Windows 7: Laptop läuft langsam. Versteckte Malware?

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-04-2014 01
Ran by Recep (administrator) on RECEP-PC on 12-04-2014 17:58:12
Running from C:\Users\Recep\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
() C:\Program Files\Google\Update\Install\{8DDEEFBF-1641-4AF3-B1C9-BD2254E0AB84}\34.0.1847.116_33.0.1750.154_chrome_updater.exe
(Google Inc.) C:\Windows\TEMP\CR_10CE1.tmp\setup.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10889832 2011-12-27] (Realtek Semiconductor)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [280576 2013-10-15] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [1050912 2014-03-03] (Conduit)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP332B59D3-6B44-4BBB-8084-D5798C5F08AD&SSPV=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4BF3E3079AB0CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope {A96AD802-91CB-406E-B0F6-0710CB218E2C} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {A96AD802-91CB-406E-B0F6-0710CB218E2C} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP332B59D3-6B44-4BBB-8084-D5798C5F08AD&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP332B59D3-6B44-4BBB-8084-D5798C5F08AD&q={searchTerms}&SSPV=
SearchScopes: HKCU - {A96AD802-91CB-406E-B0F6-0710CB218E2C} URL = hxxp://www.sm.de/?q={searchTerms}
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Recep\AppData\Roaming\Mozilla\Firefox\Profiles\lj9yzm5b.default
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Recep\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Recep\AppData\Roaming\Mozilla\Firefox\Profiles\lj9yzm5b.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-12]

Chrome: 
=======
CHR HomePage: hxxp://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP332B59D3-6B44-4BBB-8084-D5798C5F08AD&SSPV=
CHR DefaultSearchKeyword: conduit.search
CHR DefaultSearchProvider: Conduit Search
CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP332B59D3-6B44-4BBB-8084-D5798C5F08AD&q={searchTerms}&SSPV=
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-13]
CHR Extension: (Google Drive) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-13]
CHR Extension: (YouTube) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-13]
CHR Extension: (Google-Suche) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-13]
CHR Extension: (Google Wallet) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-13]
CHR Extension: (Google Mail) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-13]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-21] (Avira Operations GmbH & Co. KG)
S4 CltMngSvc; C:\Program Files\SearchProtect\Main\bin\CltMngSvc.exe [2454816 2014-03-03] (Conduit)
S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [276248 2012-02-19] (Intel Corporation)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 b57xdbd; C:\Windows\System32\DRIVERS\b57xdbd.sys [60968 2011-11-04] (Broadcom Corporation)
R3 b57xdmp; C:\Windows\System32\DRIVERS\b57xdmp.sys [17960 2011-11-04] (Broadcom Corporation)
R3 bScsiMSx; C:\Windows\System32\DRIVERS\bScsiMSx.sys [43560 2011-09-02] (Broadcom Corporation)
R3 bScsiSDx; C:\Windows\System32\DRIVERS\bScsiSDx.sys [47104 2012-05-03] (Broadcom Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [55104 2012-07-17] (Intel Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-27] (Avira GmbH)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-12 17:58 - 2014-04-12 17:58 - 00009135 _____ () C:\Users\Recep\Desktop\FRST.txt
2014-04-12 17:58 - 2014-04-12 17:58 - 00000000 ____D () C:\FRST
2014-04-12 17:56 - 2014-04-12 17:57 - 01145856 _____ (Farbar) C:\Users\Recep\Desktop\FRST.exe
2014-04-12 17:54 - 2014-04-12 17:54 - 00000472 _____ () C:\Users\Recep\Desktop\defogger_disable.log
2014-04-12 17:54 - 2014-04-12 17:54 - 00000000 _____ () C:\Users\Recep\defogger_reenable
2014-04-12 17:52 - 2014-04-12 17:52 - 00050477 _____ () C:\Users\Recep\Desktop\Defogger.exe
2014-04-12 17:48 - 2014-04-12 17:49 - 00000000 ____D () C:\Users\Recep\AppData\Roaming\Mozilla
2014-04-12 17:48 - 2014-04-12 17:49 - 00000000 ____D () C:\Users\Recep\AppData\Local\Mozilla
2014-04-12 17:47 - 2014-04-12 17:47 - 00001109 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\ProgramData\Mozilla
2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-04-12 17:29 - 2014-04-12 17:32 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-23 19:23 - 2014-03-23 19:42 - 00000000 ____D () C:\Users\Recep\Desktop\Neuer Ordner
2014-03-15 13:47 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-15 13:47 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-15 13:47 - 2014-03-01 06:10 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-15 13:47 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-15 13:47 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-15 13:47 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-15 13:47 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-15 13:47 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-15 13:47 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-15 13:47 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-15 13:47 - 2014-03-01 05:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-15 13:47 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-15 13:47 - 2014-03-01 05:31 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-15 13:47 - 2014-03-01 05:25 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-15 13:47 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-15 13:47 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-15 13:47 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-15 13:47 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-15 13:47 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-15 13:47 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-15 13:47 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-15 13:47 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-14 21:07 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-14 21:06 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-14 21:00 - 2014-02-07 03:07 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-14 21:00 - 2014-01-28 04:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-14 20:59 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

==================== One Month Modified Files and Folders =======

2014-04-12 17:58 - 2014-04-12 17:58 - 00009135 _____ () C:\Users\Recep\Desktop\FRST.txt
2014-04-12 17:58 - 2014-04-12 17:58 - 00000000 ____D () C:\FRST
2014-04-12 17:57 - 2014-04-12 17:56 - 01145856 _____ (Farbar) C:\Users\Recep\Desktop\FRST.exe
2014-04-12 17:56 - 2013-09-13 18:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-12 17:54 - 2014-04-12 17:54 - 00000472 _____ () C:\Users\Recep\Desktop\defogger_disable.log
2014-04-12 17:54 - 2014-04-12 17:54 - 00000000 _____ () C:\Users\Recep\defogger_reenable
2014-04-12 17:54 - 2013-09-13 17:14 - 00000000 ____D () C:\Users\Recep
2014-04-12 17:53 - 2013-09-13 17:59 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-12 17:52 - 2014-04-12 17:52 - 00050477 _____ () C:\Users\Recep\Desktop\Defogger.exe
2014-04-12 17:49 - 2014-04-12 17:48 - 00000000 ____D () C:\Users\Recep\AppData\Roaming\Mozilla
2014-04-12 17:49 - 2014-04-12 17:48 - 00000000 ____D () C:\Users\Recep\AppData\Local\Mozilla
2014-04-12 17:47 - 2014-04-12 17:47 - 00001109 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\ProgramData\Mozilla
2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-04-12 17:45 - 2013-09-13 17:08 - 01908305 _____ () C:\Windows\WindowsUpdate.log
2014-04-12 17:32 - 2014-04-12 17:29 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-12 17:32 - 2009-07-14 06:34 - 00019712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-12 17:32 - 2009-07-14 06:34 - 00019712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-12 17:29 - 2013-09-13 17:19 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-12 17:23 - 2013-09-13 17:59 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-12 17:23 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-12 17:23 - 2009-07-14 06:39 - 00083964 _____ () C:\Windows\setupact.log
2014-04-05 14:31 - 2013-09-14 15:54 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000UA.job
2014-04-04 12:59 - 2013-09-14 15:54 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000Core.job
2014-03-23 19:42 - 2014-03-23 19:23 - 00000000 ____D () C:\Users\Recep\Desktop\Neuer Ordner
2014-03-15 13:21 - 2009-07-14 06:33 - 00268272 _____ () C:\Windows\system32\FNTCACHE.DAT

Some content of TEMP:
====================
C:\Users\Recep\AppData\Local\Temp\AskSLib.dll
C:\Users\Recep\AppData\Local\Temp\avgnt.exe
C:\Users\Recep\AppData\Local\Temp\install_flashplayer11x32ax_gtba_chra_dy_aaa_aih.exe
C:\Users\Recep\AppData\Local\Temp\nsd4A02.exe
C:\Users\Recep\AppData\Local\Temp\nsd8963.exe
C:\Users\Recep\AppData\Local\Temp\nsd8DA8.exe
C:\Users\Recep\AppData\Local\Temp\nsy46D6.exe
C:\Users\Recep\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Recep\AppData\Local\Temp\SPSetup.exe
C:\Users\Recep\AppData\Local\Temp\sqlite3.exe
C:\Users\Recep\AppData\Local\Temp\utt18D4.tmp.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-11 20:34

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-04-2014 01
Ran by Recep at 2014-04-12 17:58:55
Running from C:\Users\Recep\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

µTorrent (HKCU\...\uTorrent) (Version: 3.3.2.30446 - BitTorrent Inc.)
Adobe Flash Player 12 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 15.0.7.2 - Broadcom Corporation)
Broadcom NetLink Controller (HKLM\...\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 15.0.7.1 - Broadcom Corporation)
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Google Chrome (HKLM\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)
Google Update Helper (Version: 1.3.23.9 - Google Inc.) Hidden
Intel(R) OpenCL CPU Runtime (HKLM\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2653 - Intel Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Word Viewer 2003 (HKLM\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6543 - Realtek Semiconductor Corp.)
Search Protect (HKLM\...\SearchProtect) (Version: 2.11.11.7 - Conduit) <==== ATTENTION
VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)

==================== Restore Points  =========================

11-03-2014 11:41:52 Windows Update
14-03-2014 18:46:40 Windows Update
15-03-2014 11:01:10 Windows Update
15-03-2014 14:37:21 Windows Update
18-03-2014 16:22:08 Windows Update
21-03-2014 17:52:54 Windows Update
26-03-2014 12:05:38 Windows Update
02-04-2014 11:54:28 Windows Update
12-04-2014 15:28:11 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {4760F1B8-D141-4AE4-89B1-EF10342FB605} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-27] (Adobe Systems Incorporated)
Task: {65F537DB-C1A6-46E7-B911-6D93FCF6AB51} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-09-13] (Google Inc.)
Task: {7E04538B-4AB5-45E0-935F-AE87626A3BBD} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000Core => C:\Users\Recep\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-09-14] (Facebook Inc.)
Task: {99BE2FD7-A777-4B27-9DE7-65D4A220020E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000UA => C:\Users\Recep\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-09-14] (Facebook Inc.)
Task: {DF6A0846-E748-4CEC-A7BC-EDCC3BAA42E6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-09-13] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000Core.job => C:\Users\Recep\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000UA.job => C:\Users\Recep\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-27 23:33 - 2013-09-27 23:27 - 00394824 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2013-09-13 17:26 - 2012-02-14 09:53 - 00094208 _____ () C:\Windows\System32\IccLibDll.dll
2014-04-12 17:47 - 2014-03-15 10:40 - 03642480 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-04-12 17:55 - 2014-04-08 19:02 - 08704216 _____ () C:\Program Files\Google\Update\Install\{8DDEEFBF-1641-4AF3-B1C9-BD2254E0AB84}\34.0.1847.116_33.0.1750.154_chrome_updater.exe

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: CltMngSvc => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: IEEtwCollectorService => 3
MSCONFIG\startupreg: Facebook Update => "C:\Users\Recep\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: uTorrent => "C:\Users\Recep\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/07/2014 11:54:12 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc6b7
Name des fehlerhaften Moduls: igdumd32.dll, Version: 8.15.10.2653, Zeitstempel: 0x4f3aab9f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0027d0d8
ID des fehlerhaften Prozesses: 0xb14
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3

Error: (03/07/2014 11:49:36 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc6b7
Name des fehlerhaften Moduls: igdumd32.dll, Version: 8.15.10.2653, Zeitstempel: 0x4f3aab9f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0027d0d8
ID des fehlerhaften Prozesses: 0xdc4
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3

Error: (03/07/2014 11:45:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc6b7
Name des fehlerhaften Moduls: igdumd32.dll, Version: 8.15.10.2653, Zeitstempel: 0x4f3aab9f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0027d0d8
ID des fehlerhaften Prozesses: 0xff4
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3

Error: (03/07/2014 11:35:49 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc6b7
Name des fehlerhaften Moduls: igdumd32.dll, Version: 8.15.10.2653, Zeitstempel: 0x4f3aab9f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0027d0d8
ID des fehlerhaften Prozesses: 0xf20
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3

Error: (03/06/2014 10:42:39 PM) (Source: Application Hang) (User: )
Description: Programm FacebookVideoCalling.exe, Version 2.0.0.447 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1518

Startzeit: 01cf397bc0b891d8

Endzeit: 29

Anwendungspfad: C:\Users\Recep\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe

Berichts-ID: 36fb048d-a56f-11e3-b352-b888e35c3cb4

Error: (03/04/2014 09:51:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 33.0.1750.117, Zeitstempel: 0x5305442b
Name des fehlerhaften Moduls: SPVC32Loader.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52f38c73
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7011272b
ID des fehlerhaften Prozesses: 0xeac
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (02/28/2014 07:25:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 33.0.1750.117, Zeitstempel: 0x5305442b
Name des fehlerhaften Moduls: SPVC32Loader.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52f38c73
Ausnahmecode: 0xc0000005
Fehleroffset: 0x6e87272b
ID des fehlerhaften Prozesses: 0x240
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (02/28/2014 06:19:20 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070003

Error: (02/17/2014 04:59:49 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.10.20.64, Zeitstempel: 0x52f38d32
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x005895c0
ID des fehlerhaften Prozesses: 0xa1c
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3

Error: (02/03/2014 02:11:42 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: f10

Startzeit: 01cf20d84f98ff54

Endzeit: 62

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID:


System errors:
=============
Error: (04/05/2014 02:32:12 PM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}

Error: (04/05/2014 02:31:42 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Google Update-Dienst (gupdate)" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Anwendungserfahrung" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1115

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Enumeratordienst für tragbare Geräte" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1115

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerkverbindungen" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1115

Error: (03/27/2014 00:30:13 AM) (Source: DCOM) (User: )
Description: 1115netman{BA126AD1-2166-11D1-B1D0-00805FC1270E}

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WdiServiceHost" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%50

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "netprofm" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1352

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).


Microsoft Office Sessions:
=========================
Error: (03/07/2014 11:54:12 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bc6b7igdumd32.dll8.15.10.26534f3aab9fc00000050027d0d8b1401cf3a4f29d3d420C:\Windows\system32\DllHost.exeC:\Windows\system32\igdumd32.dll03f52d08-a643-11e3-b2f1-b888e35c3cb4

Error: (03/07/2014 11:49:36 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bc6b7igdumd32.dll8.15.10.26534f3aab9fc00000050027d0d8dc401cf3a4e89920f8eC:\Windows\system32\DllHost.exeC:\Windows\system32\igdumd32.dll5f6971d2-a642-11e3-b2f1-b888e35c3cb4

Error: (03/07/2014 11:45:10 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bc6b7igdumd32.dll8.15.10.26534f3aab9fc00000050027d0d8ff401cf3a4e638f162dC:\Windows\system32\DllHost.exeC:\Windows\system32\igdumd32.dllc0ddaa72-a641-11e3-b2f1-b888e35c3cb4

Error: (03/07/2014 11:35:49 PM) (Source: Application Error)(User: )
Description: DllHost.exe6.1.7600.163854a5bc6b7igdumd32.dll8.15.10.26534f3aab9fc00000050027d0d8f2001cf3a4d33346615C:\Windows\system32\DllHost.exeC:\Windows\system32\igdumd32.dll72c4284d-a640-11e3-b2f1-b888e35c3cb4

Error: (03/06/2014 10:42:39 PM) (Source: Application Hang)(User: )
Description: FacebookVideoCalling.exe2.0.0.447151801cf397bc0b891d829C:\Users\Recep\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe36fb048d-a56f-11e3-b352-b888e35c3cb4

Error: (03/04/2014 09:51:55 PM) (Source: Application Error)(User: )
Description: chrome.exe33.0.1750.1175305442bSPVC32Loader.dll_unloaded0.0.0.052f38c73c00000057011272beac01cf37e26c4df824C:\Program Files\Google\Chrome\Application\chrome.exeSPVC32Loader.dll6f9e9375-a3d6-11e3-b3d1-b888e35c3cb4

Error: (02/28/2014 07:25:55 PM) (Source: Application Error)(User: )
Description: chrome.exe33.0.1750.1175305442bSPVC32Loader.dll_unloaded0.0.0.052f38c73c00000056e87272b24001cf34a968e85626C:\Program Files\Google\Chrome\Application\chrome.exeSPVC32Loader.dll60a02d0f-a09d-11e3-b303-b888e35c3cb4

Error: (02/28/2014 06:19:20 PM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070003 
mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

Error: (02/17/2014 04:59:49 PM) (Source: Application Error)(User: )
Description: cltmngui.exe2.10.20.6452f38d32unknown0.0.0.000000000c0000005005895c0a1c01cf2bf0c32782e1C:\PROGRA~1\SearchProtect\UI\bin\cltmngui.exeunknown2570c159-97e4-11e3-b34f-b888e35c3cb4

Error: (02/03/2014 02:11:42 PM) (Source: Application Hang)(User: )
Description: iexplore.exe11.0.9600.16428f1001cf20d84f98ff5462C:\Program Files\Internet Explorer\iexplore.exe


==================== Memory info =========================== 

Percentage of memory in use: 47%
Total physical RAM: 2642.36 MB
Available physical RAM: 1374.63 MB
Total Pagefile: 5283.01 MB
Available Pagefile: 3923.29 MB
Total Virtual: 2047.88 MB
Available Virtual: 1910.32 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:149.05 GB) (Free:107.74 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: 98CD3C36)
Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-12 18:30:38
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK1646GSX rev.LB114C 149,05GB
Running: Gmer-19357.exe; Driver: C:\Users\Recep\AppData\Local\Temp\uglorpow.sys


---- System - GMER 2.1 ----

SSDT   93C539D6                                  ZwCreateSection
SSDT   93C539E0                                  ZwRequestWaitReplyPort
SSDT   93C539DB                                  ZwSetContextThread
SSDT   93C539E5                                  ZwSetSecurityObject
SSDT   93C539EA                                  ZwSystemDebugControl
SSDT   93C53977                                  ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text  ntkrnlpa.exe!ZwRollbackEnlistment + 142D  82C5BA15 1 Byte  [06]
.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2    82C95212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text  ntkrnlpa.exe!KeRemoveQueueEx + 11F7       82C9C58C 4 Bytes  [D6, 39, C5, 93] {SALC ; CMP EBP, EAX; XCHG EBX, EAX}
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1553       82C9C8E8 4 Bytes  [E0, 39, C5, 93]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1597       82C9C92C 4 Bytes  [DB, 39, C5, 93]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1613       82C9C9A8 4 Bytes  [E5, 39, C5, 93]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1667       82C9C9FC 4 Bytes  JMP B793C539 
.text  ...                                       

---- EOF - GMER 2.1 ----