Win Vista firefox neu öffnender Tab regclean pro

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2014 01
Ran by Christina (administrator) on CHRISTINA-PC on 15-02-2014 12:56:38
Running from C:\Users\Christina\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Nero AG) C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
() C:\Windows\SYSTEM32\Rezip.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfimon.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\sdclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1049896 2008-08-28] (Synaptics, Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6814240 2009-02-13] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-02-13] (Realtek Semiconductor Corp.)
HKLM\...\Run: [BrMfcWnd] - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1085440 2008-05-29] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] - C:\Program Files\Brother\ControlCenter3\brctrcen.exe [86016 2007-12-21] (Brother Industries, Ltd.)
HKLM\...\Run: [IndexSearch] - C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2007-10-11] (Nuance Communications, Inc.)
HKLM\...\Run: [PaperPort PTD] - C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2007-10-11] (Nuance Communications, Inc.)
HKLM\...\Run: [PPort11reminder] - C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2007-08-31] (Nuance Communications, Inc.)
HKLM\...\Run: [SSBkgdUpdate] - C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-05-20] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [UCam_Menu] - C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-12] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-4209836550-4282669215-480467586-1003\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-4209836550-4282669215-480467586-1003\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-4209836550-4282669215-480467586-1003\...\MountPoints2: {485158b2-5a22-11de-8d03-806e6f6e6963} - E:\SETUP.EXE
Startup: C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA7A93F71302ACF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {97910E15-7203-4B83-9C8C-BDF76F03010B} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=386496&p={searchTerms}
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://active.macromedia.com/flash2/cabs/swflash.cab
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\chyzvv0b.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.t-online.de
FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=386496&p=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\chyzvv0b.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-07-22]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 Rezip; C:\Windows\SYSTEM32\Rezip.exe [311296 2009-03-05] ()
R2 yksvc; C:\Windows\System32\ykx32mpcoinst.dll [282624 2009-01-30] (Marvell)

==================== Drivers (Whitelisted) ====================

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-10-03] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2008-08-12] (SAMSUNG ELECTRONICS CO., LTD.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-10-03] ()
R1 SSHDRV85; C:\Windows\system32\drivers\SSHDRV85.sys [78848 2009-09-14] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-14] (Avira GmbH)
R3 VMC326; C:\Windows\System32\Drivers\VMC326.sys [238464 2008-11-21] (Vimicro Corporation)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-15 12:56 - 2014-02-15 12:57 - 00012010 _____ () C:\Users\Christina\Desktop\FRST.txt
2014-02-15 12:56 - 2014-02-15 12:56 - 00000000 ____D () C:\FRST
2014-02-15 12:55 - 2014-02-15 12:55 - 01141248 _____ (Farbar) C:\Users\Christina\Desktop\FRST.exe
2014-02-15 12:54 - 2014-02-15 12:54 - 01431792 _____ (iMesh Inc) C:\Users\Christina\Desktop\iMeshSetup-r1487-w-bf.exe
2014-02-15 12:02 - 2014-02-15 12:02 - 00220408 _____ () C:\Users\Christina\Desktop\Paket Jungen Kleidung Gr. 158_164   Sweatshirts, Langarmshirts, Sweatjacken _ eBay.htm
2014-02-15 11:28 - 2014-02-15 11:38 - 00000000 ____D () C:\Users\Christina\Documents\PersBackup
2014-02-15 11:28 - 2014-02-15 11:38 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\PersBackup5
2014-02-15 11:23 - 2014-02-15 11:23 - 08337614 _____ (J. Rathlev ) C:\Users\Christina\Desktop\pb-setup-5.5.0400.exe
2014-02-15 10:31 - 2014-02-15 10:31 - 03645064 _____ (Piriform Ltd) C:\Users\Christina\Downloads\ccsetup410_slim.exe
2014-02-15 09:55 - 2014-02-05 09:58 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-15 09:55 - 2014-02-05 09:56 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-15 09:55 - 2014-02-05 09:53 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-15 09:55 - 2014-02-05 09:51 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-15 09:55 - 2014-02-05 09:50 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-15 09:55 - 2014-02-05 09:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-15 09:55 - 2014-02-05 09:49 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-15 09:55 - 2014-02-05 09:48 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-15 09:55 - 2014-02-05 09:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-15 09:55 - 2014-02-05 09:48 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-15 09:55 - 2014-02-05 09:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-15 09:55 - 2014-02-05 09:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-15 09:55 - 2014-02-05 09:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-15 09:55 - 2014-02-05 09:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-15 09:55 - 2014-02-05 09:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-15 09:55 - 2014-02-05 09:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-15 09:30 - 2014-02-15 09:30 - 49940480 _____ () C:\Program Files\GUT2EED.tmp
2014-02-15 09:30 - 2014-02-15 09:30 - 00000000 ____D () C:\Program Files\GUM2EEC.tmp
2014-02-05 17:57 - 2014-02-06 17:24 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-02-05 17:51 - 2014-02-15 11:01 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-01-23 19:08 - 2014-02-15 10:35 - 00000000 ____D () C:\Users\Christina\Desktop\Atari 7800

==================== One Month Modified Files and Folders =======

2014-02-15 12:57 - 2014-02-15 12:56 - 00012010 _____ () C:\Users\Christina\Desktop\FRST.txt
2014-02-15 12:57 - 2009-08-25 13:16 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{FA8A6898-2D07-4787-A0B1-5E4B4B3804D8}.job
2014-02-15 12:56 - 2014-02-15 12:56 - 00000000 ____D () C:\FRST
2014-02-15 12:55 - 2014-02-15 12:55 - 01141248 _____ (Farbar) C:\Users\Christina\Desktop\FRST.exe
2014-02-15 12:54 - 2014-02-15 12:54 - 01431792 _____ (iMesh Inc) C:\Users\Christina\Desktop\iMeshSetup-r1487-w-bf.exe
2014-02-15 12:51 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-15 12:39 - 2011-12-17 12:26 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-15 12:21 - 2006-11-02 13:47 - 00006432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-15 12:21 - 2006-11-02 13:47 - 00006432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-15 12:02 - 2014-02-15 12:02 - 00220408 _____ () C:\Users\Christina\Desktop\Paket Jungen Kleidung Gr. 158_164   Sweatshirts, Langarmshirts, Sweatjacken _ eBay.htm
2014-02-15 11:49 - 2008-01-21 02:35 - 01325249 _____ () C:\Windows\WindowsUpdate.log
2014-02-15 11:44 - 2008-01-21 08:16 - 01560216 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-15 11:38 - 2014-02-15 11:28 - 00000000 ____D () C:\Users\Christina\Documents\PersBackup
2014-02-15 11:38 - 2014-02-15 11:28 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\PersBackup5
2014-02-15 11:23 - 2014-02-15 11:23 - 08337614 _____ (J. Rathlev ) C:\Users\Christina\Desktop\pb-setup-5.5.0400.exe
2014-02-15 11:01 - 2014-02-05 17:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-15 10:35 - 2014-01-23 19:08 - 00000000 ____D () C:\Users\Christina\Desktop\Atari 7800
2014-02-15 10:32 - 2012-09-11 10:38 - 00000804 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-02-15 10:32 - 2009-10-31 10:50 - 00000000 ____D () C:\Program Files\CCleaner
2014-02-15 10:31 - 2014-02-15 10:31 - 03645064 _____ (Piriform Ltd) C:\Users\Christina\Downloads\ccsetup410_slim.exe
2014-02-15 10:23 - 2011-12-17 12:26 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-15 10:21 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-15 10:05 - 2013-08-16 07:14 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-15 10:05 - 2006-11-02 11:24 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-02-15 09:30 - 2014-02-15 09:30 - 49940480 _____ () C:\Program Files\GUT2EED.tmp
2014-02-15 09:30 - 2014-02-15 09:30 - 00000000 ____D () C:\Program Files\GUM2EEC.tmp
2014-02-14 17:39 - 2009-04-29 01:08 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-02-14 17:39 - 2006-11-02 14:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-12 18:42 - 2009-08-13 20:29 - 00000000 ____D () C:\Users\Christina\AppData\Local\Adobe
2014-02-12 18:10 - 2012-04-11 13:30 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-12 18:10 - 2011-06-06 10:46 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-06 17:31 - 2012-05-04 12:56 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-06 17:24 - 2014-02-05 17:57 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-02-05 09:58 - 2014-02-15 09:55 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-05 09:56 - 2014-02-15 09:55 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-05 09:53 - 2014-02-15 09:55 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-05 09:51 - 2014-02-15 09:55 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-05 09:50 - 2014-02-15 09:55 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-05 09:49 - 2014-02-15 09:55 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-05 09:49 - 2014-02-15 09:55 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-05 09:48 - 2014-02-15 09:55 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-05 09:48 - 2014-02-15 09:55 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-05 09:48 - 2014-02-15 09:55 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-05 09:48 - 2014-02-15 09:55 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-05 09:48 - 2014-02-15 09:55 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-05 09:47 - 2014-02-15 09:55 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-05 09:47 - 2014-02-15 09:55 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-05 09:47 - 2014-02-15 09:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-05 09:46 - 2014-02-15 09:55 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

Some content of TEMP:
====================
C:\Users\Christina\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-15 10:46

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-02-2014 01
Ran by Christina at 2014-02-15 12:58:10
Running from C:\Users\Christina\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 11 ActiveX (Version: 11.3.300.271 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (Version: 10.1.9 - Adobe Systems Incorporated)
Advertising Center (Version: 0.0.0.2 - Nero AG) Hidden
Agere Systems HDA Modem (Version:  - Agere Systems)
Anno 1404 (Version: 1.00.0000 - Ubisoft) Hidden
Assassin's Creed (Version: 1.02 - Ubisoft)
Atheros WLAN Client (Version: 1.00.000 - )
ATI Catalyst Install Manager (Version: 3.0.728.0 - ATI Technologies, Inc.)
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
BatteryLifeExtender (Version: 1.0.0 - Samsung)
Brother MFL-Pro Suite MFC-490CW (Version: 1.1.5.0 - Brother Industries, Ltd.)
calibre (Version: 0.8.61 - Kovid Goyal)
Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (Version: 2009.0520.1631.27815 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (Version: 2009.0520.1631.27815 - ATI) Hidden
Catalyst Control Center Graphics Full New (Version: 2009.0520.1631.27815 - ATI) Hidden
Catalyst Control Center Graphics Light (Version: 2009.0520.1631.27815 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (Version: 2009.0520.1631.27815 - ATI) Hidden
Catalyst Control Center InstallProxy (Version: 2009.0312.2223.38381 - ATI Technologies, Inc.) Hidden
Catalyst Control Center InstallProxy (Version: 2009.0520.1631.27815 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2009.0520.1631.27815 - ATI) Hidden
CCC Help Chinese Standard (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Chinese Traditional (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Czech (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Danish (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Dutch (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help English (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Finnish (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help French (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help German (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Greek (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Hungarian (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Italian (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Japanese (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Korean (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Norwegian (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Polish (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Portuguese (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Russian (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Spanish (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Swedish (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Thai (Version: 2009.0520.1630.27815 - ATI) Hidden
CCC Help Turkish (Version: 2009.0520.1630.27815 - ATI) Hidden
ccc-core-static (Version: 2009.0520.1631.27815 - Ihr Firmenname) Hidden
ccc-utility (Version: 2009.0520.1631.27815 - ATI) Hidden
CCleaner (Version: 4.10 - Piriform)
CyberLink YouCam (Version: 2.0.2706 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.2706 - CyberLink Corp.) Hidden
Easy Battery Manager (Version: 3.2.1.7 - Samsung)
Easy Display Manager (Version: 2.3 - Samsung Electronics Co., Ltd.)
Easy Network Manager (Version: 4.0.2 - Samsung)
Easy SpeedUp Manager (Version: 2.0.2.4 - )
FreeRIP v3.65 (Version: 3.65 - MGShareware)
Giana Sisters - Twisted Dreams (Version: 1.0 - Black Forest Games)
Glucofacts Deluxe Updater 2.0 (HKCU Version:  - Bayer HealthCare LLC)
Google Earth (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden
Handball Challenge Trainingscamp (Version:  - Neutron Games GmbH)
HijackThis 2.0.2 (Version: 2.0.2 - TrendMicro)
imagine digital freedom - Samsung (Version: 1.0.2.2 - Samsung Electronics Co. Ltd.,)
ImagXpress (Version: 7.0.74.0 - Nero AG) Hidden
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) PROSet/Wireless WiFi-Software (Version: 12.01.2000 - Intel(R) Corporation)
Intel® Matrix Storage Manager (Version:  - Intel Corporation)
Java 7 Update 45 (Version: 7.0.450 - Oracle)
JavaFX 2.1.1 (Version: 2.1.1 - Oracle Corporation)
Marvell Miniport Driver (Version: 10.67.5.3 - Marvell)
Menu Templates - Starter Kit (Version: 9.4.6.0 - Nero AG) Hidden
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version:  - )
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office 2003 Web Components (Version: 11.0.8003.0 - Microsoft Corporation)
Microsoft Office 2007 Primary Interop Assemblies (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Small Business Connectivity Components (Version: 2.0.7024.0 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft SQL Server Native Client (Version: 9.00.2047.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (Version: 9.00.2047.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Movie Templates - Starter Kit (Version: 9.4.6.0 - Nero AG) Hidden
Mozilla Firefox 27.0 (x86 de) (Version: 27.0 - Mozilla)
Mozilla Maintenance Service (Version: 24.3.0 - Mozilla)
Mozilla Thunderbird 24.3.0 (x86 de) (Version: 24.3.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
Namuga 1.3M Webcam (Version: 1.00.0000 - Vimicro Corporation)
Nero 9 Essentials (Version:  - Nero AG)
Nero BurnRights (Version: 3.4.13.100 - Nero AG) Hidden
Nero BurnRights Help (Version: 3.4.4.100 - Nero AG) Hidden
Nero ControlCenter (Version: 9.0.0.1 - Nero AG) Hidden
Nero CoverDesigner (Version: 4.4.12.100 - Nero AG) Hidden
Nero CoverDesigner Help (Version: 4.4.9.100 - Nero AG) Hidden
Nero Disc Copy Gadget (Version: 2.4.34.0 - Nero AG) Hidden
Nero Disc Copy Gadget Help (Version: 2.4.34.0 - Nero AG) Hidden
Nero DiscSpeed (Version: 5.4.13.100 - Nero AG) Hidden
Nero DiscSpeed Help (Version: 5.4.4.100 - Nero AG) Hidden
Nero DriveSpeed (Version: 4.4.12.100 - Nero AG) Hidden
Nero DriveSpeed Help (Version: 4.4.4.100 - Nero AG) Hidden
Nero Express Help (Version: 9.4.27.100 - Nero AG) Hidden
Nero InfoTool (Version: 6.4.12.100 - Nero AG) Hidden
Nero InfoTool Help (Version: 6.4.4.100 - Nero AG) Hidden
Nero Installer (Version: 4.4.9.0 - Nero AG) Hidden
Nero Online Upgrade (Version: 1.3.0.0 - Nero AG) Hidden
Nero Rescue Agent (Version: 2.4.14.100 - Nero AG) Hidden
Nero RescueAgent Help (Version: 2.4.4.100 - Nero AG) Hidden
Nero ShowTime (Version: 5.4.0.100 - Nero AG) Hidden
Nero ShowTime (Version: 5.4.21.100 - Nero AG) Hidden
Nero StartSmart (Version: 9.4.19.100 - Nero AG) Hidden
Nero StartSmart Help (Version: 9.4.19.100 - Nero AG) Hidden
Nero Vision (Version: 6.4.16.100 - Nero AG) Hidden
Nero Vision Help (Version: 6.4.15.100 - Nero AG) Hidden
NeroExpress (Version: 9.4.27.100 - Nero AG) Hidden
neroxml (Version: 1.0.0 - Nero AG) Hidden
NVIDIA PhysX (Version: 9.09.0814 - NVIDIA Corporation)
OpenAL (Version:  - )
PaperPort Image Printer (Version: 1.00.0000 - Nuance Communications, Inc.)
PCTroubleshooting (Version: 2.0.0.3 - Samsung Electronics Co.,LTD.)
Personal Backup 5.5 (Version: 5.3 - J. Rathlev)
Realtek High Definition Audio Driver (Version: 6.0.1.5791 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (Version: 1.02.0085 - REALTEK Semiconductor Corp.)
Samsung Magic Doctor (Version: 5.0 - Samsung Electronics Co., LTD)
Samsung Recovery Solution III (Version: 3.0.0.8 - Samsung)
Samsung Update Plus (Version: 2.0 - Samsung Electronics Co., LTD)
Samsung Update Plus (Version: 2.0 - Samsung Electronics Co., LTD) Hidden
ScanSoft PaperPort 11 (Version: 11.1.0000 - Nuance Communications, Inc.)
Sesam Découvertes 2 deinstallieren (Version:  - )
Sesam Découvertes 3 deinstallieren (Version:  - )
Sesam Découvertes 4 deinstallieren (Version:  - )
Sesam Découvertes 5 deinstallieren (Version:  - )
Skins (Version: 2009.0520.1631.27815 - ATI) Hidden
Sony Ericsson Update Engine (Version: 2.13.4.16 - Sony Ericsson Communications AB)
Synaptics Pointing Device Driver (Version: 11.1.3.2 - Synaptics)
The Witcher 2 (Version: 1.00.0000 - CD Projekt Red)
Ubisoft Game Launcher (Version: 1.0.0.0 - UBISOFT)
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (Version: 9.00.2047.00 - Microsoft Corporation)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (Version: 3 - Microsoft Corporation)
User Guide (Version: 1.0 - )
Windows Media Player Firefox Plugin (Version: 1.0.0.8 - Microsoft Corp)

==================== Restore Points  =========================

07-02-2014 17:38:06 Geplanter Prüfpunkt
08-02-2014 17:55:12 Geplanter Prüfpunkt
11-02-2014 12:40:15 Geplanter Prüfpunkt
14-02-2014 13:52:32 Geplanter Prüfpunkt
15-02-2014 08:31:53 Windows Update
15-02-2014 08:53:35 Windows Update
15-02-2014 09:26:32 Windows Update
15-02-2014 10:11:24 Windows-Sicherung
15-02-2014 10:15:24 Windows-Sicherung

==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {17D8B9D4-0A20-4E99-A3B2-82A1E5CF7621} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-12-17] (Google Inc.)
Task: {1AED981C-8C7D-4AE1-A547-3F3CB1A46B4D} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => d:\program files\windows defender\MpCmdRun.exe
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {2093A143-4EA9-412F-B01C-67CE929DBEED} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2009-03-20] (Samsung Electronics Co., Ltd.)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {326F1D11-A3BD-4735-99FD-8DC98737921D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {570B1DE1-33B7-4315-BCA0-A269B763F199} - System32\Tasks\BatteryLifeExtender => C:\Program Files\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2009-03-13] (Samsung Electronics. Co. Ltd.)
Task: {5E66BC8D-8B26-41AB-8F09-314E757549A8} - System32\Tasks\SamsungMagicDoctor => C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe [2008-08-26] (Samsung Electronics Co., Ltd.)
Task: {6CDA04F1-DB5B-4DF1-9191-78308A9D0FBE} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe [2010-04-20] ()
Task: {71BD8784-9945-4C30-AD0B-6522A060A8C1} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2009-02-16] (Samsung Electronics Co., Ltd.)
Task: {813A8E96-0C2F-4F28-8594-19A29BD56912} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {826A5460-BD0E-49FB-BEAD-50F43464141C} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe [2008-12-10] (SAMSUNG Electronics co., LTD.)
Task: {929A83D4-3A8B-4B2F-91A0-7093405597FD} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {A70CEAA7-E729-439D-A391-EFD3134F819B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-12-17] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{FA8A6898-2D07-4787-A0B1-5E4B4B3804D8}.job => C:\Windows\system32\msfeedssync.exe

==================== Loaded Modules (whitelisted) =============

2010-11-01 15:51 - 2009-05-15 22:22 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2009-04-28 09:25 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Samsung Magic Doctor\HookDllPS2.dll
2009-04-28 09:25 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2009-04-28 09:24 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\SAMSUNG\EasySpeedUpManager\HookDllPS2.dll
2010-11-01 16:09 - 2010-11-01 16:09 - 00014848 _____ () C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
2009-02-12 13:32 - 2009-02-12 13:32 - 00016384 ____R () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-11-01 16:09 - 2010-11-01 16:09 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-02-05 17:51 - 2014-02-05 17:51 - 03583600 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-02-05 17:57 - 2014-02-05 17:57 - 03019376 _____ () C:\Program Files\Mozilla Thunderbird\mozjs.dll
2014-02-05 17:57 - 2014-02-05 17:57 - 00158832 _____ () C:\Program Files\Mozilla Thunderbird\NSLDAP32V60.dll
2014-02-05 17:57 - 2014-02-05 17:57 - 00023152 _____ () C:\Program Files\Mozilla Thunderbird\NSLDAPPR32V60.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/15/2014 11:18:35 AM) (Source: Windows Backup) (User: )
Description: Die Dateisicherung ist fehlgeschlagen. Fehler: Die Anforderung konnte wegen eines E/A-Gerätefehlers nicht ausgeführt werden. (0x8007045D)

Error: (02/15/2014 11:14:46 AM) (Source: Windows Backup) (User: )
Description: Die Dateisicherung ist fehlgeschlagen. Fehler: Die Anforderung konnte wegen eines E/A-Gerätefehlers nicht ausgeführt werden. (0x8007045D)

Error: (02/15/2014 10:24:03 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\THUNDERBIRD\PROFILES\AX8ZFZYA.DEFAULT\CACHE\4> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (02/15/2014 10:24:01 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\THUNDERBIRD\PROFILES\AX8ZFZYA.DEFAULT\CACHE\4> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (02/15/2014 10:24:00 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\THUNDERBIRD\PROFILES\AX8ZFZYA.DEFAULT\CACHE\3> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (02/15/2014 10:24:00 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\THUNDERBIRD\PROFILES\AX8ZFZYA.DEFAULT\CACHE\3> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (02/15/2014 10:23:56 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\THUNDERBIRD\PROFILES\AX8ZFZYA.DEFAULT\CACHE\2> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (02/15/2014 10:23:56 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\THUNDERBIRD\PROFILES\AX8ZFZYA.DEFAULT\CACHE\2> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (02/15/2014 10:23:56 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\THUNDERBIRD\PROFILES\AX8ZFZYA.DEFAULT\CACHE\1> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (02/15/2014 10:23:56 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\THUNDERBIRD\PROFILES\AX8ZFZYA.DEFAULT\CACHE\1> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)


System errors:
=============
Error: (02/15/2014 10:26:37 AM) (Source: iaStor) (User: )
Description: Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet.

Error: (02/15/2014 10:25:56 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (02/15/2014 10:22:39 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (02/15/2014 10:21:40 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 15.02.2014 um 10:07:36 unerwartet heruntergefahren.

Error: (02/15/2014 10:04:23 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: 0x8024200dSicherheitsupdate für Microsoft .NET Framework 2.0 SP2 unter Windows Vista SP2 und Windows Server 2008 SP2 x86 (KB2901113){9335FF13-A32D-4E69-8AB2-C4AB07E8B858}201

Error: (02/15/2014 09:55:02 AM) (Source: Microsoft-Windows-Servicing) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB2901113 (Security Update) nicht in den Status Installation angefordert(Install Requested) setzen.

Error: (02/15/2014 09:55:02 AM) (Source: Microsoft-Windows-Servicing) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB2901113 (Security Update) nicht in den Status Installation angefordert(Install Requested) setzen.

Error: (02/15/2014 09:55:02 AM) (Source: Microsoft-Windows-Servicing) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB2901113 (Security Update) nicht in den Status Installation angefordert(Install Requested) setzen.

Error: (02/15/2014 09:55:02 AM) (Source: Microsoft-Windows-Servicing) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB2901113 (Security Update) nicht in den Status Installation angefordert(Install Requested) setzen.

Error: (02/15/2014 09:55:02 AM) (Source: Microsoft-Windows-Servicing) (User: NT-AUTORITÄT)
Description: Windows-Wartung konnte das Paket KB2901113 (Security Update) nicht in den Status Wird bereitgestellt(Staging) setzen.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2012-07-08 17:09:54.435
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Tobit ClipInc\Player\ChargedByClipInc.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-08 17:09:54.220
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Tobit ClipInc\Player\ChargedByClipInc.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-08 17:09:54.003
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Tobit ClipInc\Player\ChargedByClipInc.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-08 17:09:53.786
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Tobit ClipInc\Player\ChargedByClipInc.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-08 17:09:53.569
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Tobit ClipInc\Player\ChargedByClipInc.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-08 17:09:53.351
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Tobit ClipInc\Player\ChargedByClipInc.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-08 17:09:53.133
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Tobit ClipInc\Player\ChargedByClipInc.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-08 17:09:52.916
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Tobit ClipInc\Player\ChargedByClipInc.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-08 17:09:52.695
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Tobit ClipInc\Player\ChargedByClipInc.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-07-08 17:09:52.468
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Tobit ClipInc\Player\ChargedByClipInc.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 50%
Total physical RAM: 3035.88 MB
Available physical RAM: 1515.62 MB
Total Pagefile: 6300.16 MB
Available Pagefile: 4555.43 MB
Total Virtual: 2047.88 MB
Available Virtual: 1921.76 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:226.76 GB) (Free:123.4 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:226 GB) (Free:198.59 GB) NTFS
Drive f: (Volume) (Fixed) (Total:465.76 GB) (Free:299.31 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 81164B3F)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=227 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=226 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 20ABDE0B)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-15 13:21:30
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0001 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\CHRIST~1\AppData\Local\Temp\kglcquod.sys


---- System - GMER 2.1 ----

SSDT            8D2BD8E6                                                                                         ZwCreateSection
SSDT            8D2BD8F0                                                                                         ZwRequestWaitReplyPort
SSDT            8D2BD8EB                                                                                         ZwSetContextThread
SSDT            8D2BD8F5                                                                                         ZwSetSecurityObject
SSDT            8D2BD8FA                                                                                         ZwSystemDebugControl
SSDT            8D2BD887                                                                                         ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntoskrnl.exe!KeInsertQueue + 405                                                                 8208090C 4 Bytes  [E6, D8, 2B, 8D]
.text           ntoskrnl.exe!KeInsertQueue + 729                                                                 82080C30 4 Bytes  [F0, D8, 2B, 8D]
.text           ntoskrnl.exe!KeInsertQueue + 75D                                                                 82080C64 4 Bytes  [EB, D8, 2B, 8D]
.text           ntoskrnl.exe!KeInsertQueue + 7C1                                                                 82080CC8 4 Bytes  [F5, D8, 2B, 8D]
.text           ntoskrnl.exe!KeInsertQueue + 809                                                                 82080D10 4 Bytes  [FA, D8, 2B, 8D]
.text           ...                                                                                              
.text           C:\Windows\system32\DRIVERS\atikmdag.sys                                                         section is writeable [0x8F808000, 0x2C7FC2, 0xE8000020]
.text           C:\Windows\system32\drivers\SSHDRV85.sys                                                         section is writeable [0x90713000, 0x24A24, 0xE8000020]
.pklstb         C:\Windows\system32\drivers\SSHDRV85.sys                                                         entry point in ".pklstb" section [0x90746000]
.relo2          C:\Windows\system32\drivers\SSHDRV85.sys                                                         unknown last section [0x9075C000, 0x8E, 0x42000040]
.text           C:\Windows\system32\DRIVERS\atksgt.sys                                                           section is writeable [0x9E92A300, 0x3B6D8, 0xE8000020]
.text           C:\Windows\system32\DRIVERS\lirsgt.sys                                                           section is writeable [0x9E96D300, 0x1BEE, 0xE8000020]

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Mozilla Firefox\firefox.exe[5000] ntdll.dll!LdrLoadDll                          77CD9378 5 Bytes  JMP 6E971FFD C:\Program Files\Mozilla Firefox\mozglue.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[5000] kernel32.dll!HeapSetInformation + 26          7651A8B0 7 Bytes  JMP 5FA25CC6 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[5000] kernel32.dll!LockResource + C                 76536ACB 7 Bytes  JMP 5FE109D3 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[5000] kernel32.dll!VirtualAllocEx + 54              7653AF50 7 Bytes  JMP 5FE1098B C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[5000] GDI32.dll!SetStretchBltMode + 256             77E6745C 7 Bytes  JMP 5FE109FA C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Thunderbird\thunderbird.exe[5696] ntdll.dll!LdrLoadDll                  77CD9378 5 Bytes  JMP 59C5561E C:\Program Files\Mozilla Thunderbird\xul.dll
.text           C:\Program Files\Mozilla Thunderbird\thunderbird.exe[5696] kernel32.dll!HeapSetInformation + 26  7651A8B0 7 Bytes  JMP 59C6627E C:\Program Files\Mozilla Thunderbird\xul.dll
.text           C:\Program Files\Mozilla Thunderbird\thunderbird.exe[5696] kernel32.dll!LockResource + C         76536ACB 7 Bytes  JMP 5A8F484D C:\Program Files\Mozilla Thunderbird\xul.dll
.text           C:\Program Files\Mozilla Thunderbird\thunderbird.exe[5696] kernel32.dll!VirtualAllocEx + 54      7653AF50 7 Bytes  JMP 5A8F4805 C:\Program Files\Mozilla Thunderbird\xul.dll
.text           C:\Program Files\Mozilla Thunderbird\thunderbird.exe[5696] GDI32.dll!SetStretchBltMode + 256     77E6745C 7 Bytes  JMP 5A8F4874 C:\Program Files\Mozilla Thunderbird\xul.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a7dda7115                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a7dda7115@6c8336e0cfb6         0xE2 0xEE 0xD1 0x22 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001a7dda7115 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001a7dda7115@6c8336e0cfb6             0xE2 0xEE 0xD1 0x22 ...

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                                                            unknown MBR code

---- EOF - GMER 2.1 ----