TR/Crypt.EPACK.Gen2 und PUP.Optional.Conduit.A

In der Datei 'C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
         

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.24.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16750
Sandra :: FELIX [Administrator]

24.12.2013 19:10:04
MBAM-log-2013-12-24 (19-29-29).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 219025
Laufzeit: 9 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 3
C:\Users\Sandra\AppData\Local\temp\ct3288691 (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Sandra\AppData\Local\temp\ct3297265 (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Sandra\AppData\Local\temp\ct3297861 (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

Infizierte Dateien: 5
C:\Users\Sandra\AppData\Local\temp\ct3288691\chromeid.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Sandra\AppData\Local\temp\ct3288691\setup.ini.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Sandra\AppData\Local\temp\ct3297265\ism.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Sandra\AppData\Local\temp\ct3297861\chromeid.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.
C:\Users\Sandra\AppData\Local\temp\ct3297861\setup.ini.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt.

(Ende)
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-12-2013 01
Ran by Sandra (administrator) on FELIX on 25-12-2013 12:12:34
Running from C:\Users\Sandra\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPNetworkCommunicatorCom.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPNetworkCommunicator.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\hpwuschd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [WinPatrol] - C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe [325728 2012-01-02] (BillP Studios)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [DivXMediaServer] - C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-09-11] (DivX, LLC)
HKLM\...\Run: [DivXUpdate] - C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [HP Deskjet 3050A J611 series (NET)] - C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe [1837672 2012-10-17] (Hewlett-Packard Co.)
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3050A J611 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3050A J611 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x78E514A67229CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} -  No File
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: haufereader - No CLSID Value - 
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{FEF4C783-059C-49CC-8096-53B22351814E}: [NameServer]192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\o0d1ugwq.default
FF user.js: detected! => C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\o0d1ugwq.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: 20-20 3D Viewer - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\o0d1ugwq.default\Extensions\2020Player@2020Technologies.com
FF Extension: Conduit Engine  - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\o0d1ugwq.default\Extensions\engine@conduit.com
FF Extension: FireShot - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\o0d1ugwq.default\Extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
FF Extension: Firebug - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\o0d1ugwq.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\o0d1ugwq.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}

========================== Services (Whitelisted) =================

S4 AdobeActiveFileMonitor6.0; C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [124832 2007-09-10] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [462632 2010-02-18] (Nero AG)
S4 o2flash; C:\Program Files\O2Micro Oz128 Driver\o2flash.exe [65536 2007-02-12] (O2Micro International)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [994360 2011-10-14] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [399416 2011-10-14] (Secunia)
S2 AcrSch2Svc; "C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe" [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-01-08] ()
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf.sys [15544 2010-09-01] (Secunia)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1761280 2009-09-10] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 catchme; \??\C:\Users\Sandra\AppData\Local\Temp\catchme.sys [x]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-25 12:11 - 2013-12-25 12:12 - 00022020 _____ C:\Users\Sandra\Desktop\Addition.txt
2013-12-25 12:11 - 2013-12-25 12:11 - 00000202 _____ C:\Users\Sandra\Desktop\antivir.txt
2013-12-25 12:10 - 2013-12-25 12:12 - 00009945 _____ C:\Users\Sandra\Desktop\FRST.txt
2013-12-25 12:10 - 2013-12-25 12:10 - 01061545 _____ (Farbar) C:\Users\Sandra\Desktop\FRST.exe
2013-12-25 12:10 - 2013-12-25 12:10 - 00000000 ____D C:\FRST
2013-12-25 12:08 - 2013-12-25 12:08 - 00000000 _____ C:\Users\Sandra\defogger_reenable
2013-12-24 19:09 - 2013-12-24 19:09 - 00001077 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-20 20:32 - 2013-12-20 20:32 - 00010339 _____ C:\Users\Sandra\Desktop\Geld.xlsx
2013-12-19 21:54 - 2013-12-19 21:54 - 00000028 _____ C:\Users\Sandra\Desktop\Merck.txt
2013-12-13 10:52 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-13 10:52 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-13 10:51 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-13 10:51 - 2013-10-25 05:45 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-13 10:51 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-13 10:51 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-13 10:51 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-13 10:51 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-13 10:51 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-13 10:51 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-13 10:51 - 2013-10-25 05:43 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-13 10:51 - 2013-10-25 05:43 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-13 10:51 - 2013-10-25 05:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-13 10:51 - 2013-10-25 05:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-13 10:51 - 2013-10-25 05:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-13 10:51 - 2013-10-25 04:41 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-13 10:51 - 2013-10-25 03:49 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-13 10:50 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-12 16:44 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 16:44 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-12 16:44 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 16:44 - 2013-10-30 02:27 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 16:44 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 16:44 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 16:44 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 16:44 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-12 16:44 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 16:44 - 2013-10-04 02:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-12 16:44 - 2013-10-04 02:17 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-11-27 10:52 - 2013-12-24 16:52 - 00081874 _____ C:\Windows\IE11_main.log
2013-11-25 15:48 - 2013-11-25 15:48 - 00000007 _____ C:\Users\Sandra\Desktop\Auto.txt

==================== One Month Modified Files and Folders =======

2013-12-25 12:12 - 2013-12-25 12:11 - 00022020 _____ C:\Users\Sandra\Desktop\Addition.txt
2013-12-25 12:12 - 2013-12-25 12:10 - 00009945 _____ C:\Users\Sandra\Desktop\FRST.txt
2013-12-25 12:11 - 2013-12-25 12:11 - 00000202 _____ C:\Users\Sandra\Desktop\antivir.txt
2013-12-25 12:10 - 2013-12-25 12:10 - 01061545 _____ (Farbar) C:\Users\Sandra\Desktop\FRST.exe
2013-12-25 12:10 - 2013-12-25 12:10 - 00000000 ____D C:\FRST
2013-12-25 12:08 - 2013-12-25 12:08 - 00000000 _____ C:\Users\Sandra\defogger_reenable
2013-12-25 12:08 - 2010-02-20 20:59 - 00000000 ____D C:\Program Files\Opera
2013-12-25 12:08 - 2010-02-20 20:53 - 00000000 ____D C:\Users\Sandra
2013-12-25 12:03 - 2010-02-20 20:41 - 01284822 _____ C:\Windows\WindowsUpdate.log
2013-12-25 12:01 - 2012-04-02 20:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-24 19:13 - 2009-07-14 05:34 - 00013472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-24 19:13 - 2009-07-14 05:34 - 00013472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-24 19:09 - 2013-12-24 19:09 - 00001077 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-24 19:09 - 2013-04-09 19:17 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-24 19:05 - 2012-05-04 20:01 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-24 19:05 - 2010-02-20 21:28 - 00203406 _____ C:\Windows\PFRO.log
2013-12-24 19:05 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-24 19:05 - 2009-07-14 05:39 - 00060301 _____ C:\Windows\setupact.log
2013-12-24 16:52 - 2013-11-27 10:52 - 00081874 _____ C:\Windows\IE11_main.log
2013-12-24 16:49 - 2012-12-01 00:59 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-20 20:32 - 2013-12-20 20:32 - 00010339 _____ C:\Users\Sandra\Desktop\Geld.xlsx
2013-12-19 21:54 - 2013-12-19 21:54 - 00000028 _____ C:\Users\Sandra\Desktop\Merck.txt
2013-12-18 10:23 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-12-18 10:18 - 2013-05-10 17:00 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-18 10:18 - 2012-12-19 18:15 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-18 10:18 - 2012-12-19 18:15 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-13 11:28 - 2010-02-20 20:56 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-13 11:23 - 2012-04-02 20:51 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-13 11:23 - 2011-05-14 15:51 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-12-13 11:20 - 2009-07-14 05:33 - 00341104 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-13 11:18 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-12-13 11:01 - 2010-02-21 16:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-13 10:55 - 2013-08-18 18:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-13 10:53 - 2010-02-21 15:46 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-25 15:48 - 2013-11-25 15:48 - 00000007 _____ C:\Users\Sandra\Desktop\Auto.txt
2013-11-25 14:14 - 2012-12-19 18:15 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

Some content of TEMP:
====================
C:\Users\Sandra\AppData\Local\temp\avgnt.exe
C:\Users\Sandra\AppData\Local\temp\DivXSetup.exe
C:\Users\Sandra\AppData\Local\temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Sandra\AppData\Local\temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Sandra\AppData\Local\temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Sandra\AppData\Local\temp\ugjzz3yz.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-24 20:54

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-12-2013 01
Ran by Sandra at 2013-12-25 12:12:58
Running from C:\Users\Sandra\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer (Version: 7.1.8)
7-Zip 9.20
Adobe Flash Player 11 ActiveX (Version: 11.8.800.168)
Adobe Flash Player 11 Plugin (Version: 11.9.900.170)
Adobe Photoshop Elements 6.0 (Version: 6.0)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Amazon Kindle
Amazon MP3-Downloader 1.0.17 (Version: 1.0.17)
Avira Free Antivirus (Version: 14.0.2.286)
DDBAC (Version: 4.3.31)
Designer 2.0 (Version: 7.9.3)
DivX Converter (Version: 7.1.0)
DivX Plus DirectShow Filters
DivX-Setup (Version: 2.6.1.87)
ElsterFormular 11.0.0 (Version: 11.0.0.***unknown variable buildnummer***)
FileZilla Client 3.7.3 (Version: 3.7.3)
Free YouTube to MP3 Converter version 3.10.17.221 (Version: 3.10.17.221)
FreeMind (Version: 0.9.0)
Haufe iDesk-Browser (Version: 10.10.14.0000)
Haufe iDesk-Service (Version: 10.10.25.7810)
Hewlett-Packard ACLM.NET v1.1.0.0 (Version: 1.00.0000)
High-Definition Video Playback 10 (Version: 7.0.11000.25.1)
HP Deskjet 3050A J611 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0)
HP Deskjet 3050A J611 series Hilfe (Version: 140.0.2.2)
HP Product Detection (Version: 11.14.0001)
HP Update (Version: 5.005.000.001)
HPDiagnosticAlert (Version: 1.00.0000)
ImgBurn (Version: 2.5.7.0)
Java 7 Update 45 (Version: 7.0.450)
Java Auto Updater (Version: 2.1.9.8)
Junk Mail filter update (Version: 14.0.8089.726)
Lexware buchhalter 2011 (Version: 16.30.00.0179)
Lexware Elster (Version: 9.10.00.0041)
Lexware Info Service (Version: 2.90.00.0009)
Lexware online banking (Version: 6.00.00.0087)
LG Intelligent Update (Version: 3.02.0717.01)
LG Smart Cam (Version: 1.0007.0818.01)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Visio 2007 Service Pack 3 (SP3)
Microsoft Office Visio MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Visio Professional 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Primary Interoperability Assemblies 2005 (Version: 8.0.50727.42)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft WSE 3.0 Runtime (Version: 3.0.5305.0)
Mozilla Firefox 26.0 (x86 de) (Version: 26.0)
Mozilla Maintenance Service (Version: 26.0)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Nero 10 ClipartPack (Version: 10.0.10300.0.0)
Nero 10 Menu TemplatePack 1 (Version: 10.0.10300.0.0)
Nero 10 Menu TemplatePack 2 (Version: 10.0.10300.0.0)
Nero 10 Menu TemplatePack 3 (Version: 10.0.10300.0.0)
Nero 10 Menu TemplatePack Basic (Version: 10.0.10300.0.0)
Nero 10 Movie ThemePack 1 (Version: 10.0.10300.1.0)
Nero 10 Movie ThemePack 2 (Version: 10.0.10300.1.0)
Nero 10 Movie ThemePack Basic (Version: 10.0.10300.1.0)
Nero 10 Sample ImagePack (Version: 10.0.10300.0.0)
Nero 10 Sample Videos (Version: 10.0.10300.2.0)
Nero BackItUp 10 (Version: 5.4.11100.14.101)
Nero BackItUp 10 Help (CHM) (Version: 1.0.10500)
Nero Burning ROM 10 (Version: 10.0.10700.7.100)
Nero BurningROM 10 Help (CHM) (Version: 1.0.10500)
Nero BurnRights 10 (Version: 4.0.10600.9.100)
Nero BurnRights 10 Help (CHM) (Version: 1.0.10500)
Nero Control Center 10 (Version: 10.0.11500.1.0)
Nero Core Components 10 (Version: 2.0.13100.0.1)
Nero CoverDesigner 10 (Version: 5.0.10500.7.100)
Nero CoverDesigner 10 Help (CHM) (Version: 1.0.10500)
Nero DiscCopy Gadget 10 (Version: 3.0.10400.6.100)
Nero DiscCopyGadget 10 Help (CHM) (Version: 1.0.10500)
Nero DiscSpeed 10 (Version: 6.0.10400.4.100)
Nero DiscSpeed 10 Help (CHM) (Version: 1.0.10500)
Nero Dolby Files 10 (Version: 2.0.11000.0.10)
Nero Express 10 (Version: 10.0.10500.7.100)
Nero Express 10 Help (CHM) (Version: 1.0.10500)
Nero InfoTool 10 (Version: 7.0.10400.5.100)
Nero InfoTool 10 Help (CHM) (Version: 1.0.10500)
Nero MediaHub 10 (Version: 1.0.11000.6.100)
Nero MediaHub 10 Help (CHM) (Version: 1.0.10500)
Nero Multimedia Suite 10 (Version: 10.0.11200)
Nero Recode 10 (Version: 4.6.10600.1.100)
Nero Recode 10 Help (CHM) (Version: 1.0.10500)
Nero RescueAgent 10 (Version: 3.0.10500.5.100)
Nero RescueAgent 10 Help (CHM) (Version: 1.0.10500)
Nero SoundTrax 10 (Version: 4.6.10500.1.100)
Nero SoundTrax 10 Help (CHM) (Version: 1.0.10500)
Nero StartSmart 10 (Version: 10.0.10500.4.100)
Nero StartSmart 10 Help (CHM) (Version: 1.0.10500)
Nero Update (Version: 1.0.0012)
Nero Vision 10 (Version: 7.0.10700.4.100)
Nero Vision 10 Help (CHM) (Version: 1.0.10500)
Nero WaveEditor 10 (Version: 5.6.10500.1.100)
Nero WaveEditor 10 Help (CHM) (Version: 1.0.10500)
NVIDIA Display Control Panel (Version: 6.14.12.5896)
NVIDIA Drivers (Version: 1.10.62.40)
Nvu 1.0 (Version: 1.0)
O2Micro Flash Memory Card Reader Driver Installer(x86) (Version: 3.09)
Opera 12.16 (Version: 12.16.1860)
PDFCreator (Version: 0.9.5)
Quicken 2009 - ServicePack 3 (Version: 16.08.1028)
Quicken 2009 (Version: 16.00.00.0182)
Quicken Import Export Server 2009 (Version: 16.0.1.1)
QuickSteuer 2012 (Version: 18.09.00.0003)
QuickSteuer 2013 (Version: 19.06.00.0003)
QuickSteuer Deluxe 2010 (Version: 16.14.00.0002)
QuickSteuer Deluxe 2011 (Version: 17.08.00.0005)
QuickSteuer DELUXE Wissens-Center 2010 (Version: 16.0.2.0)
QuickSteuer DELUXE Wissens-Center 2011 (Version: 17.10.0.0)
Realtek High Definition Audio Driver (Version: 6.0.1.6043)
RENESIS® Player Browser Plugins (Version: 1.1.1)
SAMSUNG Mobile Composite Device Software
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Drive Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung New PC Studio (Version: 1.00.0000)
Secunia PSI (2.0.0.4003) (Version: 2.0.0.4003)
Servicepack Datumsaktualisierung (Version: 1.00.00.0005)
Synaptics Pointing Device Driver (Version: 9.1.11.0)
System Requirements Lab
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)
VLC media player 2.1.0 (Version: 2.1.0)
Wertpapieranalyse 2009 (Version: 1.00.0004)
Windows 7 USB/DVD Download Tool (Version: 1.0.30)
Windows Live Anmelde-Assistent (Version: 5.000.818.5)
Windows Live Communications Platform (Version: 14.0.8098.930)
Windows Live Essentials (Version: 14.0.8089.0726)
Windows Live Essentials (Version: 14.0.8089.726)
Windows Live Fotogalerie (Version: 14.0.8081.709)
Windows Live Mail (Version: 14.0.8089.0726)
Windows Live Movie Maker (Version: 14.0.8091.0730)
Windows Live Sync (Version: 14.0.8089.726)
Windows Live-Uploadtool (Version: 14.0.8014.1029)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
WinPatrol (Version: 24.0.2012.1)
Xvid 1.2.2 final uninstall (Version: 1.2)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 03:04 - 2012-01-22 23:07 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0280DDDA-27D1-4421-902B-CC6C2283B113} - System32\Tasks\{040EE5C3-4FD7-48D5-AC9B-ECE810DC0630} => C:\Program Files\Acronis\TrueImageHome\TrueImage.exe
Task: {3AAEB8DF-91B5-474D-91AF-5BA6890AAF09} - System32\Tasks\{B28E5086-3D54-4CCF-A3D8-381BDA00FAD5} => C:\Program Files\Acronis\TrueImageHome\TrueImage.exe
Task: {4EE565A9-15DA-493E-BDB6-61F848936E82} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {56BA0B38-143A-4E81-80D5-8FA47BB70B78} - System32\Tasks\Update Manager => C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [2011-07-31] (Haufe-Lexware GmbH & Co. KG)
Task: {5786039D-E2D9-4BF6-B13D-9FCF11C4746C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-13] (Adobe Systems Incorporated)
Task: {B1C8BAB5-2B72-430D-B132-C400E63A0522} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {DF150315-BD2F-4034-973C-E819C9F50B46} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files\TuneUp Utilities 2010\OneClick.exe
Task: {EAFF8C23-6E17-4198-A160-E7281901C52A} - System32\Tasks\Laufwerk D Sandra => C:\Program Files\Nero\Nero 10\Nero BackItUp\NBCore.exe [2010-02-22] (Nero AG)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-12-19 18:15 - 2012-09-19 18:17 - 00397088 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2013-08-07 20:25 - 2013-08-07 20:25 - 00093696 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2012-01-26 22:15 - 2012-01-08 20:50 - 00573100 ____N () C:\Program Files\BillP Studios\WinPatrol\sqlite3.dll
2013-08-29 01:25 - 2013-08-29 01:25 - 00100688 _____ () C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/24/2013 08:56:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (12/17/2013 10:08:01 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (12/13/2013 10:46:43 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: PSIA.exe, Version: 2.0.0.4003, Zeitstempel: 0x4e954f51
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0013baac
ID des fehlerhaften Prozesses: 0x1d0
Startzeit der fehlerhaften Anwendung: 0xPSIA.exe0
Pfad der fehlerhaften Anwendung: PSIA.exe1
Pfad des fehlerhaften Moduls: PSIA.exe2
Berichtskennung: PSIA.exe3

Error: (12/06/2013 06:14:27 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (12/06/2013 05:28:16 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (12/03/2013 05:56:29 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (12/02/2013 08:52:08 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/28/2013 09:36:32 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/25/2013 02:57:08 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/20/2013 01:16:34 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (12/24/2013 09:09:00 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (12/24/2013 07:05:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Acronis Scheduler2 Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (12/24/2013 07:05:16 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎24.‎12.‎2013 um 18:55:38 unerwartet heruntergefahren.

Error: (12/24/2013 04:56:16 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7

Error: (12/21/2013 02:16:50 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7

Error: (12/20/2013 07:05:08 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7

Error: (12/19/2013 04:30:51 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7

Error: (12/18/2013 10:21:34 AM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (12/18/2013 10:21:34 AM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (12/18/2013 10:21:33 AM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5


Microsoft Office Sessions:
=========================
Error: (01/06/2013 06:03:02 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5696 seconds with 3720 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 48%
Total physical RAM: 2047.3 MB
Available physical RAM: 1045.51 MB
Total Pagefile: 4094.61 MB
Available Pagefile: 2716.14 MB
Total Virtual: 2047.88 MB
Available Virtual: 1886.35 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:49.27 GB) (Free:6.36 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Sandra) (Fixed) (Total:96.74 GB) (Free:26.38 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: F24965A4)
Partition 1: (Not Active) - (Size=1 GB) - (Type=27)
Partition 2: (Active) - (Size=49 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=97 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=05)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-25 12:37:19
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9160821AS rev.3.ALC 149,05GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Sandra\AppData\Local\Temp\ugddypod.sys


---- System - GMER 2.1 ----

SSDT            8F453726                                                                                         ZwCreateSection
SSDT            8F453730                                                                                         ZwRequestWaitReplyPort
SSDT            8F45372B                                                                                         ZwSetContextThread
SSDT            8F453735                                                                                         ZwSetSecurityObject
SSDT            8F45373A                                                                                         ZwSystemDebugControl
SSDT            8F4536C7                                                                                         ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                         82E87A15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                           82EC1212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                              82EC858C 4 Bytes  [26, 37, 45, 8F]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                              82EC88E8 4 Bytes  [30, 37, 45, 8F]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                              82EC892C 4 Bytes  [2B, 37, 45, 8F]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                              82EC89A8 4 Bytes  [35, 37, 45, 8F]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                              82EC89FC 4 Bytes  [3A, 37, 45, 8F]
.text           ...                                                                                              

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys
AttachedDevice  \FileSystem\fastfat \Fat                                                                         fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000df04649a3                      
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000df04649a3@0024914d087e         0xA8 0xFD 0x97 0xB7 ...
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000df04649a3@b0ec71d09bc0         0xCD 0x0A 0xDD 0x19 ...
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000df04649a3@e4b0212e739b         0x4E 0x99 0xBF 0x1A ...
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000df04649a3@845181a340c4         0xA8 0xC2 0xA1 0xF5 ...
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000df04649a3 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000df04649a3@0024914d087e             0xA8 0xFD 0x97 0xB7 ...
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000df04649a3@b0ec71d09bc0             0xCD 0x0A 0xDD 0x19 ...
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000df04649a3@e4b0212e739b             0x4E 0x99 0xBF 0x1A ...
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000df04649a3@845181a340c4             0xA8 0xC2 0xA1 0xF5 ...

---- EOF - GMER 2.1 ----