Windows 7 Home Premium 32 bit nicht installierter Antivirus Security Pro meldet Virus

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:34 on 06/11/2013 (Hans-Jürgen)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by **** ****** (administrator) on ******* on 06-11-2013 13:36:41
Running from F:\Virus Laptop Toms Eltern\32 bit
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Micro-Star International Co., Ltd.) C:\Program Files\System Control Manager\MSIService.exe
(Protexis Inc.) c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Iminent) C:\Program Files\Common Files\Umbrella\umbrella.exe
(glindorus) C:\Program Files\glindorus\updateglindorus.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
() C:\ProgramData\gp33pDg3\gp33pDg3.exe
(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [102400 2010-06-08] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1725736 2010-04-22] (Synaptics Incorporated)
HKLM\...\Run: [CLMLServer] - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM\...\Run: [MGSysCtrl] - C:\Program Files\System Control Manager\MGSysCtrl.exe [2478080 2010-06-22] (Micro-Star International Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9267816 2010-06-08] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1481320 2010-06-08] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Iminent] - C:\Program Files\Iminent\Iminent.exe [1074736 2013-10-29] (Iminent)
HKLM\...\Run: [IminentMessenger] - C:\Program Files\Iminent\Iminent.Messengers.exe [884784 2013-10-29] (Iminent)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20472992 2013-10-02] (Skype Technologies S.A.)
HKCU\...\Run: [AS2014] - C:\ProgramData\gp33pDg3\gp33pDg3.exe [587056 2013-11-03] ()
HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [ 2009-10-22] ()
HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [ 2009-10-22] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=B3138B4A-9AA2-4549-B5AA-1AD599535D75
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.google.de/
hxxp://www.google.de/
hxxp://www.google.de/
hxxp://www.google.de/
hxxp://www.google.de/
URLSearchHook: HKCU - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} -  No File
SearchScopes: HKLM - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=B3138B4A-9AA2-4549-B5AA-1AD599535D75&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - {0FC962BE-7725-4031-ABEF-319699E892ED} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {53E94982-EF00-4B5E-9EA7-6E97E27186CF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox
SearchScopes: HKCU - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=B3138B4A-9AA2-4549-B5AA-1AD599535D75&ref=toolbox&q={searchTerms}
BHO: iminent Helper Object - {112BA211-334C-4A90-90EC-2AD1CDAB287C} - C:\Program Files\IminentToolbar\1.8.26.8\bh\iminent.dll (Iminent)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: glindorus - {9598e82a-7e09-4438-b425-b9e9718c3c73} - C:\Program Files\glindorus\glindorusBHO.dll (glindorus)
BHO: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files\Iminent\Iminent.WebBooster.InternetExplorer.dll (SIEN)
BHO: Skype Plug-In - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Iminent Toolbar - {1FAFD711-ABF9-4F6A-8130-5166C7371427} - C:\Program Files\IminentToolbar\1.8.26.8\iminentTlbr.dll (Iminent)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} hxxp://download.bitdefender.com/resources/scanner/sources/de/scan8/oscan8.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

========================== Services (Whitelisted) =================

R2 Micro Star SCM; C:\Program Files\System Control Manager\MSIService.exe [160768 2009-07-09] (Micro-Star International Co., Ltd.)
R2 SProtection; C:\Program Files\Common Files\Umbrella\umbrella.exe [2886464 2013-10-29] (Iminent)
R2 Update glindorus; C:\Program Files\glindorus\updateglindorus.exe [65312 2013-10-05] (glindorus)

==================== Drivers (Whitelisted) ====================

R2 AegisP; C:\Windows\System32\DRIVERS\AegisP.sys [21035 2011-02-13] (Meetinghouse Data Communications)
R2 EAPPkt; C:\Windows\System32\DRIVERS\EAPPkt.sys [38144 2006-11-15] (Windows (R) 2000 DDK provider)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [168480 2009-12-02] (Realtek Semiconductor Corp.)
S3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [379904 2010-03-31] (Realtek Semiconductor Corporation                           )
S1 gndemjsr; \??\C:\Windows\system32\drivers\gndemjsr.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-06 13:36 - 2013-11-06 13:36 - 00000000 ____D C:\FRST
2013-11-06 13:34 - 2013-11-06 13:34 - 00000000 _____ C:\Users\Hans-Jürgen\defogger_reenable
2013-11-06 12:54 - 2013-11-06 12:54 - 00001670 _____ C:\Users\Hans-Jürgen\Desktop\Antivirus Security Pro.lnk
2013-11-06 12:54 - 2013-11-06 12:54 - 00000118 _____ C:\Users\Hans-Jürgen\Desktop\Antivirus Security Pro support.url
2013-11-06 11:10 - 2013-11-06 11:10 - 00000000 ____D C:\Users\Hans-Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antivirus Security Pro
2013-11-05 14:00 - 2013-11-06 12:17 - 00000000 ____D C:\Users\Hans-Jürgen\AppData\Roaming\ALDI_SUED_Mah_Jong
2013-11-05 11:22 - 2013-11-05 11:22 - 11259728 _____ (Microsoft Corporation) C:\Users\Hans-Jürgen\Desktop\mseinstall.exe
2013-11-05 11:22 - 2013-11-05 11:22 - 00000611 _____ C:\Windows\system32\InstallUtil.InstallLog
2013-11-05 11:22 - 2013-11-05 11:22 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-05 11:22 - 2013-11-05 11:22 - 00000000 ____D C:\Program Files\IminentToolbar
2013-11-05 11:22 - 2013-11-05 11:22 - 00000000 ____D C:\Program Files\Iminent
2013-11-05 11:22 - 2013-11-05 11:22 - 00000000 ____D C:\Program Files\glindorus
2013-11-05 11:22 - 2013-11-05 11:22 - 00000000 ____D C:\Program Files\Common Files\Umbrella
2013-11-03 16:29 - 2013-11-06 12:54 - 00000000 ____D C:\ProgramData\gp33pDg3
2013-11-03 16:29 - 2013-11-05 11:22 - 00000000 ____D C:\Users\Hans-Jürgen\AppData\Local\Google
2013-10-13 15:53 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-13 15:53 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-13 15:53 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-13 15:53 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-13 15:53 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-13 15:53 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-13 15:53 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-13 15:53 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-13 15:53 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-13 15:53 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-13 15:53 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-13 15:53 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-13 15:53 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-13 15:53 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-13 15:52 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-13 15:52 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-13 15:46 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-13 15:46 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-13 15:46 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-13 15:46 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-13 15:46 - 2013-07-03 05:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-13 15:46 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-13 15:46 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-13 15:45 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-13 15:45 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-13 15:45 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-13 15:45 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-13 15:45 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-13 15:45 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-13 15:45 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-13 15:45 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-13 15:45 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-13 15:45 - 2013-07-12 11:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-13 15:45 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-13 15:45 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-13 15:45 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-13 15:45 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-13 15:45 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-13 15:45 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-13 15:45 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-13 15:45 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-13 15:45 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-13 15:45 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

==================== One Month Modified Files and Folders =======

2013-11-06 13:36 - 2013-11-06 13:36 - 00000000 ____D C:\FRST
2013-11-06 13:36 - 2010-06-22 11:24 - 01500294 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-06 13:34 - 2013-11-06 13:34 - 00000000 _____ C:\Users\Hans-Jürgen\defogger_reenable
2013-11-06 13:32 - 2009-07-14 05:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-06 13:32 - 2009-07-14 05:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-06 12:57 - 2010-08-03 13:54 - 01599967 _____ C:\Windows\WindowsUpdate.log
2013-11-06 12:54 - 2013-11-06 12:54 - 00001670 _____ C:\Users\Hans-Jürgen\Desktop\Antivirus Security Pro.lnk
2013-11-06 12:54 - 2013-11-06 12:54 - 00000118 _____ C:\Users\Hans-Jürgen\Desktop\Antivirus Security Pro support.url
2013-11-06 12:54 - 2013-11-03 16:29 - 00000000 ____D C:\ProgramData\gp33pDg3
2013-11-06 12:54 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-06 12:54 - 2009-07-14 05:39 - 00101707 _____ C:\Windows\setupact.log
2013-11-06 12:42 - 2013-02-24 14:17 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-06 12:30 - 2011-04-30 11:58 - 00000000 __SHD C:\Users\Hans-Jürgen\AppData\Roaming\.#
2013-11-06 12:17 - 2013-11-05 14:00 - 00000000 ____D C:\Users\Hans-Jürgen\AppData\Roaming\ALDI_SUED_Mah_Jong
2013-11-06 11:10 - 2013-11-06 11:10 - 00000000 ____D C:\Users\Hans-Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antivirus Security Pro
2013-11-05 14:25 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-11-05 11:22 - 2013-11-05 11:22 - 11259728 _____ (Microsoft Corporation) C:\Users\Hans-Jürgen\Desktop\mseinstall.exe
2013-11-05 11:22 - 2013-11-05 11:22 - 00000611 _____ C:\Windows\system32\InstallUtil.InstallLog
2013-11-05 11:22 - 2013-11-05 11:22 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-05 11:22 - 2013-11-05 11:22 - 00000000 ____D C:\Program Files\IminentToolbar
2013-11-05 11:22 - 2013-11-05 11:22 - 00000000 ____D C:\Program Files\Iminent
2013-11-05 11:22 - 2013-11-05 11:22 - 00000000 ____D C:\Program Files\glindorus
2013-11-05 11:22 - 2013-11-05 11:22 - 00000000 ____D C:\Program Files\Common Files\Umbrella
2013-11-05 11:22 - 2013-11-03 16:29 - 00000000 ____D C:\Users\Hans-Jürgen\AppData\Local\Google
2013-11-05 11:04 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\NDF
2013-11-03 16:24 - 2011-02-26 19:10 - 00000000 ____D C:\Users\Hans-Jürgen\AppData\Roaming\Skype
2013-10-30 13:45 - 2011-02-26 19:10 - 00000000 ___RD C:\Program Files\Skype
2013-10-30 13:45 - 2011-02-26 19:10 - 00000000 ____D C:\ProgramData\Skype
2013-10-28 18:46 - 2011-02-14 20:20 - 00000000 ____D C:\Users\Hans-Jürgen\Documents\Youcam
2013-10-25 07:04 - 2009-07-14 05:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-14 18:09 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-13 17:25 - 2009-07-14 05:33 - 00279208 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-13 17:23 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-13 15:55 - 2013-08-17 16:17 - 00000000 ____D C:\Windows\system32\MRT
2013-10-13 15:54 - 2010-06-22 11:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-13 15:53 - 2010-06-22 11:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight

Files to move or delete:
====================
ZeroAccess:
C:\Users\Hans-Jürgen\AppData\Local\Google\Desktop\Install


Some content of TEMP:
====================
C:\Users\Hans-Jürgen\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\Installer.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\_is342A.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\_is36D8.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\_is45B6.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\_is5907.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\_is959A.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\_isBAA7.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\_isCD6C.exe
C:\Users\Hans-Jürgen\AppData\Local\Temp\_isE426.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-05 14:17

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by Hans-Jürgen at 2013-11-06 13:37:16
Running from F:\Virus Laptop Toms Eltern\32 bit
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Acrobat.com (Version: 1.6.65)
Adobe AIR (Version: 1.5.0.7220)
Adobe Flash Player 10 ActiveX (Version: 10.2.152.32)
Adobe Reader 9.5.5 MUI (Version: 9.5.5)
ALDI SÜD Mah Jong
Ashampoo Burning Studio (Version: 9.23.0)
Ashampoo Photo Commander (Version: 8.1.0)
Ashampoo Snap (Version: 3.4.0)
ATI Catalyst Install Manager (Version: 3.0.774.0)
Catalyst Control Center Core Implementation (Version: 2010.0608.2230.38564)
Catalyst Control Center Graphics Full Existing (Version: 2010.0608.2230.38564)
Catalyst Control Center Graphics Full New (Version: 2010.0608.2230.38564)
Catalyst Control Center Graphics Light (Version: 2010.0608.2230.38564)
Catalyst Control Center Graphics Previews Common (Version: 2010.0608.2230.38564)
Catalyst Control Center Graphics Previews Vista (Version: 2010.0608.2230.38564)
Catalyst Control Center InstallProxy (Version: 2010.0608.2230.38564)
Catalyst Control Center Localization All (Version: 2010.0608.2230.38564)
CCC Help Chinese Standard (Version: 2010.0608.2229.38564)
CCC Help Chinese Traditional (Version: 2010.0608.2229.38564)
CCC Help Czech (Version: 2010.0608.2229.38564)
CCC Help Danish (Version: 2010.0608.2229.38564)
CCC Help Dutch (Version: 2010.0608.2229.38564)
CCC Help English (Version: 2010.0608.2229.38564)
CCC Help Finnish (Version: 2010.0608.2229.38564)
CCC Help French (Version: 2010.0608.2229.38564)
CCC Help German (Version: 2010.0608.2229.38564)
CCC Help Greek (Version: 2010.0608.2229.38564)
CCC Help Hungarian (Version: 2010.0608.2229.38564)
CCC Help Italian (Version: 2010.0608.2229.38564)
CCC Help Japanese (Version: 2010.0608.2229.38564)
CCC Help Korean (Version: 2010.0608.2229.38564)
CCC Help Norwegian (Version: 2010.0608.2229.38564)
CCC Help Polish (Version: 2010.0608.2229.38564)
CCC Help Portuguese (Version: 2010.0608.2229.38564)
CCC Help Russian (Version: 2010.0608.2229.38564)
CCC Help Spanish (Version: 2010.0608.2229.38564)
CCC Help Swedish (Version: 2010.0608.2229.38564)
CCC Help Thai (Version: 2010.0608.2229.38564)
CCC Help Turkish (Version: 2010.0608.2229.38564)
ccc-core-static (Version: 2010.0608.2230.38564)
ccc-utility (Version: 2010.0608.2230.38564)
Cisco EAP-FAST Module (Version: 2.2.14)
Cisco LEAP Module (Version: 1.0.19)
Cisco PEAP Module (Version: 1.1.6)
CorelDRAW Essentials 4
CorelDRAW Essentials 4 - Content (Version: 4.0)
CorelDRAW Essentials 4 - Draw (Version: 4.0)
CorelDRAW Essentials 4 - Filters (Version: 4.0)
CorelDRAW Essentials 4 - ICA (Version: 4.0)
CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0)
CorelDRAW Essentials 4 - Lang BR (Version: 4.0)
CorelDRAW Essentials 4 - Lang DE (Version: 4.0)
CorelDRAW Essentials 4 - Lang EN (Version: 4.0)
CorelDRAW Essentials 4 - Lang ES (Version: 4.0)
CorelDRAW Essentials 4 - Lang FR (Version: 4.0)
CorelDRAW Essentials 4 - Lang IT (Version: 4.0)
CorelDRAW Essentials 4 - Lang NL (Version: 4.0)
CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0)
CorelDRAW Essentials 4 - Windows Shell Extension
CorelDRAW Essentials 4 - Windows Shell Extension (Version: 1.1)
CorelDRAW Essentials 4 (Version: 4.0)
CyberLink LabelPrint (Version: 2.5.2602)
CyberLink Power2Go (Version: 6.1.3602c)
CyberLink PowerDVD Copy (Version: 1.5.1306)
CyberLink YouCam (Version: 3.0.2626)
glindorus 1.0.0 (Version: 1.0.0)
Iminent (Version: 6.44.21.0)
Iminent Toolbar on IE and Chrome (Version: 1.8.26.8)
Java Auto Updater (Version: 2.0.2.1)
Java(TM) 6 Update 20 (Version: 6.0.200)
JMicron Flash Media Controller Driver (Version: 1.0.45.0)
Junk Mail filter update (Version: 14.0.8089.726)
Medion Home Cinema (Version: 8.0.1505)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - Deutsch (Version: 14.0.4763.1000)
Microsoft PowerPoint Viewer (Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [DEU] (Version: 3.1.0000)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
PlayReady PC Runtime x86 (Version: 1.3.0)
PowerXpressHybrid (Version: 1.00.0000)
Realtek Ethernet Controller Driver For Windows 7 (Version: 7.18.322.2010)
Realtek High Definition Audio Driver (Version: 6.0.1.6132)
REALTEK Wireless LAN Driver (Version: 1.00.0148)
Skype Toolbars (Version: 5.2.4170)
Skype™ 6.9 (Version: 6.9.106)
Synaptics Pointing Device Driver (Version: 15.0.18.0)
System Control Manager (Version: 2.210.0622.OE006.16.M04)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Windows Live Anmelde-Assistent (Version: 5.000.818.5)
Windows Live Call (Version: 14.0.8064.0206)
Windows Live Communications Platform (Version: 14.0.8064.206)
Windows Live Essentials (Version: 14.0.8089.0726)
Windows Live Essentials (Version: 14.0.8089.726)
Windows Live Fotogalerie (Version: 14.0.8081.709)
Windows Live Mail (Version: 14.0.8089.0726)
Windows Live Messenger (Version: 14.0.8089.0726)
Windows Live Movie Maker (Version: 14.0.8091.0730)
Windows Live Sync (Version: 14.0.8089.726)
Windows Live Writer (Version: 14.0.8089.0726)
Windows Live-Uploadtool (Version: 14.0.8014.1029)
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series (Version: 9.00.2980)
Wireless Network Utility (Version: Package:1.00.0006 Driver:5.1089.601.2007 UI:500.1491.627.2007)
Wireless Network Utility (Version: Package:1.00.0006 Driver:5.1097.201.2007 UI:500.1491.627.2007)

==================== Restore Points  =========================

13-10-2013 14:45:53 Windows Update
13-10-2013 14:52:02 Windows Update
13-10-2013 17:00:07 Windows-Sicherung
13-10-2013 17:31:04 Windows Update
16-10-2013 10:31:41 Windows Update
20-10-2013 20:28:00 Windows-Sicherung
20-10-2013 20:28:41 Windows Update
25-10-2013 06:15:09 Windows Update
28-10-2013 12:20:53 Windows-Sicherung
29-10-2013 08:36:38 Windows Update
03-11-2013 12:46:44 Windows Update
05-11-2013 09:51:17 Windows-Sicherung

==================== Hosts content: ==========================

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0A9622F9-35AB-4F0A-8044-CC31A803D64B} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {7C73BAAA-D03A-431D-8EB7-3C240D21AF22} - System32\Tasks\{BC672989-520A-46FD-9CA0-E2C1D38F2301} => C:\Program Files\Skype\\Phone\Skype.exe [2013-10-02] (Skype Technologies S.A.)
Task: {A41ADA5C-3026-453F-90A9-2C70634F7F13} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BsScanner => ""="Service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/06/2013 01:04:22 PM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (11/06/2013 11:19:36 AM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (11/05/2013 02:18:05 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (11/05/2013 11:27:41 AM) (Source: Application Hang) (User: )
Description: Programm gp33pDg3.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: c84

Startzeit: 01ceda0b380a056b

Endzeit: 15

Anwendungspfad: C:\ProgramData\gp33pDg3\gp33pDg3.exe

Berichts-ID: e1830d7f-4604-11e3-b1ea-406186ad5762

Error: (11/05/2013 10:52:44 AM) (Source: Windows Backup) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Am Sicherungsspeicherort ist nicht genügend freier Speicherplatz verfügbar, um die Daten zu sichern. (0x80780048)"

Error: (11/05/2013 10:51:31 AM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (10/28/2013 01:22:54 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Am Sicherungsspeicherort ist nicht genügend freier Speicherplatz verfügbar, um die Daten zu sichern. (0x80780048)"

Error: (10/25/2013 07:04:55 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_LanmanServer, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x46c
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_LanmanServer0
Pfad der fehlerhaften Anwendung: svchost.exe_LanmanServer1
Pfad des fehlerhaften Moduls: svchost.exe_LanmanServer2
Berichtskennung: svchost.exe_LanmanServer3

Error: (10/22/2013 06:17:53 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (10/20/2013 09:29:56 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Am Sicherungsspeicherort ist nicht genügend freier Speicherplatz verfügbar, um die Daten zu sichern. (0x80780048)"


System errors:
=============
Error: (11/06/2013 11:19:34 AM) (Source: Microsoft Antimalware) (User: )
Description: %%8604.3.0219.01.161.1332.07%%859NT-AUTORITÄTSYSTEMS-1-5-181%%8001%%8031.1.10003.00x8024402cUnerwartetes Problem bei der Überprüfung auf Updates. Informationen zum Installieren von Updates oder zur Problembehandlung finden Sie unter "Hilfe und Support". 1%%852hxxp://www.microsoft.com

Error: (11/05/2013 11:23:14 AM) (Source: DCOM) (User: )
Description: {000C101C-0000-0000-C000-000000000046}

Error: (11/05/2013 11:22:44 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/05/2013 11:22:44 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SProtection" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (11/05/2013 10:51:23 AM) (Source: Microsoft Antimalware) (User: )
Description: %%8604.3.0219.01.161.1332.07%%859NT-AUTORITÄTSYSTEMS-1-5-181%%8001%%8031.1.10003.00x8024402cUnerwartetes Problem bei der Überprüfung auf Updates. Informationen zum Installieren von Updates oder zur Problembehandlung finden Sie unter "Hilfe und Support". 1%%852hxxp://www.microsoft.com

Error: (11/05/2013 10:50:03 AM) (Source: DCOM) (User: )
Description: {98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}

Error: (11/03/2013 04:23:30 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎03.‎11.‎2013 um 16:21:41 unerwartet heruntergefahren.

Error: (11/03/2013 01:35:37 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎03.‎11.‎2013 um 13:33:15 unerwartet heruntergefahren.

Error: (10/25/2013 07:07:00 AM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (10/25/2013 07:06:59 AM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Multimediaklassenplaner" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056


Microsoft Office Sessions:
=========================
Error: (11/06/2013 01:04:22 PM) (Source: CVHSVC)(User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (11/06/2013 11:19:36 AM) (Source: CVHSVC)(User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (11/05/2013 02:18:05 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (11/05/2013 11:27:41 AM) (Source: Application Hang)(User: )
Description: gp33pDg3.exe0.0.0.0c8401ceda0b380a056b15C:\ProgramData\gp33pDg3\gp33pDg3.exee1830d7f-4604-11e3-b1ea-406186ad5762

Error: (11/05/2013 10:52:44 AM) (Source: Windows Backup)(User: )
Description: Am Sicherungsspeicherort ist nicht genügend freier Speicherplatz verfügbar, um die Daten zu sichern. (0x80780048)

Error: (11/05/2013 10:51:31 AM) (Source: CVHSVC)(User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (10/28/2013 01:22:54 PM) (Source: Windows Backup)(User: )
Description: Am Sicherungsspeicherort ist nicht genügend freier Speicherplatz verfügbar, um die Daten zu sichern. (0x80780048)

Error: (10/25/2013 07:04:55 AM) (Source: Application Error)(User: )
Description: svchost.exe_LanmanServer6.1.7600.163854a5bc100unknown0.0.0.000000000c00000050000000046c01ced148110a7809C:\Windows\system32\svchost.exeunknown5e1b35e3-3d3b-11e3-a9bd-406186ad5762

Error: (10/22/2013 06:17:53 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (10/20/2013 09:29:56 PM) (Source: Windows Backup)(User: )
Description: Am Sicherungsspeicherort ist nicht genügend freier Speicherplatz verfügbar, um die Daten zu sichern. (0x80780048)


==================== Memory info =========================== 

Percentage of memory in use: 25%
Total physical RAM: 3071.24 MB
Available physical RAM: 2276.63 MB
Total Pagefile: 6140.77 MB
Available Pagefile: 5271.41 MB
Total Virtual: 2047.88 MB
Available Virtual: 1887.68 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:256.99 GB) (Free:224.39 GB) NTFS
Drive d: (Recover) (Fixed) (Total:40 GB) (Free:4.92 GB) NTFS
Drive f: () (Removable) (Total:3.74 GB) (Free:3.71 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: F22BA34D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=257 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 4 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=4 GB) - (Type=0B)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-06 13:52:36
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\00000058 Hitachi_ rev.FC4O 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\HANS-J~1\AppData\Local\Temp\uxrdapoc.sys


---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D  83454A15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2    8348E212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           C:\Windows\system32\DRIVERS\atikmdag.sys  section is writeable [0x91E3A000, 0x2FC0BA, 0xE8000020]

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0   Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1   Wdf01000.sys
AttachedDevice  \FileSystem\fastfat \Fat                  fltmgr.sys

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                     unknown MBR code

---- EOF - GMER 2.1 ----