BKA-Trojaner, fährt bei abgesichertem Modus runter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2013 02
Ran by Willi (administrator) on WILLI-PC on 18-11-2013 17:58:11
Running from C:\Users\Willi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\KMWDSrv.exe
(Hewlett-Packard Company) c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\StartAutorun.exe
(Siliten) C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\KbClient_FD2.exe
(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\KMConfig.exe
(Siliten) C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\MouClient_FD2.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(UASSOFT.COM) C:\Program Files (x86)\Silvercrest MTS2218 driver\KMProcess.exe
(CyberLink) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(CyberLink Corp.) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\symerr.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\KBD\kbd.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Winlogon: [Userinit] C:\WINDOWS\system32\userinit.exe
MountPoints2: {e0fffd72-770b-11de-9472-806e6f6e6963} - E:\autorun.exe
HKLM-x32\...\Run: [hpsysdrv] - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [KBD] - C:\Program Files (x86)\Hewlett-Packard\KBD\KbdStub.exe [12288 2008-07-21] (Microsoft)
HKLM-x32\...\Run: [KMCONFIG] - C:\Program Files (x86)\Silvercrest MTS2218 driver\StartAutorun.exe KMConfig.exe
HKLM-x32\...\Run: [Launch SilverCrest MTS2219-SL-K] - C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\KbClient_FD2.exe [1424384 2010-09-03] (Siliten)
HKLM-x32\...\Run: [Launch SilverCrest MTS2219-SL-M] - C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\MouClient_FD2.exe [860672 2010-09-03] (Siliten)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\Cyberlink\LabelPrint\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\Cyberlink\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePDIRShortCut] - C:\Program Files (x86)\Cyberlink\PowerDirector\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\Cyberlink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe [210216 2009-02-02] (CyberLink Corp.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1561768 2012-05-04] (Ask)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
AppInit_DLLs-x32: c:\progra~3\browse~1\23796~1.11\{16cdf~1\browse~1.dll [ ] ()
Startup: C:\Users\Willi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=93&bd=Presario&pf=cndt
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=110824&tt=4212_2&babsrc=HP_ss&mntrId=86ed29740000000000000026180e69b4
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM - DefaultScope {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM - {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM - {58235107-16C5-49E2-98F1-21B363368353} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM - {9E85F70F-E0D6-4AD4-823C-1BC5B6AE763C} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM-x32 - DefaultScope {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM-x32 - {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKLM-x32 - {58235107-16C5-49E2-98F1-21B363368353} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM-x32 - {9E85F70F-E0D6-4AD4-823C-1BC5B6AE763C} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKCU - DefaultScope {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {017A66CC-3985-4911-A97F-FECB0BCC95B0} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110824&tt=4212_2&babsrc=SP_ss&mntrId=86ed29740000000000000026180e69b4
SearchScopes: HKCU - {58235107-16C5-49E2-98F1-21B363368353} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - {5AE612B1-2BCD-478E-AC38-FA47CA3138FA} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=6421419A-6C72-478F-9B9A-11BBC7030DC9&apn_sauid=B885066A-EF97-4256-A0AC-4615AB7323FD
SearchScopes: HKCU - {9E85F70F-E0D6-4AD4-823C-1BC5B6AE763C} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=20&locale=de_DE&gct=kwd&qsrc=2869
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52272 2009-05-19] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default
FF user.js: detected! => C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\user.js
FF Homepage: hxxp://www.google.de/ig
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\searchplugins\safesearch.xml
FF SearchPlugin: C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\searchplugins\WebSearch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: LavaFox V2-Blue - C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\Extensions\djziggy@gmail.com
FF Extension: No Name - C:\Users\Willi\AppData\Roaming\Mozilla\Firefox\Profiles\ib4jrgh7.default\Extensions\WTB_GLOBAL.sqlite
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [ntfdsaftsfdfdxx@mozilla.org] - C:\Users\Willi\AppData\Roaming\Free Media Pack\extension_firefox.xpi
FF Extension: No Name - C:\Users\Willi\AppData\Roaming\Free Media Pack\extension_firefox.xpi
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFF

Chrome: 
=======
CHR HomePage: hxxp://websearch.oversearch.info/?pid=969&r=2013/09/17&hid=8392900373862859251&lg=EN&cc=DE&unqvl=36
CHR RestoreOnStartup: 		"urls_to_restore_on_startup": [
CHR Extension: (Browse2save) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbofdekhceiophbojfilglehgciieapk\1
CHR Extension: (saVenashare ) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibimjopifbpdgllmenfbedjhifpbfbij\5.10
CHR Extension: (Plus-HD-2.2) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfakeonomonapccoamcmdgpoaicnpnoo\1.23.10_0
CHR Extension: (SearchNewTab) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\legepjmdalkoddjgaplaipoclplbhbcl\1.0
CHR Extension: (PricePeep) - C:\Users\Willi\AppData\Local\Google\Chrome\User Data\Default\Extensions\licjnkifamhpbaefhdpacpmihicfbomb\2.1.0.22_0
CHR HKLM-x32\...\Chrome\Extension: [gkjoindjjcmbdpbfppabdgflnkgbbcli] - C:\Program Files (x86)\FTDownloader.com\FTDownloader10.crx
CHR HKLM-x32\...\Chrome\Extension: [kekfoodhbhpjhjcdecjngamojfhknooc] - C:\Users\Willi\AppData\Roaming\Free Media Pack\extension_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.crx

==================== Services (Whitelisted) =================

R2 KMWDSERVICE; C:\Program Files (x86)\Silvercrest MTS2218 driver\KMWDSrv.exe [208896 2008-05-30] (UASSOFT.COM)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20131101.003\BHDrvx64.sys [1524824 2013-10-23] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-09-17] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20131115.001\IDSvia64.sys [521816 2013-10-28] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20131115.017\ENG64.SYS [126040 2013-11-08] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20131115.017\EX64.SYS [2099288 2013-11-08] (Symantec Corporation)
S3 OV550I; C:\Windows\System32\Drivers\ov550ivx.sys [196992 2008-02-21] (Omnivision Technologies, Inc.)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
S1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2009-08-26] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
S3 SYMFW; \SystemRoot\System32\Drivers\NISx64\1008030.006\SYMFW.SYS [x]
S3 SYMNDISV; \SystemRoot\System32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-18 17:58 - 2013-11-18 17:58 - 00016763 _____ C:\Users\Willi\Desktop\FRST.txt
2013-11-18 17:57 - 2013-11-18 14:33 - 01958026 _____ (Farbar) C:\Users\Willi\Desktop\FRST64.exe
2013-11-18 17:21 - 2013-11-18 17:21 - 00000000 ____D C:\FRST
2013-11-16 11:49 - 2013-11-17 18:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 13:22 - 2013-11-14 13:22 - 00000000 ____D C:\Windows\Panther
2013-11-14 12:05 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-14 12:05 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-14 12:05 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-14 12:05 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-14 12:05 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-14 12:05 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 12:05 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 12:05 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 12:05 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-14 12:05 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-14 12:05 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-14 12:05 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 07:33 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 07:33 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 07:33 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 07:33 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 07:33 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 07:33 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-14 07:32 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 07:32 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 07:32 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 07:32 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 07:32 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 07:32 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 07:32 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 07:32 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 07:32 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 07:32 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 07:32 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 07:32 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 07:32 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 07:32 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 07:32 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 07:32 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 07:32 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 07:32 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-10-23 08:42 - 2013-11-18 17:52 - 00210482 _____ C:\Windows\setupact.log
2013-10-23 08:42 - 2013-10-23 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-10-20 15:10 - 2013-10-20 15:10 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 15:10 - 2013-10-08 06:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-20 15:10 - 2013-10-08 06:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-20 15:10 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-20 15:10 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-20 15:09 - 2013-10-20 15:10 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log

==================== One Month Modified Files and Folders =======

2013-11-18 17:58 - 2013-11-18 17:58 - 00016763 _____ C:\Users\Willi\Desktop\FRST.txt
2013-11-18 17:56 - 2012-04-13 11:33 - 01396250 _____ C:\Windows\WindowsUpdate.log
2013-11-18 17:55 - 2010-01-19 17:34 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{6587D8B7-C844-481A-8772-26373D901CB6}
2013-11-18 17:52 - 2013-10-23 08:42 - 00210482 _____ C:\Windows\setupact.log
2013-11-18 17:52 - 2010-01-18 15:55 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-18 17:52 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-18 17:21 - 2013-11-18 17:21 - 00000000 ____D C:\FRST
2013-11-18 14:33 - 2013-11-18 17:57 - 01958026 _____ (Farbar) C:\Users\Willi\Desktop\FRST64.exe
2013-11-18 10:39 - 2010-01-19 16:42 - 00014880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-18 10:39 - 2010-01-19 16:42 - 00014880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-18 10:37 - 2010-01-18 15:55 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-18 10:36 - 2009-07-14 18:58 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-11-18 10:36 - 2009-07-14 18:58 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-11-18 10:36 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-18 10:36 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-18 10:33 - 2012-04-13 11:00 - 00000000 ____D C:\Users\Willi
2013-11-17 18:50 - 2013-11-16 11:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-17 18:50 - 2012-05-09 22:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-17 18:50 - 2009-12-24 15:25 - 00000000 ____D C:\Users\Willi\AppData\Roaming\vlc
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-11-17 18:50 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-17 18:50 - 2009-05-19 05:54 - 00000000 ____D C:\ProgramData\Norton
2013-11-17 16:14 - 2013-08-15 21:41 - 00000000 ____D C:\Windows\system32\MRT
2013-11-16 16:39 - 2010-01-19 12:11 - 00000000 _____ C:\Users\Willi\AppData\Roaming\wklnhst.dat
2013-11-16 16:23 - 2013-03-15 18:30 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-15 17:01 - 2010-08-30 13:58 - 00000448 ____H C:\Windows\Tasks\Norton Security Scan for Willi.job
2013-11-14 13:33 - 2012-04-13 11:57 - 00000099 _____ C:\Users\Public\LMDebug.log
2013-11-14 13:26 - 2012-09-14 18:44 - 00012754 _____ C:\Users\Willi\Desktop\Notizen.odt
2013-11-14 13:23 - 2013-05-26 19:19 - 00010107 _____ C:\Users\Willi\Desktop\erledigen.odt
2013-11-14 13:22 - 2013-11-14 13:22 - 00000000 ____D C:\Windows\Panther
2013-11-14 12:03 - 2012-04-13 12:37 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-05 12:10 - 2012-02-28 22:02 - 00094208 _____ C:\Users\Willi\Desktop\buch.xls
2013-11-01 10:35 - 2013-10-16 19:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 21:20 - 2010-08-26 17:17 - 00003188 _____ C:\Windows\System32\Tasks\HPCeeScheduleForWilli
2013-10-30 21:20 - 2010-08-26 17:17 - 00000334 _____ C:\Windows\Tasks\HPCeeScheduleForWilli.job
2013-10-28 17:32 - 2012-07-12 20:42 - 00000000 ____D C:\Users\Willi\AppData\Local\CrashDumps
2013-10-23 08:42 - 2013-10-23 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-10-20 15:10 - 2013-10-20 15:10 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 15:10 - 2013-10-20 15:09 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-20 15:10 - 2013-06-22 08:38 - 00000000 ____D C:\Program Files (x86)\Java

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-10 19:16

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-11-2013 02
Ran by Willi at 2013-11-18 17:59:02
Running from C:\Users\Willi\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Norton Internet Security (Enabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

64 Bit HP CIO Components Installer (Version: 6.2.2)
Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0.1)
Activation Assistant for the 2007 Microsoft Office suites (x32)
Adobe Flash Player 10 ActiveX (x32 Version: 10.0.12.36)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe SVG Viewer 3.0 (x32 Version:  3.0)
ArcSoft PhotoImpression 6 (x32 Version: 6.1.8.146)
Ask Toolbar (x32 Version: 1.15.2.0)
Ask Toolbar Updater (HKCU Version: 1.2.1.23037)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
CyberLink DVD Suite Deluxe (x32 Version: 6.0.2602)
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904)
DJ_SF_06_D1600_SW_Min (x32 Version: 140.0.690.000)
Foxit Reader (x32 Version: 3.1.4.1125)
Free Audio CD Burner version 1.2 (x32)
Free Media Pack (HKCU)
Free Media Pack Usenet.nl (x32)
FTDownloader (x32 Version: 2.1 Build 26473)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.165)
Hardwarediagnosetools (Version: 6.0.5205.31)
HP Customer Experience Enhancements (x32 Version: 5.7.0.2945)
HP Deskjet D1600 Printer Driver 14.0 Rel. 6 (Version: 14.0)
HP MediaSmart DVD (x32 Version: 3.0.3420)
HP MediaSmart Music/Photo/Video (x32 Version: 3.0.3228)
HP Picasso Media Center Add-In (x32 Version: 9.1.7.0)
HP Recovery Manager RSS (x32 Version: 92.0.0.11)
HP Total Care Setup (x32 Version: 1.2.2854.2975)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
LabelPrint (x32 Version: 2.5.1402)
LightScribe System Software (x32 Version: 1.18.3.2)
Magic Desktop (x32)
Malwarebytes Anti-Malware Version 1.62.0.1300 (x32 Version: 1.62.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Works (x32 Version: 9.7.0621)
Mozilla Firefox 25.0.1 (x86 de) (x32 Version: 25.0.1)
Mozilla Maintenance Service (x32 Version: 25.0.1)
Mozilla Thunderbird 24.1.0 (x86 de) (x32 Version: 24.1.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Multimedia-Enzyklopädie (x32)
Norton Internet Security (x32 Version: 20.4.0.40)
Norton Security Scan (x32 Version: 3.5.1.8)
NVIDIA Drivers (Version: 1.3)
OpenOffice.org 3.1 (x32 Version: 3.1.9420)
Optimierte Multimedia-Tastatur-Lösung (x32 Version: 1.0.9.2)
OVTScanner_Vista64 (x32 Version: 1.00.0000)
Power2Go (x32 Version: 6.0.2602)
PowerDirector (x32 Version: 7.0.2611)
Python 2.6 pywin32-212 (x32 Version: 2.12)
Python 2.6.1 (x32 Version: 2.6.1150)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5882)
Registry Repair 4.1.0.388 (x32 Version: 4.1.0.388)
Samsung Easy Printer Manager (x32 Version: 1.00.62.00)
Samsung ML-1670 Series (x32)
Samsung Printer Live Update (x32)
Silvercrest MTS2218 driver (x32 Version: 5.09.04.21)
SilverCrest MTS2219-SL Driver (x32 Version: 1.0)
Toolbox (x32 Version: 140.0.428.000)
Uninstall 1.0.0.1 (x32)
VLC media player 1.1.7 (x32 Version: 1.1.7)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
WinRAR
Yontoo 1.10.03 (Version: 1.10.03)

==================== Restore Points  =========================

28-04-2013 16:23:23 Installed Java 7 Update 21
11-05-2013 16:10:29 Geplanter Prüfpunkt
16-05-2013 17:26:41 Wiederherstellungsvorgang
16-05-2013 17:34:59 Windows Update
16-05-2013 20:56:59 Windows Update
30-05-2013 16:59:45 Geplanter Prüfpunkt
07-06-2013 16:30:42 Geplanter Prüfpunkt
12-06-2013 20:16:58 Windows Update
16-06-2013 21:25:26 Windows Update
17-06-2013 14:39:31 Wiederherstellungsvorgang
18-06-2013 01:00:24 Windows Update
22-06-2013 07:37:41 Installed Java 7 Update 25
01-07-2013 19:47:03 Geplanter Prüfpunkt
09-07-2013 11:26:25 Geplanter Prüfpunkt
11-07-2013 21:03:13 Windows Update
18-07-2013 22:11:40 Geplanter Prüfpunkt
26-07-2013 14:22:56 Geplanter Prüfpunkt
29-07-2013 19:20:35 Wiederherstellungsvorgang
06-08-2013 09:42:55 Geplanter Prüfpunkt
13-08-2013 16:11:22 Geplanter Prüfpunkt
15-08-2013 20:39:57 Windows Update
23-08-2013 17:49:31 Geplanter Prüfpunkt
03-09-2013 17:16:49 Geplanter Prüfpunkt
10-09-2013 22:00:14 Geplanter Prüfpunkt
12-09-2013 01:00:28 Windows Update
12-09-2013 21:01:13 Windows Update
17-09-2013 18:51:57 Wiederherstellungsvorgang
25-09-2013 09:24:04 Geplanter Prüfpunkt
02-10-2013 10:44:52 Geplanter Prüfpunkt
08-10-2013 17:12:50 Installed OVTScanner_Vista64.
08-10-2013 17:13:17 Installed OVTScanner_Vista64.
08-10-2013 17:17:26 Installiert PhotoImpression
09-10-2013 20:37:52 Windows Update
20-10-2013 14:09:02 Installed Java 7 Update 45
29-10-2013 14:20:15 Geplanter Prüfpunkt
06-11-2013 07:17:56 Geplanter Prüfpunkt
14-11-2013 10:05:03 Geplanter Prüfpunkt
14-11-2013 11:02:58 Windows Update
16-11-2013 15:48:50 Wiederherstellungsvorgang
17-11-2013 15:11:40 Windows Update

==================== Hosts content: ==========================

2006-11-02 13:34 - 2006-09-18 22:37 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {0C739CE5-6B07-4166-A93D-C699B0422782} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {110EBD4B-0297-40C6-B6E2-A2F3C681F08F} - System32\Tasks\Games\UpdateCheck_S-1-5-21-3671571329-2275905496-885990249-1000
Task: {16869ED2-DD15-4BE8-845A-F073B38BD74F} - System32\Tasks\CLMLSvc => C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [2009-08-28] (CyberLink)
Task: {20F8AF39-59E7-4944-9656-2B4A5F7E4DD4} - System32\Tasks\DVDAgent => C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [2009-10-20] (CyberLink Corp.)
Task: {3C35140A-578B-4A33-BBD8-793AC8CCF62F} - System32\Tasks\HPCeeScheduleForWilli => C:\Program Files (x86)\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2009-02-24] (Hewlett-Packard)
Task: {5E3BECA9-4AC3-4ADB-87DE-8311A16853C1} - \SidebarExecute No Task File
Task: {69387679-F8A6-438C-A7CA-7E22C909C22C} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\wscstub.exe [2013-06-04] (Symantec Corporation)
Task: {712C6861-2B14-4E72-92BA-22B6921FE2B7} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {89AFA96B-19BF-43F5-9963-7FF59A2AD3C4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {A4C1BF27-697A-4CF4-8F18-910A76E70126} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-01-18] (Google Inc.)
Task: {B8537ED1-083F-4869-B999-2686D4355BBF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-01-18] (Google Inc.)
Task: {CAC5FE53-D35D-4D79-B98A-490BB5E07173} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-05-04] ()
Task: {DC59D859-1F13-4539-BA21-CD7AADABCC88} - System32\Tasks\Norton Security Scan for Willi => C:\PROGRA~2\NORTON~3\Engine\351~1.8\Nss.exe
Task: {E7F7550C-D3FA-46AE-8BBD-7D268037DC27} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {EACA307C-706A-4B5C-B38D-C5E3A31B6CBC} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\symerr.exe [2013-06-04] (Symantec Corporation)
Task: {EB4D4184-19B8-4C38-9D9D-31DF1D4A742D} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\symerr.exe [2013-06-04] (Symantec Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForWilli.job => C:\Program Files (x86)\Hewlett-Packard\SDP\Ceement\HPCEE.exe
Task: C:\Windows\Tasks\Norton Security Scan for Willi.job => C:\PROGRA~2\NORTON~3\Engine\351~1.8\Nss.exe

==================== Loaded Modules (whitelisted) =============

2011-02-26 13:41 - 2010-03-15 11:28 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2013-06-17 15:48 - 2012-05-30 07:51 - 00699280 ____R () C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY\ENGINE\20.4.0.40\wincfi39.dll
2009-08-18 15:54 - 2009-08-18 15:54 - 00970752 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2010-12-09 10:17 - 2010-09-03 14:31 - 00053248 _____ () C:\Program Files (x86)\SilverCrest MTS2219-SL Driver\UniFunc.dll
2008-07-11 16:27 - 2008-07-11 16:27 - 00106496 _____ () C:\Program Files (x86)\Silvercrest MTS2218 driver\keydll.dll
2008-06-16 09:06 - 2008-06-16 09:06 - 00053248 _____ () C:\Program Files (x86)\Silvercrest MTS2218 driver\MouseHook.dll
2009-08-28 11:52 - 2009-08-28 11:52 - 00931112 _____ () c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Symantec Network Security Intermediate Filter Driver
Description: Symantec Network Security Intermediate Filter Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: SymIM
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/18/2013 05:53:56 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/18/2013 10:35:18 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 06:35:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 06:30:56 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a144
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb164a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000005132a
ID des fehlerhaften Prozesses: 0xa98
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (11/17/2013 06:28:21 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer" nicht initialisiert werden.


Details:
Could not query the status of the EventSystem service.

System Error:
Der Computer wird heruntergefahren.
.

Error: (11/17/2013 04:09:26 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 04:06:43 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 04:05:22 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a144
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb164a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000005175a
ID des fehlerhaften Prozesses: 0xa48
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (11/17/2013 00:50:34 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 00:47:22 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (11/18/2013 05:52:31 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SymIM

Error: (11/18/2013 01:26:03 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SymIM

Error: (11/18/2013 10:40:31 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SymIM

Error: (11/18/2013 10:34:00 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SymIM

Error: (11/17/2013 06:39:07 PM) (Source: DCOM) (User: )
Description: 1084ShellHWDetection{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (11/17/2013 06:39:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (11/17/2013 06:39:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (11/17/2013 06:39:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (11/17/2013 06:39:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (11/17/2013 06:39:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068


Microsoft Office Sessions:
=========================
Error: (11/18/2013 05:53:56 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/18/2013 10:35:18 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 06:35:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 06:30:56 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175144ce7a144ntdll.dll6.1.7601.1822951fb164ac0000005000000000005132aa9801cee3babf64e1ecC:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll0378e4ab-4fae-11e3-9e72-0026180e69b4

Error: (11/17/2013 06:28:21 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
Could not query the status of the EventSystem service.

System Error:
Der Computer wird heruntergefahren.

Error: (11/17/2013 04:09:26 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 04:06:43 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 04:05:22 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175144ce7a144ntdll.dll6.1.7601.1822951fb164ac0000005000000000005175aa4801cee3a66bfad762C:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dlladc2e63d-4f99-11e3-a7ad-0026180e69b4

Error: (11/17/2013 00:50:34 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/17/2013 00:47:22 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2012-07-12 20:31:59.498
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.480
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.463
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.443
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.424
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.404
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.385
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.367
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.349
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-12 20:31:59.331
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\crypt32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 39%
Total physical RAM: 4095.18 MB
Available physical RAM: 2468 MB
Total Pagefile: 8188.54 MB
Available Pagefile: 6443.65 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (COMPAQ) (Fixed) (Total:305.61 GB) (Free:177.43 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (FACTORY_IMAGE) (Fixed) (Total:14.53 GB) (Free:2.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Software) (CDROM) (Total:0.11 GB) (Free:0 GB) CDFS
Drive g: (Festplatte) (Fixed) (Total:276.02 GB) (Free:177.44 GB) NTFS
Drive i: (USB-STICK) (Removable) (Total:7.45 GB) (Free:7.45 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=306 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=276 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 7 GB) (Disk ID: 1CB57BDF)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

==================== End Of Log ============================