Ursachensuche: Rechner wird langsam(er)

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-01-2014
Ran by Frau Blume at 2014-01-09 22:20:19
Running from C:\Users\Frau Blume\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe AIR (x32 Version: 3.5.0.1060 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.5.0.1060 - Adobe Systems Incorporated) Hidden
Adobe Digital Editions (x32 Version:  - )
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
Audacity 2.0.3 (x32 Version: 2.0.3 - Audacity Team)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
CANON iMAGE GATEWAY MyCamera Download Plugin (x32 Version: 3.1.0.1 - Canon Inc.)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (x32 Version: 1.8.0.1 - Canon Inc.)
Canon Internet Library for ZoomBrowser EX (x32 Version: 1.7.0.1 - Canon Inc.)
Canon MOV Decoder (x32 Version: 1.7.0.6 - Canon Inc.)
Canon MOV Encoder (x32 Version: 1.5.0.3 - Canon Inc.)
Canon MovieEdit Task for ZoomBrowser EX (x32 Version: 3.6.0.5 - Canon Inc.)
Canon Utilities CameraWindow DC 8 (x32 Version: 8.3.0.6 - Canon Inc.)
Canon Utilities CameraWindow Launcher (x32 Version: 7.5.0.2 - Canon Inc.)
Canon Utilities Digital Photo Professional 3.9 (x32 Version: 3.9.1.0 - Canon Inc.)
Canon Utilities Movie Uploader for YouTube (x32 Version: 1.1.0.4 - Canon Inc.)
Canon Utilities MyCamera (x32 Version: 7.4.0.2 - Canon Inc.)
Canon Utilities PhotoStitch (x32 Version: 3.1.22.46 - Canon Inc.)
Canon Utilities ZoomBrowser EX (x32 Version: 6.6.0.23 - Canon Inc.)
Canon ZoomBrowser EX Memory Card Utility (x32 Version: 1.4.0.4 - Canon Inc.)
ChatZum Toolbar (x32 Version: 1.0.20 - ChatZum)
Cisco AnyConnect Secure Mobility Client  (x32 Version: 3.1.01065 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.01065 - Cisco Systems, Inc.) Hidden
Cisco Systems VPN Client 5.0.07.0440 (Version: 5.0.7 - Cisco Systems, Inc.)
Citavi (x32 Version: 3.3.0.0 - Swiss Academic Software)
Cold Turkey version 0.8 (Version: 0.8 - Felix Belzile)
Conexant HD Audio (Version: 4.130.0.62 - Conexant)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version:  - Microsoft)
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
Energy Management (x32 Version: 5.4.0.8 - Lenovo)
f4 2012 (x32 Version:  - audiotranskription.de)
f4 3.0.3 (x32 Version: 3.0.3 - MAXqda)
F-pro 1.3 (x32 Version: 1.3 - MAXqda)
GIMP 2.8.4 (Version: 2.8.4 - The GIMP Team)
GPL Ghostscript (x32 Version: 9.07 - Artifex Software Inc.)
GSview 5.0 (x32 Version: 5.0 - Ghostgum Software Pty Ltd)
Intel(R) Turbo Boost Technology Driver (x32 Version: 01.02.00.1002 - Intel Corporation)
Java 7 Update 7 (x32 Version: 7.0.70 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
Lenovo EasyCamera (Version: 5.38.1.4 - Silicon Motion)
Lenovo EasyCamera (x32 Version: 5.38.1.4 - Silicon Motion)
Lenovo System Update (x32 Version: 5.00.0019 - Lenovo)
Lenovo_Wireless_Driver (x32 Version: 1.02.01 - Lenovo)
MAGIX FunPix Maker 1.0.0.0 (D) (x32 Version: 1.0.0.0 - MAGIX AG)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
MiKTeX 2.8 (x32 Version: 2.8 - MiKTeX.org)
Mindjet MindManager 2012 (x32 Version: 10.1.459 - Mindjet)
Mozilla Firefox 26.0 (x86 en-US) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
myphotobook.de (x32 Version: 1.5.0 - myphotobook GmbH) Hidden
myphotobook.de (x32 Version: 1.5.0.992 - myphotobook GmbH)
NVIDIA Drivers (Version: 1.10.57.35 - NVIDIA Corporation)
Paint.NET v3.5.10 (Version: 3.60.0 - dotPDN LLC)
PDF24 Creator 5.2.0 (x32 Version:  - PDF24.org)
PDF-XChange 3 (Version:  - Tracker Software)
ScanWizard 5 (x32 Version:  - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Skype™ 6.3 (x32 Version: 6.3.107 - Skype Technologies S.A.)
System Requirements Lab for Intel (x32 Version: 4.5.9.0 - Husdawg, LLC)
TeXnicCenter Version 2.0 Beta 1 (x32 Version: 2.0 Beta 1 - The TeXnicCenter Team)
Tinypic 3.18 (x32 Version: Tinypic 3.18 - E. Fiedler)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version:  - Microsoft)
VLC media player 2.0.4 (Version: 2.0.4 - VideoLAN)
Windows Driver Package - Broadcom Bluetooth  (06/15/2009 6.2.0.9000) (Version: 06/15/2009 6.2.0.9000 - Broadcom)
Windows Driver Package - Broadcom Bluetooth  (07/30/2009 6.2.0.9405) (Version: 07/30/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (10/19/2009 5.4.0.1) (Version: 10/19/2009 5.4.0.1 - Lenovo)
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0 - win.rar GmbH)
Yahoo! Detect (x32 Version:  - )

==================== Restore Points  =========================

14-11-2013 11:48:51 Windows Update
18-11-2013 02:01:08 Windows Update
06-12-2013 04:43:48 Windows Update
12-12-2013 04:53:40 Windows Update
26-12-2013 19:18:38 Installed Jitsi
26-12-2013 20:27:43 Removed Jitsi
07-01-2014 05:25:19 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 03:34 - 2013-05-10 11:25 - 00000854 ____R C:\Windows\system32\Drivers\etc\hosts


















==================== Scheduled Tasks (whitelisted) =============

Task: {1C2FCF60-FFB8-44EB-BC81-8E9C3366DBC3} - System32\Tasks\{3132CA05-CF67-4AA2-8193-A2B1D98C024C} => C:\Program Files\ColdTurkey\ColdTurkey.exe [2013-03-11] ()
Task: {348C33F2-8A00-455F-8C61-DAA294A9585B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {5A555899-683A-4D4E-BDCC-BF81EE23FDD8} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {DAFADF21-DE1F-45D8-8A6C-8F0534A9D60F} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2012-09-27] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-10-10 20:31 - 2009-07-15 14:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2012-10-10 20:30 - 2009-07-15 14:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Frau Blume\Downloads\Hi Anna.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/09/2014 07:19:36 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/09/2014 04:31:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/06/2014 07:36:58 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/05/2014 07:00:05 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "G:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (01/03/2014 02:09:21 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087, Zeitstempel: 0x52a0d273
Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087, Zeitstempel: 0x52a0d20a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0014e1a8
ID des fehlerhaften Prozesses: 0x1294
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3

Error: (01/02/2014 07:20:51 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/01/2014 08:40:06 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/31/2013 11:27:23 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/29/2013 07:37:38 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "G:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (12/26/2013 09:30:26 PM) (Source: Microsoft-Windows-RestartManager) (User: FrauBlume-PC)
Description: Die Anwendung oder der Dienst "SProtection" konnte nicht neu gestartet werden.


System errors:
=============
Error: (01/09/2014 07:17:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/09/2014 04:33:18 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004005

Error: (01/09/2014 04:30:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/06/2014 07:36:55 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/06/2014 07:36:55 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (01/06/2014 07:36:55 PM) (Source: DCOM) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (01/06/2014 07:35:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/02/2014 07:19:14 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/01/2014 08:39:25 AM) (Source: Service Control Manager) (User: )
Description: Dienst "KCTRP" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/01/2014 08:38:38 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (01/09/2014 07:19:36 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/09/2014 04:31:46 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/06/2014 07:36:58 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/05/2014 07:00:05 PM) (Source: Windows Backup)(User: )
Description: G:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (01/03/2014 02:09:21 AM) (Source: Application Error)(User: )
Description: firefox.exe26.0.0.508752a0d273xul.dll26.0.0.508752a0d20ac00000050014e1a8129401cf0819ce09b3d1C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dllad0a4042-7413-11e3-93ba-88ae1d26dbc9

Error: (01/02/2014 07:20:51 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/01/2014 08:40:06 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/31/2013 11:27:23 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/29/2013 07:37:38 PM) (Source: Windows Backup)(User: )
Description: G:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (12/26/2013 09:30:26 PM) (Source: Microsoft-Windows-RestartManager)(User: FrauBlume-PC)
Description: 0C:\Program Files (x86)\Common Files\Umbrella\umbrella.exeSProtection03026217818840


==================== Memory info =========================== 

Percentage of memory in use: 41%
Total physical RAM: 3958.85 MB
Available physical RAM: 2328.87 MB
Total Pagefile: 7915.88 MB
Available Pagefile: 5972.08 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:421.81 GB) (Free:338.15 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:28.05 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 2C831534)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=422 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=15 GB) - (Type=12)

==================== End Of Log ============================
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:15 on 09/01/2014 (Frau Blume)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-01-2014
Ran by Frau Blume (administrator) on FRAUBLUME-PC on 09-01-2014 22:18:27
Running from C:\Users\Frau Blume\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files (x86)\Microtek\ScanWizard 5\ScannerFinder.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Mindjet) C:\Program Files (x86)\Mindjet\MindManager 10\MmReminderService.exe
(Dropbox, Inc.) C:\Users\Frau Blume\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
() C:\Users\Frau Blume\Downloads\FRST64.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] - C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [6988736 2009-12-17] (Lenovo (Beijing) Limited)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2011-05-27] ()
HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe [521272 2011-05-27] (Conexant Systems, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [684024 2012-10-17] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [ColdTurkey_notify] - C:\Program Files\ColdTurkey\ct_notify.exe [47104 2013-01-01] ()
HKLM-x32\...\Run: [MMReminderService] - C:\Program Files (x86)\Mindjet\MindManager 10\MmReminderService.exe [38248 2012-02-27] (Mindjet)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
Startup: C:\Users\Frau Blume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Frau Blume\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=E62FFA53-3B13-4D17-B549-D841F87349BE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9672A6D418A7CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=1048269084&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=1048269084&q={searchTerms}
SearchScopes: HKLM-x32 - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=E62FFA53-3B13-4D17-B549-D841F87349BE&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - DefaultScope {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=E62FFA53-3B13-4D17-B549-D841F87349BE&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=1048269084&q={searchTerms}
SearchScopes: HKCU - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=E62FFA53-3B13-4D17-B549-D841F87349BE&ref=toolbox&q={searchTerms}
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: CmjBrowserHelperObject Object - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Program Files (x86)\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: XBTBPos00 Class - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\ChatZum Toolbar\tbunsp73C2.tmp\tbcore3.dll ()
Toolbar: HKLM-x32 - ChatZum Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files (x86)\ChatZum Toolbar\tbunsp73C2.tmp\tbcore3.dll ()
Toolbar: HKCU - No Name - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Frau Blume\AppData\Roaming\Mozilla\Firefox\Profiles\acq9b773.default
FF SearchEngineOrder.1: ChatZumSearch
FF SelectedSearchEngine: StartWeb
FF Homepage: www.google.de
FF Keyword.URL: hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=1048269084&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Frau Blume\AppData\Roaming\Mozilla\Firefox\Profiles\acq9b773.default\searchplugins\ChatZumSearch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\StartWeb.xml
FF Extension: YouTube Unblocker - C:\Users\Frau Blume\AppData\Roaming\Mozilla\Firefox\Profiles\acq9b773.default\Extensions\youtubeunblocker@unblocker.yt
FF Extension: ChatZum Toolbar - C:\Users\Frau Blume\AppData\Roaming\Mozilla\Firefox\Profiles\acq9b773.default\Extensions\{ADFA33FD-16F5-4355-8504-DF4D664CFE83}
FF Extension: Grooveshark Unlocker - C:\Users\Frau Blume\AppData\Roaming\Mozilla\Firefox\Profiles\acq9b773.default\Extensions\groovesharkUnlocker@overlord1337.xpi
FF Extension: {b8059785-ecb2-4ac5-a6ee-cda968b59a52} - C:\Users\Frau Blume\AppData\Roaming\Mozilla\Firefox\Profiles\acq9b773.default\Extensions\{b8059785-ecb2-4ac5-a6ee-cda968b59a52}.xpi
FF Extension: Adblock Plus - C:\Users\Frau Blume\AppData\Roaming\Mozilla\Firefox\Profiles\acq9b773.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: PDF Print Helper Plus - C:\Users\Frau Blume\AppData\Roaming\Mozilla\Firefox\Profiles\acq9b773.default\Extensions\{e5a24d56-98ac-4429-9e3e-f72a5cbb00bf}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S2 KCTRP; C:\Program Files\ColdTurkey\KCTRP_srv.exe [29696 2013-01-27] ()
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [21416 2012-09-27] ()

==================== Drivers (Whitelisted) ====================

S2 ASPI32; No ImagePath
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 usbsmi; C:\Windows\System32\DRIVERS\SMIksdrv.sys [197504 2009-10-26] (SMI)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-09 22:18 - 2014-01-09 22:19 - 00011439 _____ C:\Users\Frau Blume\Downloads\FRST.txt
2014-01-09 22:17 - 2014-01-09 22:17 - 00000000 ____D C:\FRST
2014-01-09 22:15 - 2014-01-09 22:15 - 00000000 _____ C:\Users\Frau Blume\defogger_reenable
2014-01-07 17:10 - 2014-01-07 17:10 - 04848839 _____ C:\Users\Frau Blume\Downloads\FoEKampagne.zip
2014-01-06 07:54 - 2014-01-06 07:54 - 00000012 _____ C:\Users\Frau Blume\Desktop\Reise-Annas-Eltern.txt
2013-12-26 20:24 - 2013-12-26 20:24 - 00401752 _____ (Softonic                                        ) C:\Users\Frau Blume\Downloads\SoftonicDownloader_fuer_viber.exe
2013-12-26 20:20 - 2013-12-26 21:26 - 00000000 ____D C:\Users\Frau Blume\AppData\Roaming\Jitsi
2013-12-26 20:08 - 2013-12-26 20:13 - 41490184 _____ (jitsi.org) C:\Users\Frau Blume\Downloads\jitsi-2.2-latest-x86.exe
2013-12-26 02:19 - 2013-12-26 02:19 - 09125638 _____ C:\Users\Frau Blume\Documents\Hallo ihr Lieben2.odt
2013-12-25 05:01 - 2013-12-26 02:17 - 22528025 _____ C:\Users\Frau Blume\Documents\Hallo ihr Lieben.odt
2013-12-25 02:30 - 2013-12-27 22:46 - 00000000 ____D C:\Users\Frau Blume\Desktop\zweiteMail
2013-12-20 06:42 - 2013-12-20 06:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-12 06:00 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 06:00 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 06:00 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 06:00 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-12 05:57 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-12 05:57 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-12 05:57 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-12 05:57 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-12 05:57 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-12 05:57 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-12 05:57 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-12 05:57 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-12 05:57 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-12 05:57 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-12 05:57 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-12 05:57 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-12 05:57 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-12 05:57 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-12 05:57 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-12 05:57 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-12 05:57 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-12 05:57 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-12 05:57 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-12 05:57 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-12 05:57 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-12 05:57 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-12 05:57 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-12 05:57 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-12 05:57 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-12 05:57 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-12 05:57 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-12 05:57 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-12 05:57 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-12 05:57 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-12 05:57 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 16:48 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 16:48 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 16:48 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 16:48 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 16:48 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 16:48 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 16:48 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 16:48 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 16:48 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 16:48 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 16:48 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 16:48 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 16:48 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 16:48 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 16:48 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 16:48 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 16:48 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 16:48 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 16:48 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys

==================== One Month Modified Files and Folders =======

2014-01-09 22:19 - 2014-01-09 22:18 - 00011439 _____ C:\Users\Frau Blume\Downloads\FRST.txt
2014-01-09 22:18 - 2012-10-27 16:10 - 00000000 ____D C:\Users\Frau Blume\AppData\Roaming\Skype
2014-01-09 22:17 - 2014-01-09 22:17 - 00000000 ____D C:\FRST
2014-01-09 22:16 - 2013-05-02 08:05 - 00000000 ____D C:\dominik
2014-01-09 22:16 - 2012-10-10 19:40 - 01996366 _____ C:\Windows\WindowsUpdate.log
2014-01-09 22:15 - 2014-01-09 22:15 - 00000000 _____ C:\Users\Frau Blume\defogger_reenable
2014-01-09 22:15 - 2012-10-10 19:46 - 00000000 ____D C:\Users\Frau Blume
2014-01-09 21:57 - 2012-10-12 12:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-09 19:27 - 2009-07-14 05:45 - 00021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-09 19:27 - 2009-07-14 05:45 - 00021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-09 19:19 - 2012-11-20 10:00 - 00000000 ___RD C:\Users\Frau Blume\Dropbox
2014-01-09 19:19 - 2012-11-20 09:54 - 00000000 ____D C:\Users\Frau Blume\AppData\Roaming\Dropbox
2014-01-09 19:17 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-09 19:17 - 2009-07-14 05:51 - 00098986 _____ C:\Windows\setupact.log
2014-01-09 16:37 - 2012-10-10 19:47 - 00000000 ___RD C:\Users\Frau Blume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-09 16:36 - 2012-11-20 10:00 - 00001036 _____ C:\Users\Frau Blume\Desktop\Dropbox.lnk
2014-01-09 16:36 - 2012-11-20 09:55 - 00000000 ____D C:\Users\Frau Blume\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-07 17:10 - 2014-01-07 17:10 - 04848839 _____ C:\Users\Frau Blume\Downloads\FoEKampagne.zip
2014-01-06 07:54 - 2014-01-06 07:54 - 00000012 _____ C:\Users\Frau Blume\Desktop\Reise-Annas-Eltern.txt
2014-01-05 02:38 - 2010-11-21 07:50 - 00654400 _____ C:\Windows\system32\perfh007.dat
2014-01-05 02:38 - 2010-11-21 07:50 - 00130240 _____ C:\Windows\system32\perfc007.dat
2014-01-05 02:38 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-01 03:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-31 23:25 - 2012-10-10 19:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-31 23:25 - 2010-11-21 04:47 - 00145650 _____ C:\Windows\PFRO.log
2013-12-27 22:46 - 2013-12-25 02:30 - 00000000 ____D C:\Users\Frau Blume\Desktop\zweiteMail
2013-12-26 21:30 - 2013-03-28 17:35 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-12-26 21:26 - 2013-12-26 20:20 - 00000000 ____D C:\Users\Frau Blume\AppData\Roaming\Jitsi
2013-12-26 20:24 - 2013-12-26 20:24 - 00401752 _____ (Softonic                                        ) C:\Users\Frau Blume\Downloads\SoftonicDownloader_fuer_viber.exe
2013-12-26 20:13 - 2013-12-26 20:08 - 41490184 _____ (jitsi.org) C:\Users\Frau Blume\Downloads\jitsi-2.2-latest-x86.exe
2013-12-26 02:19 - 2013-12-26 02:19 - 09125638 _____ C:\Users\Frau Blume\Documents\Hallo ihr Lieben2.odt
2013-12-26 02:17 - 2013-12-25 05:01 - 22528025 _____ C:\Users\Frau Blume\Documents\Hallo ihr Lieben.odt
2013-12-26 01:31 - 2012-11-18 17:38 - 00000000 ____D C:\Users\Frau Blume\AppData\Local\Paint.NET
2013-12-25 19:28 - 2012-11-30 08:33 - 00486912 ___SH C:\Users\Frau Blume\Desktop\Thumbs.db
2013-12-20 16:20 - 2012-11-24 22:10 - 00000000 ____D C:\Users\Frau Blume\AppData\Roaming\vlc
2013-12-20 06:42 - 2013-12-20 06:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-20 05:03 - 2012-11-24 22:13 - 00000000 ____D C:\Users\Frau Blume\AppData\Roaming\dvdcss
2013-12-18 20:35 - 2013-05-04 15:04 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-18 20:35 - 2013-03-29 09:28 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-18 20:35 - 2013-03-29 09:28 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-12 16:23 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-12 16:19 - 2009-07-14 05:45 - 00346520 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-12 05:59 - 2012-10-11 18:30 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-11 16:57 - 2012-10-12 12:32 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 16:57 - 2012-10-12 12:32 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 16:57 - 2012-10-12 12:32 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

Some content of TEMP:
====================
C:\Users\Frau Blume\AppData\Local\Temp\20121121100357178jniverify.dll
C:\Users\Frau Blume\AppData\Local\Temp\AskSLib.dll
C:\Users\Frau Blume\AppData\Local\Temp\avgnt.exe
C:\Users\Frau Blume\AppData\Local\Temp\bootstrapper.exe
C:\Users\Frau Blume\AppData\Local\Temp\chatzum_softonic_yahoo_62_v5.exe
C:\Users\Frau Blume\AppData\Local\Temp\firefoxjre_exe-1.exe
C:\Users\Frau Blume\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\Frau Blume\AppData\Local\Temp\ose00000.exe
C:\Users\Frau Blume\AppData\Local\Temp\pdf24-creator-update.exe
C:\Users\Frau Blume\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Frau Blume\AppData\Local\Temp\ydetect.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-01 03:07

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-09 22:37:46
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD5000BEVT-24A0RT0 rev.01.01A02 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\FRAUBL~1\AppData\Local\Temp\kwlcruob.sys


---- User code sections - GMER 2.1 ----

.text  C:\Users\Frau Blume\AppData\Roaming\Dropbox\bin\Dropbox.exe[2436] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69   0000000075ef1465 2 bytes [EF, 75]
.text  C:\Users\Frau Blume\AppData\Roaming\Dropbox\bin\Dropbox.exe[2436] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155  0000000075ef14bb 2 bytes [EF, 75]
.text  ...                                                                                                                         * 2

---- EOF - GMER 2.1 ----