windows\SysWOW64\Ẋ電轜”
2013-09-04 13:40 - 2013-05-06 13:22 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-04 13:40 - 2013-03-30 15:17 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-04 13:40 - 2013-03-30 15:17 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

ZeroAccess:
C:\Windows\Installer\{b522f2dd-e2eb-b5e4-d4b7-50bbc394d728}
C:\Windows\Installer\{b522f2dd-e2eb-b5e4-d4b7-50bbc394d728}\@
C:\Windows\Installer\{b522f2dd-e2eb-b5e4-d4b7-50bbc394d728}\U\00000001.@
C:\Windows\Installer\{b522f2dd-e2eb-b5e4-d4b7-50bbc394d728}\U\00000002.@
C:\Windows\Installer\{b522f2dd-e2eb-b5e4-d4b7-50bbc394d728}\U\80000000.@
C:\Windows\Installer\{b522f2dd-e2eb-b5e4-d4b7-50bbc394d728}\U\80000001.@
C:\Windows\Installer\{b522f2dd-e2eb-b5e4-d4b7-50bbc394d728}\U\800000cb.@

ZeroAccess:
C:\Users\dhushan\AppData\Local\{b522f2dd-e2eb-b5e4-d4b7-50bbc394d728}
C:\Users\dhushan\AppData\Local\{b522f2dd-e2eb-b5e4-d4b7-50bbc394d728}\@

Files to move or delete:
====================
C:\ProgramData\dsgsdgdsgdsgw.pad
C:\ProgramData\ism_0_llatsni.pad
C:\ProgramData\PKP_DLdu.DAT
C:\ProgramData\PKP_DLdw.DAT


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2009-07-14 01:19] - [2009-07-14 03:39] - 0328704 ____N () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\System32\services.exe IS INFECTED. <===== ATTENTION!

C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2012-10-14 15:09

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-09-2013 02
Ran by dhushan at 2013-10-02 10:14:41
Running from C:\Users\dhushan\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (x32)
7-Zip 4.65 (x32)
Acer Arcade Deluxe (x32 Version: 3.2.6929)
Acer Backup Manager (x32 Version: 2.0.2.19)
Acer eRecovery Management (x32 Version: 4.05.3005)
Acer Registration (x32 Version: 1.02.3006)
Acer ScreenSaver (x32 Version: 1.1.0812)
Acer Updater (x32 Version: 1.01.3017)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 1.5.0.7220)
Adobe Anchor Service CS4 (x32 Version: 2.0)
Adobe Anchor Service x64 CS4 (Version: 2.0)
Adobe Bridge CS4 (x32 Version: 3)
Adobe CMaps CS4 (x32 Version: 2.0)
Adobe CMaps x64 CS4 (Version: 2.0)
Adobe Color - Photoshop Specific CS4 (x32 Version: 2.0)
Adobe Color EU Recommended Settings CS4 (x32 Version: 2.0)
Adobe Color JA Extra Settings CS4 (x32 Version: 2.0)
Adobe Color NA Extra Settings CS4 (x32 Version: 2.0)
Adobe Color Video Profiles CS CS4 (x32 Version: 2.0)
Adobe CSI CS4 (x32 Version: 1)
Adobe CSI CS4 x64 (Version: 1)
Adobe Default Language CS4 (x32 Version: 2.0)
Adobe Device Central CS4 (x32 Version: 2)
Adobe Drive CS4 (x32 Version: 1)
Adobe Drive CS4 x64 (Version: 1)
Adobe ExtendScript Toolkit CS4 (x32 Version: 3.0.0)
Adobe Extension Manager CS4 (x32 Version: 2.0)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.175)
Adobe Fonts All (x32 Version: 2.0)
Adobe Fonts All x64 (Version: 2.0)
Adobe Linguistics CS4 (x32 Version: 4.0.0)
Adobe Linguistics CS4 x64 (Version: 4.0.0)
Adobe Media Player (x32 Version: 0.0.0)
Adobe Media Player (x32 Version: 1.1)
Adobe Output Module (x32 Version: 2.0)
Adobe PDF Library Files CS4 (x32 Version: 9.0)
Adobe PDF Library Files x64 CS4 (Version: 9.0)
Adobe Photoshop CS4 (64 Bit) (Version: 11.0)
Adobe Photoshop CS4 (x32 Version: 11.0)
Adobe Photoshop CS4 Support (x32 Version: 11.0)
Adobe Reader 9.5.5 MUI (x32 Version: 9.5.5)
Adobe Search for Help (x32 Version: 1.0)
Adobe Service Manager Extension (x32 Version: 1.0)
Adobe Setup (x32 Version: 2.0)
Adobe Type Support CS4 (x32 Version: 9.0)
Adobe Type Support x64 CS4 (Version: 9.0)
Adobe Update Manager CS4 (x32 Version: 6.0.0)
Adobe WinSoft Linguistics Plugin (x32 Version: 1.1)
Adobe WinSoft Linguistics Plugin x64 (Version: 1.1)
Adobe XMP Panels CS4 (x32 Version: 2.0)
AdobeColorCommonSetCMYK (x32 Version: 2.0)
AdobeColorCommonSetRGB (x32 Version: 2.0)
Advertising Center (x32 Version: 0.0.0.2)
AMD DnD V1.0.19 (x32 Version: 1.0.19)
Apple Application Support (x32 Version: 1.3.2)
Apple Mobile Device Support (Version: 3.2.0.47)
Apple Software Update (x32 Version: 2.1.3.127)
Ask Toolbar (x32 Version: 1.9.1.0)
ATI Catalyst Install Manager (Version: 3.0.745.0)
Audials (x32 Version: 8.0.54900.0)
Audials TV (x32 Version: 1.3.10803.300)
Auslogics Registry Cleaner (x32 Version: version 2.0)
Avira Free Antivirus (x32 Version: 13.0.0.4052)
Backup Manager Advance (x32 Version: 2.0.2.19)
Bonjour (Version: 2.0.2.0)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Core Implementation (x32 Version: 2009.0925.1707.28889)
Catalyst Control Center Graphics Full Existing (x32 Version: 2009.0925.1707.28889)
Catalyst Control Center Graphics Full New (x32 Version: 2009.0925.1707.28889)
Catalyst Control Center Graphics Light (x32 Version: 2009.0925.1707.28889)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.0925.1707.28889)
Catalyst Control Center InstallProxy (x32 Version: 2009.0925.1707.28889)
Catalyst Control Center Localization All (x32 Version: 2009.0925.1707.28889)
CCC Help Chinese Standard (x32 Version: 2009.0925.1706.28889)
CCC Help Chinese Traditional (x32 Version: 2009.0925.1706.28889)
CCC Help Czech (x32 Version: 2009.0925.1706.28889)
CCC Help Danish (x32 Version: 2009.0925.1706.28889)
CCC Help Dutch (x32 Version: 2009.0925.1706.28889)
CCC Help English (x32 Version: 2009.0925.1706.28889)
CCC Help Finnish (x32 Version: 2009.0925.1706.28889)
CCC Help French (x32 Version: 2009.0925.1706.28889)
CCC Help German (x32 Version: 2009.0925.1706.28889)
CCC Help Greek (x32 Version: 2009.0925.1706.28889)
CCC Help Hungarian (x32 Version: 2009.0925.1706.28889)
CCC Help Italian (x32 Version: 2009.0925.1706.28889)
CCC Help Japanese (x32 Version: 2009.0925.1706.28889)
CCC Help Korean (x32 Version: 2009.0925.1706.28889)
CCC Help Norwegian (x32 Version: 2009.0925.1706.28889)
CCC Help Polish (x32 Version: 2009.0925.1706.28889)
CCC Help Portuguese (x32 Version: 2009.0925.1706.28889)
CCC Help Russian (x32 Version: 2009.0925.1706.28889)
CCC Help Spanish (x32 Version: 2009.0925.1706.28889)
CCC Help Swedish (x32 Version: 2009.0925.1706.28889)
CCC Help Thai (x32 Version: 2009.0925.1706.28889)
CCC Help Turkish (x32 Version: 2009.0925.1706.28889)
ccc-core-static (x32 Version: 2009.0925.1707.28889)
ccc-utility64 (Version: 2009.0925.1707.28889)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
Connect (x32 Version: 1.0.0.1)
DB Screensaver 02 (x32)
DolbyFiles (x32 Version: 2.0)
dradio-Recorder Version 3.02.2 (x32)
eSobi v2 (x32 Version: 2.0.4.000274)
Free Audio CD Burner version 1.3 (x32)
Free PDF to Word Doc Converter v1.1 (x32 Version: 1.1)
Free YouTube to MP3 Converter version 3.5 (x32)
Google Earth (x32 Version: 7.1.1.1888)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4413.1752)
Google Update Helper (x32 Version: 1.3.21.153)
Hotkey Utility (x32 Version: 1.00.3004)
Identity Card (x32 Version: 1.00.3002)
ImagXpress (x32 Version: 7.0.74.0)
Intel® Matrix Storage Manager
IrfanView (remove only) (x32)
iTunes (Version: 10.0.0.68)
Java(TM) 6 Update 15 (x32 Version: 6.0.150)
JDownloader (x32 Version: 0.89)
JMicron JMB36X Driver (x32 Version: 1.00.0000)
Junk Mail filter update (x32 Version: 14.0.8089.726)
kuler (x32 Version: 2.0)
Logitech Vid HD (x32 Version: 7.2 (7230))
Logitech Webcam Software (Version: 12.00.1280)
Logitech Webcam Software-Treiberpaket (Version: 12.0.1278)
Malwarebytes Anti-Malware Version 1.62.0.1300 (x32 Version: 1.62.0.1300)
Menu Templates - Starter Kit (x32 Version: 9.4.6.0)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Language Pack 2007 - German/Deutsch (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.4 (x32 Version: 2.0.3008.0)
Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (x32)
Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (x32 Version: 4.1.10329.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Movie Templates - Starter Kit (x32 Version: 9.4.6.0)
Mozilla Firefox 19.0 (x86 de) (x32 Version: 19.0)
Mozilla Maintenance Service (x32 Version: 19.0)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MyWinLocker (x32 Version: 3.1.76.0)
Nero 9 Trial (x32)
Nero BurnRights (x32 Version: 3.4.13.100)
Nero ControlCenter (x32 Version: 9.0.0.1)
Nero CoverDesigner (x32 Version: 4.4.12.100)
Nero Disc Copy Gadget (x32 Version: 2.4.34.0)
Nero DiscSpeed (x32 Version: 5.4.13.100)
Nero DriveSpeed (x32 Version: 4.4.12.100)
Nero InfoTool (x32 Version: 6.4.12.100)
Nero Installer (x32 Version: 4.4.9.0)
Nero PhotoSnap (x32 Version: 2.4.28.0)
Nero Recode (x32 Version: 4.4.38.1)
Nero Rescue Agent (x32 Version: 2.4.14.100)
Nero ShowTime (x32 Version: 5.4.21.100)
Nero StartSmart (x32 Version: 9.4.19.100)
Nero Vision (x32 Version: 6.4.16.100)
Nero WaveEditor (x32 Version: 5.4.37.1)
NeroBurningROM (x32 Version: 9.4.26.100)
NeroExpress (x32 Version: 9.4.26.100)
neroxml (x32 Version: 1.0.0)
Nikon Message Center (x32 Version: 0.92.000)
Nikon RAW Codec (x32 Version: 1.00.0000)
Nikon Transfer (x32 Version: 1.1.1)
NVIDIA Drivers (Version: 1.7)
PDF Settings CS4 (x32 Version: 9.0)
phonostar-Player Version 3.01.7 (x32)
Photoshop Camera Raw (x32 Version: 5.0)
Photoshop Camera Raw_x64 (Version: 5.0)
Picture Control Utility (x32 Version: 1.1.2)
QuickTime (x32 Version: 7.67.75.0)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5874)
SmartCopy (x32)
SmartLauncher (x32)
SoundTrax (x32 Version: 4.4.37.1)
Suite Shared Configuration CS4 (x32 Version: 1.0)
Uninstall 1.0.0.1 (x32)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687267) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
UseNeXT by Tangysoft (x32)
VideoDownloadConverter Internet Explorer Toolbar (x32)
ViewNX (x32 Version: 1.1.1)
Visual C++ 9.0 CRT (x86) WinSXS MSM (x32 Version: 9.0)
VLC media player 1.0.5 (x32 Version: 1.0.5)
Welcome Center (x32 Version: 1.00.3008)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live ID-Anmelde-Assistent (Version: 6.500.3146.0)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
YTD Video Downloader 3.9.6 (x32 Version: 3.9.6)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2010-09-15 12:03 - 00002180 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1       activate.adobe.com
127.0.0.1       practivate.adobe.com
127.0.0.1       adobeereg.com
127.0.0.1       hxxp://www.adobeereg.com
127.0.0.1       activate.adobe.com
127.0.0.1       activate-sea.adobe.com
127.0.0.1       activate-sjc0.adobe.com
127.0.0.1       wwis-dubc1-vip60.adobe.com
127.0.0.1       192.150.18.108
127.0.0.1       activate.adobe.com:443
127.0.0.1       3dns-3.adobe.com
127.0.0.1       3dns-2.adobe.com
127.0.0.1       adobeereg.com
127.0.0.1       www.adobeereg.com
127.0.0.1       activate.adobe.com
127.0.0.1       activate-sea.adobe.com
127.0.0.1       activate-sjc0.adobe.com
127.0.0.1       wwis-dubc1-vip60.adobe.com
127.0.0.1       192.150.18.108
127.0.0.1       adobeereg.com
127.0.0.1       www.adobeereg.com
127.0.0.1       activate.adobe.com
127.0.0.1       activate-sea.adobe.com
127.0.0.1       activate-sjc0.adobe.com
127.0.0.1       wwis-dubc1-vip60.adobe.com
127.0.0.1       192.150.18.108
127.0.0.1       adobe-dns.adobe.com
127.0.0.1       adobe-dns-2.adobe.com

There are 7 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {35919146-8C24-4373-923D-8C8F8E3DE3AA} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2010-09-28] ()
Task: {8B4BC667-277B-4527-948C-F259CF0A694A} - System32\Tasks\McQcModifier-5c47-a7b0 => C:\ProgramData\McQcModifier-5c47-a7b0\McQcModifier-5c47-a7b0.cmd [2009-08-29] ()
Task: {A7245A6A-E61A-4397-BDC7-FD20028FB644} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {B39BE0B3-1183-486E-8813-F6675AECF6F3} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {B5EB542B-744A-4920-8B0B-5E7F979FB64F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-23] (Google Inc.)
Task: {CDF5EA1D-46EF-4D7B-ACEA-6A5FFA9E20D9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-23] (Google Inc.)
Task: {D9590F43-DD52-425E-BAA6-EF5DB67C82C9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-20] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-14 17:42 - 2013-09-14 17:42 - 00292424 _____ () C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\AppIntegratorStub64.dll
2013-09-14 17:42 - 2013-09-14 17:42 - 00442952 _____ () C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\HPG64.DLL
2009-08-14 11:55 - 2009-08-14 11:55 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2009-12-17 13:17 - 2009-12-17 13:17 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-11-03 18:10 - 2012-09-19 20:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2009-02-03 02:33 - 2009-02-03 02:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2008-09-29 02:55 - 2008-09-29 02:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll
2010-03-01 18:39 - 2009-08-13 12:54 - 02013184 _____ () D:\Programme\phonostar-Player\QtCore4.dll
2010-03-01 18:39 - 2009-06-20 07:51 - 07464448 _____ () D:\Programme\phonostar-Player\QtGui4.dll
2010-03-01 18:39 - 2009-06-20 07:51 - 00179712 _____ () D:\Programme\phonostar-Player\QtSql4.dll
2010-03-01 18:39 - 2009-06-20 08:55 - 00344576 _____ () D:\Programme\phonostar-Player\plugins\sqldrivers\qsqlite4.dll
2011-09-18 11:40 - 2011-06-15 14:07 - 02293248 _____ () C:\Program Files (x86)\dradio-Recorder\QtCore4.dll
2011-09-18 11:40 - 2011-03-30 08:16 - 08173568 _____ () C:\Program Files (x86)\dradio-Recorder\QtGui4.dll
2011-09-18 11:40 - 2011-03-30 07:59 - 00191488 _____ () C:\Program Files (x86)\dradio-Recorder\QtSql4.dll
2011-09-18 11:40 - 2011-03-30 11:46 - 00416256 _____ () C:\Program Files (x86)\dradio-Recorder\plugins\sqldrivers\qsqlite4.dll
2009-08-18 09:31 - 2009-08-18 09:31 - 00163840 _____ () C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll
2010-03-15 16:57 - 2010-03-15 16:57 - 00067872 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-08 18:03 - 2013-04-08 18:03 - 03067288 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== Faulty Device Manager Devices =============

Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/30/2013 00:06:49 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "N:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (09/30/2013 00:03:01 PM) (Source: Application Hang) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17514 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 7ac

Startzeit: 01cebdc361641530

Endzeit: 16942

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: 6743b1af-29b7-11e3-a60c-00016c6fa9f5

Error: (09/30/2013 11:57:27 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (09/29/2013 06:17:04 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1
Name des fehlerhaften Moduls: kmddsp.tsp, Version: 6.1.7600.16385, Zeitstempel: 0x523f154e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000003c1f
ID des fehlerhaften Prozesses: 0x15e0
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe0
Pfad der fehlerhaften Anwendung: svchost.exe1
Pfad des fehlerhaften Moduls: svchost.exe2
Berichtskennung: svchost.exe3

Error: (09/29/2013 01:17:30 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10000

Error: (09/29/2013 01:17:30 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10000

Error: (09/29/2013 01:17:30 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/29/2013 01:17:29 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9001

Error: (09/29/2013 01:17:29 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9001

Error: (09/29/2013 01:17:29 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (10/02/2013 10:06:11 AM) (Source: Service Control Manager) (User: )
Description: IPsec-Richtlinien-AgentBFE

Error: (10/02/2013 10:06:03 AM) (Source: Service Control Manager) (User: )
Description: IKE- und AuthIP IPsec-SchlüsselerstellungsmoduleBFE

Error: (10/02/2013 10:06:03 AM) (Source: Service Control Manager) (User: )
Description: Computerbrowser%%1060

Error: (10/02/2013 10:06:01 AM) (Source: Service Control Manager) (User: )
Description: Funktionssuche-Ressourcenveröffentlichung%%-2147024891

Error: (10/02/2013 09:25:30 AM) (Source: Service Control Manager) (User: )
Description: IPsec-Richtlinien-AgentBFE

Error: (10/02/2013 09:25:24 AM) (Source: Service Control Manager) (User: )
Description: Computerbrowser%%1060

Error: (10/02/2013 09:25:23 AM) (Source: Service Control Manager) (User: )
Description: IKE- und AuthIP IPsec-SchlüsselerstellungsmoduleBFE

Error: (10/02/2013 09:25:21 AM) (Source: Service Control Manager) (User: )
Description: Funktionssuche-Ressourcenveröffentlichung%%-2147024891

Error: (10/01/2013 06:37:10 PM) (Source: Service Control Manager) (User: )
Description: IPsec-Richtlinien-AgentBFE

Error: (10/01/2013 06:37:02 PM) (Source: Service Control Manager) (User: )
Description: IKE- und AuthIP IPsec-SchlüsselerstellungsmoduleBFE


Microsoft Office Sessions:
=========================
Error: (06/22/2013 07:08:47 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (07/03/2011 11:37:40 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 22 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (07/03/2011 11:36:45 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 142 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (07/03/2011 11:34:00 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 15 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (07/03/2011 11:33:18 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2385 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (07/03/2011 10:53:04 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 74 seconds with 60 seconds of active time.  This session ended with a crash.

Error: (07/03/2011 10:51:33 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 11 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (07/03/2011 10:51:06 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3373 seconds with 3180 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 22%
Total physical RAM: 8183.08 MB
Available physical RAM: 6351.1 MB
Total Pagefile: 16364.35 MB
Available Pagefile: 14341.53 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:97.65 GB) (Free:24.55 GB) NTFS
Drive d: (DATA) (Fixed) (Total:97.65 GB) (Free:94.42 GB) NTFS
Drive e: (STORE) (Fixed) (Total:97.65 GB) (Free:83.94 GB) NTFS
Drive f: (BACKUP) (Fixed) (Total:623.45 GB) (Free:620.58 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: EA9780B0)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=98 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=819 GB) - (Type=05)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-02 10:39:22
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST310005 rev.CC44 931,51GB
Running: 9h2u4ps3.exe; Driver: C:\Users\dhushan\AppData\Local\Temp\ugldypog.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000075041465 2 bytes [04, 75]
.text   C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000750414bb 2 bytes [04, 75]
.text   ...                                                                                                                                             * 2
.text   C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe[1216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                        0000000075041465 2 bytes [04, 75]
.text   C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe[1216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                       00000000750414bb 2 bytes [04, 75]
.text   ...                                                                                                                                             * 2
.text   C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69               0000000075041465 2 bytes [04, 75]
.text   C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155              00000000750414bb 2 bytes [04, 75]
.text   ...                                                                                                                                             * 2

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\services.exe [592:3432]                                                                                                     00000000001a1c68

---- EOF - GMER 2.1 ----