BKA-Trojaner? Firefox-Fenster wollte sich nicht schließen lassen

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-12-2013
Ran by Werner (administrator) on PILLEPOP on 02-12-2013 11:08:54
Running from C:\Users\Werner\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TomTom) C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(combit GmbH) C:\Program Files (x86)\combit\amw\cmar01.exe
(Dropbox, Inc.) C:\Users\Werner\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(combit GmbH) C:\Program Files (x86)\combit\amw\tm.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Macrovision Europe Ltd.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\audiosrv.exe
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2011-12-16] (Synaptics Incorporated)
HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [489472 2011-12-16] (IDT, Inc.)
HKLM-x32\...\Winlogon: [Userinit] C:\Windows\sysWOW64\userinit.exe [26624 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [MyTomTomSA.exe] - C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe [455608 2013-05-23] (TomTom)
MountPoints2: {aea9f570-d65c-11e0-8a98-1cc1deb051dc} - D:\LaunchU3.exe -a
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [499768 2009-09-01] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-10-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-14] (Avira Operations GmbH & Co. KG)
HKU\Default\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
Startup: C:\Users\Werner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\combit address pick-up.lnk
ShortcutTarget: combit address pick-up.lnk -> C:\Program Files (x86)\combit\amw\cmar01.exe (combit GmbH)
Startup: C:\Users\Werner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Werner\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Werner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\time manager.lnk
ShortcutTarget: time manager.lnk -> C:\Program Files (x86)\combit\amw\tm.exe (combit GmbH)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\fe1o3ttp.default
FF user.js: detected! => C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\fe1o3ttp.default\user.js
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\fe1o3ttp.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [280120 2010-10-01] (Hewlett-Packard Company)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [96384 2010-05-21] (Realtek Semiconductor Corp.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-02 11:08 - 2013-12-02 11:10 - 00009931 _____ C:\Users\Werner\Desktop\FRST.txt
2013-12-02 11:08 - 2013-12-02 11:08 - 00000474 _____ C:\Users\Werner\Desktop\defogger_disable.log
2013-12-02 11:08 - 2013-12-02 11:08 - 00000000 ____D C:\FRST
2013-12-02 11:08 - 2013-12-02 11:08 - 00000000 _____ C:\Users\Werner\defogger_reenable
2013-12-02 11:05 - 2013-12-02 11:05 - 00377856 _____ C:\Users\Werner\Desktop\gmer_2.1.19163.exe
2013-12-02 11:04 - 2013-12-02 11:04 - 01959184 _____ (Farbar) C:\Users\Werner\Desktop\FRST64.exe
2013-12-02 11:04 - 2013-12-02 11:04 - 00050477 _____ C:\Users\Werner\Desktop\Defogger.exe
2013-11-26 11:48 - 2013-11-21 15:49 - 1135902720 _____ C:\Users\Werner\Desktop\Nancarrow.iso
2013-11-19 20:53 - 2013-11-19 20:53 - 00000000 ____D C:\Users\Werner\Documents\Neuer Ordner
2013-11-16 20:30 - 2013-11-16 20:37 - 00000000 ____D C:\Users\Werner\Desktop\Usedom Auswahl
2013-11-15 21:59 - 2013-11-15 22:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 20:32 - 2013-11-15 20:40 - 00015957 _____ C:\Users\Werner\Desktop\Inhalt 4-2013.odt
2013-11-13 00:43 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-11-13 00:43 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-11-13 00:43 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-11-13 00:43 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-11-13 00:43 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-11-13 00:43 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-11-13 00:43 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-11-13 00:43 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-11-13 00:43 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-11-13 00:43 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-11-13 00:43 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-11-13 00:43 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-11-13 00:43 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-11-13 00:43 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-13 00:42 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-11-13 00:42 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-11-13 00:42 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-11-13 00:42 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-11-13 00:42 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-11-13 00:42 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-11-13 00:42 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-11-13 00:42 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-11-13 00:42 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-11-13 00:42 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-11-13 00:42 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-11-13 00:42 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-11-13 00:42 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-11-13 00:42 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-11-13 00:42 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-11-13 00:42 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-11-13 00:42 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-11-12 21:08 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll
2013-11-12 21:08 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
2013-11-12 21:08 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL
2013-11-12 21:08 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll
2013-11-12 21:08 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL
2013-11-12 21:08 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-11-12 21:08 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-11-12 21:08 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll
2013-11-12 21:08 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\credui.dll
2013-11-12 21:08 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2013-11-12 21:08 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-12 21:08 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2013-11-12 21:08 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\credui.dll
2013-11-12 21:08 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2013-11-12 21:08 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2013-11-12 21:08 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2013-11-12 21:08 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2013-11-12 21:08 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2013-11-12 21:08 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2013-11-12 21:08 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2013-11-12 21:08 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2013-11-12 21:08 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2013-11-12 21:08 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2013-11-12 21:07 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2013-11-12 21:07 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2013-11-12 21:07 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2013-11-12 21:07 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2013-11-12 21:07 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2013-11-12 21:07 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2013-11-12 21:07 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2013-11-11 23:02 - 2013-12-02 00:52 - 00056596 _____ C:\windows\IE11_main.log
2013-11-02 22:40 - 2013-11-21 23:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird

==================== One Month Modified Files and Folders =======

2013-12-02 11:10 - 2013-12-02 11:08 - 00009931 _____ C:\Users\Werner\Desktop\FRST.txt
2013-12-02 11:09 - 2009-07-14 05:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-02 11:09 - 2009-07-14 05:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-02 11:08 - 2013-12-02 11:08 - 00000474 _____ C:\Users\Werner\Desktop\defogger_disable.log
2013-12-02 11:08 - 2013-12-02 11:08 - 00000000 ____D C:\FRST
2013-12-02 11:08 - 2013-12-02 11:08 - 00000000 _____ C:\Users\Werner\defogger_reenable
2013-12-02 11:08 - 2011-08-17 23:27 - 00000000 ____D C:\Users\Werner
2013-12-02 11:05 - 2013-12-02 11:05 - 00377856 _____ C:\Users\Werner\Desktop\gmer_2.1.19163.exe
2013-12-02 11:04 - 2013-12-02 11:04 - 01959184 _____ (Farbar) C:\Users\Werner\Desktop\FRST64.exe
2013-12-02 11:04 - 2013-12-02 11:04 - 00050477 _____ C:\Users\Werner\Desktop\Defogger.exe
2013-12-02 10:59 - 2012-03-30 21:08 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-12-02 10:41 - 2010-10-05 19:38 - 01904600 _____ C:\windows\WindowsUpdate.log
2013-12-02 10:35 - 2011-08-18 12:46 - 00000000 ___RD C:\Users\Werner\Dropbox
2013-12-02 10:35 - 2011-08-18 12:44 - 00000000 ____D C:\Users\Werner\AppData\Roaming\Dropbox
2013-12-02 10:34 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-12-02 10:34 - 2009-07-14 05:51 - 00142443 _____ C:\windows\setupact.log
2013-12-02 00:52 - 2013-11-11 23:02 - 00056596 _____ C:\windows\IE11_main.log
2013-12-02 00:50 - 2011-10-05 09:20 - 00000000 ____D C:\Users\Werner\Documents\Adressen
2013-12-01 17:19 - 2010-09-10 12:27 - 00656294 _____ C:\windows\system32\perfh007.dat
2013-12-01 17:19 - 2010-09-10 12:27 - 00130894 _____ C:\windows\system32\perfc007.dat
2013-12-01 17:19 - 2009-07-14 06:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-28 15:22 - 2012-12-14 16:28 - 00003192 _____ C:\windows\System32\Tasks\HPCeeScheduleForWerner
2013-11-28 15:22 - 2012-12-14 16:28 - 00000336 _____ C:\windows\Tasks\HPCeeScheduleForWerner.job
2013-11-26 11:50 - 2012-01-29 14:25 - 00000000 ____D C:\Users\Werner\AppData\Roaming\dvdcss
2013-11-26 11:50 - 2011-09-05 23:37 - 00000000 ____D C:\Users\Werner\AppData\Roaming\vlc
2013-11-25 22:56 - 2012-03-30 21:08 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-11-25 22:56 - 2012-03-30 21:08 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-11-25 22:56 - 2011-08-19 19:41 - 00000000 ____D C:\Users\Werner\AppData\Local\Adobe
2013-11-25 22:56 - 2011-08-18 12:38 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-24 20:30 - 2011-08-18 21:31 - 00000000 ____D C:\Users\Werner\AppData\Roaming\BOM
2013-11-22 12:17 - 2012-04-28 11:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-21 23:21 - 2013-11-02 22:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-11-21 15:49 - 2013-11-26 11:48 - 1135902720 _____ C:\Users\Werner\Desktop\Nancarrow.iso
2013-11-19 20:54 - 2013-03-30 11:44 - 00000000 ____D C:\Users\Werner\Documents\Bedienungsanleitungen
2013-11-19 20:53 - 2013-11-19 20:53 - 00000000 ____D C:\Users\Werner\Documents\Neuer Ordner
2013-11-16 20:37 - 2013-11-16 20:30 - 00000000 ____D C:\Users\Werner\Desktop\Usedom Auswahl
2013-11-15 22:00 - 2013-11-15 21:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 21:26 - 2011-08-19 07:18 - 00000000 ____D C:\windows\rescache
2013-11-15 20:40 - 2013-11-15 20:32 - 00015957 _____ C:\Users\Werner\Desktop\Inhalt 4-2013.odt
2013-11-14 11:39 - 2013-05-07 13:07 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-11-14 11:39 - 2013-03-30 11:31 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-11-14 11:39 - 2013-03-30 11:31 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-11-14 11:39 - 2013-03-30 11:31 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-11-13 23:10 - 2013-10-16 22:08 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-11-13 23:10 - 2013-05-11 20:41 - 00001931 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-13 00:41 - 2013-08-15 10:50 - 00000000 ____D C:\windows\system32\MRT
2013-11-13 00:39 - 2011-10-13 23:56 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-11-11 05:50 - 2011-08-18 11:47 - 00267936 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-11-07 15:22 - 2012-01-29 01:18 - 00000000 ____D C:\Users\Werner\Desktop\Gisa Philh Chor

Some content of TEMP:
====================
C:\Users\Werner\AppData\Local\Temp\avgnt.exe
C:\Users\Werner\AppData\Local\Temp\CWPCUNLR.dll
C:\Users\Werner\AppData\Local\Temp\Extract.exe
C:\Users\Werner\AppData\Local\Temp\HPQSi.exe
C:\Users\Werner\AppData\Local\Temp\install_flashplayer11x32au_ltr5x64d_awc_aih(1).exe
C:\Users\Werner\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Werner\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Werner\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Werner\AppData\Local\Temp\MSNEBE6.exe
C:\Users\Werner\AppData\Local\Temp\Resource.exe
C:\Users\Werner\AppData\Local\Temp\SP49415.exe
C:\Users\Werner\AppData\Local\Temp\SP50370.exe
C:\Users\Werner\AppData\Local\Temp\SP51129.exe
C:\Users\Werner\AppData\Local\Temp\SP51626.exe
C:\Users\Werner\AppData\Local\Temp\SP51765.exe
C:\Users\Werner\AppData\Local\Temp\SP51810.exe
C:\Users\Werner\AppData\Local\Temp\SP52407.exe
C:\Users\Werner\AppData\Local\Temp\sp54373.exe
C:\Users\Werner\AppData\Local\Temp\sp54620.exe
C:\Users\Werner\AppData\Local\Temp\uninstall.exe
C:\Users\Werner\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Werner\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\Werner\AppData\Local\Temp\vcredist_x64.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-30 00:45

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-12-2013
Ran by Werner at 2013-12-02 11:11:38
Running from C:\Users\Werner\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe Flash Player 10 ActiveX (x32 Version: 10.0.32.18)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8)
Avira Free Antivirus (x32 Version: 14.0.1.749)
Biet-O-Matic v2.14.12 (x32 Version: 2.14.12)
Biet-O-Matic v2.14.8 (x32 Version: Biet-O-Matic v2.14.8)
CDBurnerXP (x32 Version: 4.4.0.3018)
CD-LabelPrint (x32)
combit address manager 2005 (x32)
dm-Fotowelt (x32)
Dropbox (HKCU Version: 2.4.2)
Energy Star Digital Logo (x32 Version: 1.0.1)
FOTOParadies (x32 Version: 3.1.10.105)
GIMP 2.6.11 (x32 Version: 2.6.11)
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000)
HP Customer Experience Enhancements (x32 Version: 6.0.1.4)
HP Documentation (x32 Version: 1.5.1.0)
HP ESU for Microsoft Windows 7 (x32 Version: 1.1.8.1)
HP HotKey Support (Version: 4.0.3.1)
HP Setup (x32 Version: 1.2.3557.3169)
HP Software Framework (x32 Version: 4.0.51.1)
HP Software Setup (x32 Version: 7.0.1.6)
HP Support Assistant (x32 Version: 6.1.12.1)
HP Web Camera (Version: 1.0.0)
HP Webcam (x32 Version: 1.0.25.0)
HP Webcam Driver (x32 Version: 6.1.7600.0049)
HP Wireless Assistant (x32 Version: 3.50.10.1)
IDT Audio (x32 Version: 1.0.6300.0)
ImgBurn (x32 Version: 2.5.8.0)
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2057)
Intel® Matrix Storage Manager
IrfanView (remove only) (x32 Version: 4.32)
Java 7 Update 7 (64-bit) (Version: 7.0.70)
Java Auto Updater (x32 Version: 2.0.6.1)
Java(TM) 6 Update 29 (x32 Version: 6.0.290)
LightScribe System Software (x32 Version: 1.18.22.2)
LSI HDA Modem (Version: 2.2.98)
McAfee Security Scan Plus (Version: 3.8.130.10)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 25.0.1 (x86 de) (x32 Version: 25.0.1)
Mozilla Maintenance Service (x32 Version: 24.1.1)
Mozilla Thunderbird 24.1.1 (x86 de) (x32 Version: 24.1.1)
MyTomTom 3.2.0.1116 (x32 Version: 3.2.0.1116)
OpenOffice.org 3.3 (x32 Version: 3.3.9567)
PDFCreator (x32 Version: 1.2.2)
Ralink Motorola BC4 Bluetooth 3.0+HS Adapter (Version: 3.0.41.262)
Ralink RT3090 802.11b/g/n WiFi Adapter (x32 Version: 1.2.0.27)
Realtek Ethernet Controller All-In-One Windows Driver (x32 Version: 1.12.0011)
Roxio Activation Module (x32 Version: 1.0)
Roxio Creator Audio (x32 Version: 3.8.0)
Roxio Creator Business (x32 Version: 10.3.56.21)
Roxio Creator Business v10 (x32 Version: 3.8.0)
Roxio Creator Copy (x32 Version: 3.8.0)
Roxio Creator Data (x32 Version: 3.8.0)
Roxio Creator Tools (x32 Version: 3.8.0)
Roxio Express Labeler 3 (x32 Version: 3.2.2)
Skype™ 5.10 (x32 Version: 5.10.116)
Synaptics Pointing Device Driver (Version: 15.0.24.0)
Synkron 1.6.2 (x32 Version: 1.6.2)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Visual Studio C++ 10.0 Runtime (x32 Version: 10.0.0)
VLC media player 2.0.3 (x32 Version: 2.0.3)
Windows 7 Default Setting (x32 Version: 1.0.1.6)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
WinZip 14.5 (x32 Version: 14.5.9095)
Yahoo! Detect (x32)

==================== Restore Points  =========================

12-11-2013 23:37:44 Windows Update
19-11-2013 18:30:59 Windows Update
22-11-2013 22:48:30 Windows Update
26-11-2013 01:40:01 Windows Update
26-11-2013 07:54:54 Windows Update
27-11-2013 00:26:10 Windows Update
28-11-2013 00:00:52 Windows Update
28-11-2013 22:25:38 Windows Update
28-11-2013 23:16:24 Windows Update
30-11-2013 00:26:15 Windows Update
01-12-2013 00:14:48 Windows Update
01-12-2013 23:50:34 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0843F827-8B55-48B9-9D4A-953DCA13EB52} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-09] (Hewlett-Packard Company)
Task: {3D570A93-5B79-4771-AF8B-5FD533DAF02A} - System32\Tasks\HPCeeScheduleForWerner => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {67C56595-C1A8-45FC-AB89-4B17A69B4063} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-12-15] (Hewlett-Packard)
Task: {7C9C18A8-F7C5-44BF-8CAF-FC1AB2269057} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)
Task: {AFFFAD6C-44F7-4627-8A8D-0A6A4987890A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-25] (Adobe Systems Incorporated)
Task: {D31D671C-0585-4322-8244-8FBBB2EC1819} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-09-09] (Hewlett-Packard Company)
Task: {FA218E43-AEC6-45C6-881E-4C1AB4A9A27C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-09] (Hewlett-Packard Company)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\HPCeeScheduleForWerner.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2013-02-24 22:06 - 2013-02-24 22:00 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-05-23 12:53 - 2013-05-23 12:53 - 00026040 _____ () C:\Program Files (x86)\MyTomTom 3\DeviceDetection.dll
2013-05-23 12:53 - 2013-05-23 12:53 - 00074680 _____ () C:\Program Files (x86)\MyTomTom 3\TomTomSupporterBase.dll
2013-05-23 12:53 - 2013-05-23 12:53 - 00279480 _____ () C:\Program Files (x86)\MyTomTom 3\TomTomSupporterProxy.dll
2013-03-13 21:48 - 2013-03-13 21:48 - 24978944 _____ () C:\Users\Werner\AppData\Roaming\Dropbox\bin\libcef.dll
2011-09-03 21:15 - 2001-01-12 17:27 - 00163840 _____ () C:\Program Files (x86)\combit\amw\CM32T1.dll
2013-11-15 21:59 - 2013-11-15 22:00 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-02-24 22:06 - 2013-02-24 22:00 - 00397704 _____ () C:\program files (x86)\avira\antivir desktop\sqlite3.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Werner\Desktop\Kanon.jpg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Werner\Desktop\Kanon.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/12/2013 08:51:27 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xd48
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (11/11/2013 07:17:50 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xe10
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (11/10/2013 11:13:07 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xe2c
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (11/08/2013 10:32:24 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xd84
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (11/06/2013 06:55:27 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xe30
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (11/02/2013 01:38:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xd18
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (10/30/2013 09:37:40 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xe00
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (10/26/2013 10:32:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xda4
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (10/24/2013 06:02:39 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xdf0
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (10/18/2013 08:22:37 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xd58
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3


System errors:
=============
Error: (12/02/2013 10:37:20 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (12/02/2013 10:37:20 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (12/02/2013 10:37:20 AM) (Source: DCOM) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (12/02/2013 00:52:35 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme

Error: (12/01/2013 04:34:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (12/01/2013 04:34:07 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (12/01/2013 04:34:07 PM) (Source: DCOM) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (12/01/2013 01:17:49 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Zeitgeber" wurde mit folgendem Fehler beendet: 
%%1115

Error: (12/01/2013 01:17:17 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme

Error: (11/30/2013 01:28:43 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme


Microsoft Office Sessions:
=========================
Error: (11/12/2013 08:51:27 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487d4801cedfe0891e81b7C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exed0fe5223-4bd3-11e3-b63a-1cc1deb051dc

Error: (11/11/2013 07:17:50 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487e1001cedf0a4b004681C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe92b07b69-4afd-11e3-89b2-1cc1deb051dc

Error: (11/10/2013 11:13:07 AM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487e2c01ceddfd69904a4dC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeb1003a0d-49f0-11e3-990e-1cc1deb051dc

Error: (11/08/2013 10:32:24 AM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487d8401cedc65643fe7d2C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeac05891c-4858-11e3-9b9b-1cc1deb051dc

Error: (11/06/2013 06:55:27 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487e3001cedb193a46228bC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe9dc60b46-470c-11e3-8b4a-1cc1deb051dc

Error: (11/02/2013 01:38:10 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487d1801ced7c857e90d2fC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exea0d83a7b-43bb-11e3-8a36-1cc1deb051dc

Error: (10/30/2013 09:37:40 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487e0001ced5afd72eedc8C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe1e897126-41a3-11e3-a2ac-1cc1deb051dc

Error: (10/26/2013 10:32:07 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487da401ced292c4556982C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe0fd3313a-3e86-11e3-9cf9-1cc1deb051dc

Error: (10/24/2013 06:02:39 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487df001ced0dace909e3fC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe166babec-3cce-11e3-8a71-1cc1deb051dc

Error: (10/18/2013 08:22:37 AM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487d5801cecbd2c373da91C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe0fdd4a83-37c6-11e3-936a-1cc1deb051dc


==================== Memory info =========================== 

Percentage of memory in use: 64%
Total physical RAM: 1976.27 MB
Available physical RAM: 702.3 MB
Total Pagefile: 3952.53 MB
Available Pagefile: 2207.95 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:280.79 GB) (Free:87.28 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: () (Removable) (Total:0.95 GB) (Free:0.42 GB) FAT
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.98 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 8F1389CE)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=281 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)

========================================================
Disk: 1 (Size: 972 MB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=972 MB) - (Type=06)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-02 11:46:57
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB3O 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Werner\AppData\Local\Temp\uxtiapod.sys


---- User code sections - GMER 2.1 ----

.text  C:\Users\Werner\AppData\Roaming\Dropbox\bin\Dropbox.exe[1148] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 69     00000000764d1465 2 bytes [4D, 76]
.text  C:\Users\Werner\AppData\Roaming\Dropbox\bin\Dropbox.exe[1148] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 155    00000000764d14bb 2 bytes [4D, 76]
.text  ...                                                                                                                       * 2
.text  C:\program files (x86)\avira\antivir desktop\avcenter.exe[3056] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000764d1465 2 bytes [4D, 76]
.text  C:\program files (x86)\avira\antivir desktop\avcenter.exe[3056] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000764d14bb 2 bytes [4D, 76]
.text  ...                                                                                                                       * 2

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\70f395d953dd                                               
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\70f395d953dd (not active ControlSet)                           

---- EOF - GMER 2.1 ----
         

Exportierte Ereignisse:

26.11.2013 02:39 [System-Scanner] Malware gefunden
      Die Datei 
      'C:\Users\Werner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\1f45f824-7412
      207f'
      enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2012-1723.A.Gen' 
      [exploit].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '435f70e7.qua' 
      verschoben!

26.11.2013 02:39 [System-Scanner] Malware gefunden
      Die Datei 
      'C:\Users\Werner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\76a24849-2eed6
      14c'
      enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2012-1713.A' 
      [exploit].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5bfb5890.qua' 
      verschoben!

26.11.2013 02:39 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Werner\AppData\Local\Temp\A5D3.tmp'
      enthielt einen Virus oder unerwünschtes Programm 'TR/FakeAV.jgmnb' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '11102dde.qua' 
      verschoben!

26.11.2013 02:39 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Werner\AppData\Local\Temp\9A5D.tmp'
      enthielt einen Virus oder unerwünschtes Programm 'TR/FakeAV.jgmnb' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '773865e8.qua' 
      verschoben!