BMI, Polizei Virus, abgesicherter Modus fährt ohne Eingabemöglichkeit wieder runter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-01-2014 01 (ATTENTION: ====> FRST version is 81 days old and could be outdated)
Ran by SYSTEM on MININT-JNRO2HG on 17-04-2014 17:24:50
Running from H:\
Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [QlbCtrl.exe] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [288312 2009-07-28] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [PDF Complete] - C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-06-18] (PDF Complete Inc)
HKLM\...\Run: [WirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)
HKLM\...\Run: [HP Software Update] - c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-30] (Synaptics Incorporated)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-30] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [458844 2009-08-05] (IDT, Inc.)
HKLM\...\Run: [NortonOnlineBackupReminder] - C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [DATAMNGR] - C:\Program Files\Search Results Toolbar\Datamngr\datamngrUI.exe [1683456 2013-02-14] (Bandoo Media Inc)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM\...\runonceex: [ContentMerger] - c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\ContentMerger10.exe [19952 2009-06-13] (Sonic Solutions)
HKU\Bernhard Kager\...\Run: [Skype] - C:\Program Files\Skype\\Phone\Skype.exe [ 2009-06-02] (Skype Technologies S.A.)
HKU\Bernhard Kager\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2009-06-17] (Hewlett-Packard Company)
AppInit_DLLs: C:\PROGRA~2\Wincert\WIN32C~1.DLL => C:\ProgramData\Wincert\win32cert.dll [7168 2013-02-07] ()
AppInit_DLLs: C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll => C:\Program Files\Search Results Toolbar\Datamngr\datamngr.dll [1540096 2013-02-14] (Bandoo Media Inc)
AppInit_DLLs: C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll => C:\Program Files\Search Results Toolbar\Datamngr\IEBHO.dll [1189240 2013-02-14] (Bandoo Media Inc)
Startup: C:\Users\Bernhard Kager\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\alclvg8.lnk
ShortcutTarget: alclvg8.lnk -> C:\ProgramData\8gvlcla.gsa ()

========================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86224 2012-08-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110032 2012-08-07] (Avira Operations GmbH & Co. KG)
S2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [124928 2009-07-10] (Hewlett-Packard)
S2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-06-18] (PDF Complete Inc)
S2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_78abd0f66cc3a020\STacSV.exe [221266 2009-08-05] (IDT, Inc.)
S2 Winmgmt; C:\ProgramData\8gvlcla.gsa [114688 2014-03-24] ()

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83392 2012-08-07] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137928 2012-08-07] (Avira GmbH)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36000 2011-12-15] (Avira GmbH)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2010-02-22] (MBB Incorporated)
S3 MfeAVFK; C:\Windows\System32\drivers\MfeAVFK.sys [79816 2009-05-16] (McAfee, Inc.)
S3 MfeBOPK; C:\Windows\System32\drivers\MfeBOPK.sys [35272 2009-05-16] (McAfee, Inc.)
S1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [214024 2009-05-16] (McAfee, Inc.)
S3 MfeRKDK; C:\Windows\System32\drivers\MfeRKDK.sys [34248 2009-05-16] (McAfee, Inc.)
S1 mfetdik; C:\Windows\System32\drivers\mfetdik.sys [55336 2009-05-16] (McAfee, Inc.)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
S5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [208896 2010-08-31] (Huawei Technologies Co., Ltd.)
S5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [102784 2010-07-27] (Huawei Technologies Co., Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-17 17:24 - 2014-04-17 17:24 - 00000000 ____D C:\FRST
2014-03-24 00:05 - 2014-03-24 00:05 - 95027928 ____T C:\ProgramData\alclvg8.bbr
2014-03-24 00:05 - 2014-03-24 00:05 - 00114688 ____N C:\ProgramData\8gvlcla.gsa

==================== One Month Modified Files and Folders =======

2014-04-17 17:24 - 2014-04-17 17:24 - 00000000 ____D C:\FRST
2014-04-08 19:09 - 2009-07-14 05:39 - 00096428 _____ C:\Windows\setupact.log
2014-03-27 06:10 - 2009-07-14 05:34 - 00019760 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-27 06:10 - 2009-07-14 05:34 - 00019760 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-27 06:01 - 2012-02-14 04:55 - 01524133 _____ C:\Windows\WindowsUpdate.log
2014-03-27 05:40 - 2012-02-13 21:55 - 00107422 _____ C:\Windows\PFRO.log
2014-03-27 05:40 - 2012-02-13 21:09 - 00000000 ____D C:\Users\Bernhard Kager\AppData\Local\VirtualStore
2014-03-27 05:34 - 2010-01-08 00:21 - 00000000 ____D C:\ProgramData\PDFC
2014-03-24 00:05 - 2014-03-24 00:05 - 95027928 ____T C:\ProgramData\alclvg8.bbr
2014-03-24 00:05 - 2014-03-24 00:05 - 00114688 ____N C:\ProgramData\8gvlcla.gsa
2014-03-18 01:22 - 2012-07-03 23:06 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2014-03-18 01:22 - 2012-07-03 23:06 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Bernhard Kager\AppData\Local\Temp\AskSLib.dll
C:\Users\Bernhard Kager\AppData\Local\Temp\HPQSi.exe
C:\Users\Bernhard Kager\AppData\Local\Temp\installhelper.dll
C:\Users\Bernhard Kager\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_aih.exe
C:\Users\Bernhard Kager\AppData\Local\Temp\SRAssetsHelper.dll


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2014-02-23 05:45:43
Restore point made on: 2014-02-27 22:48:14
Restore point made on: 2014-03-02 06:50:05
Restore point made on: 2014-03-08 07:04:22
Restore point made on: 2014-03-11 03:00:45
Restore point made on: 2014-03-18 01:25:55
Restore point made on: 2014-03-22 15:21:01
Restore point made on: 2014-03-24 05:33:30
Restore point made on: 2014-03-27 05:29:59
Restore point made on: 2014-03-27 06:00:26
Restore point made on: 2014-03-27 06:00:31

==================== Memory info =========================== 

Percentage of memory in use: 52%
Total physical RAM: 764.87 MB
Available physical RAM: 362.04 MB
Total Pagefile: 764.87 MB
Available Pagefile: 361.09 MB
Total Virtual: 2047.88 MB
Available Virtual: 1929.64 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:131.75 GB) (Free:101.62 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_RECOVERY) (Fixed) (Total:15 GB) (Free:6.64 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.92 GB) FAT32
Drive h: (KINGSTON) (Removable) (Total:1.86 GB) (Free:1.67 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.29 GB) (Free:0.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: 8AB6F604)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=132 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 04030201)
Partition 1: (Not Active) - (Size=2 GB) - (Type=06)


LastRegBack: 2014-03-26 23:48

==================== End Of Log ============================