Windows 7: Webseiten werden auf Werbung umgeleitet

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:31 on 08/05/2014 (Oliver)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-05-2014 01
Ran by XXXXX (administrator) on XXXXX-PC on 08-05-2014 20:33:07
Running from C:\Users\XXXXX\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(CrypKey (Canada) Ltd.) C:\Windows\System32\Crypserv.exe
() C:\Windows\System32\cndial32.exe
() C:\Windows\System32\DlProtectSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(ASUS) C:\Windows\AsScrPro.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
() C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\ProgramData\dlprotect.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(asus) C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\XXXXX\Desktop\Defogger.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDWare] => C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-06-10] (ELAN Microelectronic Corp.)
HKLM\...\Run: [ASUS WebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [1754448 2010-03-16] ()
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2103912 2010-07-22] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-05-03] (Alcor Micro Corp.)
HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1928976 2010-03-05] (Intel(R) Corporation)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM-x32\...\Run: [RemoteControl9] => C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2010-02-24] (cyberlink)
HKLM-x32\...\Run: [UpdatePSTShortCut] => C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2010-06-25] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateLBPShortCut] => C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [6806144 2010-06-25] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-04-26] ()
HKLM-x32\...\Run: [ASUS VIBE] => C:\Program Files (x86)\ASUS\ASUS VIBE\ASUS VIBE.exe [102400 2010-03-02] (ecm)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-03-11] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Download Protect] => C:\ProgramData\dlprotect.exe [12800 2014-05-04] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2319975947-2091509605-1812867878-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-11-02] (Google Inc.)
HKU\S-1-5-21-2319975947-2091509605-1812867878-1001\...\Run: [360Amigo] => C:\Program files\360Amigo\360Amigo.exe [5356320 2012-03-28] (360Amigo)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [111720 2010-07-26] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [100968 2010-07-26] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk
ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?gd=&ctid=CT3320324&octid=EB_ORIGINAL_CTID&ISID=MA21DDB9C-9DE7-437F-A8FC-093010462ECE&SearchSource=55&CUI=&UM=5&UP=SPB436C6AC-CC74-417E-9A70-D65FB97BD895&SSPV=
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=109958&tt=190712_ctrl_2912_5&babsrc=SP_ss&mntrId=78da6c160000000000000026c7ac319b
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=SPC2&o=15000&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=PV&apn_dtid=YYYYYYYYDE&apn_uid=96802F39-D5A5-4458-9332-08EB362B6E22&apn_sauid=6CC1219B-FEDD-48DA-BF06-6FDDB2F7F274
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
BHO-x32: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\2xpl5hn3.default-1390946476844
FF user.js: detected! => C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\2xpl5hn3.default-1390946476844\user.js
FF SelectedSearchEngine: Google
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_95.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_95.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\2xpl5hn3.default-1390946476844\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\2xpl5hn3.default-1390946476844\Extensions\2020Player_IKEA@2020Technologies.com [2014-03-16]
FF Extension: PSHD-9.9 - C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\2xpl5hn3.default-1390946476844\Extensions\a54e453c-130a-4769-9333-c5ec2aa914c5@9bd7cc89-9c7c-44e9-a03b-042b92d363f0.com [2014-05-04]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-03-30]

==================== Services (Whitelisted) =================

R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1012280 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896592 2014-03-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-03-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-03-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-03-11] (Avira Operations GmbH & Co. KG)
R2 CrypKey License; C:\Windows\system32\crypserv.exe [126976 2010-03-18] (CrypKey (Canada) Ltd.)
R2 dialer64; C:\Windows\system32\cndial32.exe [120832 2014-05-04] ()
R2 DlProtectSvc; C:\Windows\System32\DlProtectSvc.exe [124928 2014-05-04] ()
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()
R3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-04-06] ()

==================== Drivers (Whitelisted) ====================

R1 AmgHips; C:\Windows\System32\Drivers\AmgHips.sys [31008 2012-03-28] ()
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-08-05] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-08-05] (Avira GmbH)
R1 avfwot; C:\Windows\SysWOW64\DRIVERS\avfwot.sys [131336 2011-06-30] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R1 NetworkX; C:\Windows\System32\ckldrv.sys [30272 2010-03-19] ()
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-08-06] ()
R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files (x86)\Cyberlink\PowerDVD9\000.fcl [146928 2010-02-24] (CyberLink Corp.)
U3 tmlwf; 
U3 tmwfp; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-08 20:33 - 2014-05-08 20:33 - 00017648 _____ () C:\Users\XXXXX\Desktop\FRST.txt
2014-05-08 20:32 - 2014-05-08 20:33 - 00000000 ____D () C:\FRST
2014-05-08 20:31 - 2014-05-08 20:31 - 00000474 _____ () C:\Users\XXXXX\Desktop\defogger_disable.log
2014-05-08 20:31 - 2014-05-08 20:31 - 00000000 _____ () C:\Users\XXXXX\defogger_reenable
2014-05-08 20:30 - 2014-05-08 13:24 - 00380416 _____ () C:\Users\XXXXX\Desktop\Gmer-19357.exe
2014-05-08 20:30 - 2014-05-08 13:23 - 02063872 _____ (Farbar) C:\Users\XXXXX\Desktop\FRST64.exe
2014-05-08 20:30 - 2014-05-08 13:22 - 00050477 _____ () C:\Users\XXXXX\Desktop\Defogger.exe
2014-05-07 22:54 - 2014-05-08 20:30 - 00000853 _____ () C:\Windows\setupact.log
2014-05-07 22:54 - 2014-05-07 22:54 - 00002858 _____ () C:\Windows\PFRO.log
2014-05-07 22:54 - 2014-05-07 22:54 - 00000162 _____ () C:\Windows\errord.log
2014-05-07 22:54 - 2014-05-07 22:54 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-07 22:53 - 2014-05-07 22:55 - 00000508 _____ () C:\Windows\error.log
2014-05-07 22:31 - 2014-05-07 22:31 - 00000000 ____D () C:\Program Files (x86)\MediaPlayerplus
2014-05-07 22:30 - 2014-05-08 20:15 - 00001478 _____ () C:\Windows\Tasks\9c402e05-3dbb-480c-ac63-356184b4cc5b-5.job
2014-05-07 22:30 - 2014-05-07 22:30 - 00004508 _____ () C:\Windows\System32\Tasks\9c402e05-3dbb-480c-ac63-356184b4cc5b-5
2014-05-07 22:30 - 2014-05-07 22:30 - 00000000 ____D () C:\Program Files (x86)\Freeven pro 1.2
2014-05-07 22:28 - 2014-05-07 22:28 - 00614496 _____ () C:\Users\XXXXX\Downloads\Setup.exe
2014-05-07 20:25 - 2014-05-07 20:25 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-07 20:23 - 2014-05-07 20:23 - 19151024 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-06 21:37 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-06 21:37 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-04 23:16 - 2014-05-04 23:16 - 00001170 _____ () C:\Users\XXXXX\Desktop\100 Euro Guthaben.lnk
2014-05-04 23:16 - 2014-05-04 23:16 - 00000000 ____D () C:\Users\XXXXX\AppData\Roaming\dlg
2014-05-04 23:15 - 2014-05-08 20:15 - 00003108 _____ () C:\Windows\Tasks\060489a5-6909-4c45-b002-aad097050531-3.job
2014-05-04 23:15 - 2014-05-08 20:15 - 00002136 _____ () C:\Windows\Tasks\060489a5-6909-4c45-b002-aad097050531-4.job
2014-05-04 23:15 - 2014-05-08 20:15 - 00001442 _____ () C:\Windows\Tasks\060489a5-6909-4c45-b002-aad097050531-5.job
2014-05-04 23:15 - 2014-05-06 21:35 - 00000000 ____D () C:\Program Files (x86)\PSHD-9.9
2014-05-04 23:15 - 2014-05-04 23:15 - 00006138 _____ () C:\Windows\System32\Tasks\060489a5-6909-4c45-b002-aad097050531-3
2014-05-04 23:15 - 2014-05-04 23:15 - 00005166 _____ () C:\Windows\System32\Tasks\060489a5-6909-4c45-b002-aad097050531-4
2014-05-04 23:15 - 2014-05-04 23:15 - 00004472 _____ () C:\Windows\System32\Tasks\060489a5-6909-4c45-b002-aad097050531-5
2014-05-04 23:15 - 2014-05-04 23:15 - 00000000 ____D () C:\Program Files (x86)\SparPilotAddon
2014-05-04 23:14 - 2014-05-04 23:14 - 00124928 _____ () C:\Windows\system32\DlProtectSvc.exe
2014-05-04 23:14 - 2014-05-04 23:14 - 00120832 _____ () C:\Windows\system32\cndial32.exe
2014-05-04 23:14 - 2014-05-04 23:14 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-05-04 23:10 - 2014-05-04 23:10 - 00462976 _____ () C:\Users\XXXXX\Downloads\ccleaner.exe
2014-05-03 23:50 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 23:50 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 23:50 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 23:50 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-30 09:07 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-30 09:07 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-30 09:07 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-30 09:07 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-30 09:06 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-30 09:06 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-30 09:06 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-30 09:06 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-30 09:06 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-30 09:06 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-30 09:06 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-30 09:06 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-30 09:06 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-30 09:06 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-30 09:06 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-30 09:06 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-30 09:06 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-30 09:06 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-30 09:06 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-30 09:06 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-30 09:06 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-30 09:06 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-30 09:06 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-30 09:06 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-30 09:06 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-30 09:06 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-30 09:06 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-30 09:06 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-30 09:06 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-30 09:06 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-30 09:06 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-30 09:06 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-30 09:06 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-30 09:06 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-30 09:06 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-30 09:06 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-30 09:06 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-30 09:06 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-30 09:06 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-30 09:06 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-30 09:06 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-30 09:06 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-30 09:06 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-30 09:06 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 20:14 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 20:14 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 20:14 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 20:14 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 20:14 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 20:14 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 20:14 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 20:14 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 20:14 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 20:14 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 20:14 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 20:14 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 20:14 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 20:14 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 20:14 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 20:14 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 20:14 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2014-05-08 20:33 - 2014-05-08 20:33 - 00017648 _____ () C:\Users\XXXXX\Desktop\FRST.txt
2014-05-08 20:33 - 2014-05-08 20:32 - 00000000 ____D () C:\FRST
2014-05-08 20:31 - 2014-05-08 20:31 - 00000474 _____ () C:\Users\XXXXX\Desktop\defogger_disable.log
2014-05-08 20:31 - 2014-05-08 20:31 - 00000000 _____ () C:\Users\XXXXX\defogger_reenable
2014-05-08 20:31 - 2011-03-19 22:09 - 00000000 ____D () C:\Users\XXXXX
2014-05-08 20:31 - 2009-08-04 11:51 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-05-08 20:31 - 2009-08-04 11:51 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-05-08 20:31 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-08 20:30 - 2014-05-07 22:54 - 00000853 _____ () C:\Windows\setupact.log
2014-05-08 20:25 - 2011-08-13 15:28 - 01326951 _____ () C:\Windows\WindowsUpdate.log
2014-05-08 20:15 - 2014-05-07 22:30 - 00001478 _____ () C:\Windows\Tasks\9c402e05-3dbb-480c-ac63-356184b4cc5b-5.job
2014-05-08 20:15 - 2014-05-04 23:15 - 00003108 _____ () C:\Windows\Tasks\060489a5-6909-4c45-b002-aad097050531-3.job
2014-05-08 20:15 - 2014-05-04 23:15 - 00002136 _____ () C:\Windows\Tasks\060489a5-6909-4c45-b002-aad097050531-4.job
2014-05-08 20:15 - 2014-05-04 23:15 - 00001442 _____ () C:\Windows\Tasks\060489a5-6909-4c45-b002-aad097050531-5.job
2014-05-08 20:15 - 2012-12-16 01:00 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-08 13:24 - 2014-05-08 20:30 - 00380416 _____ () C:\Users\XXXXX\Desktop\Gmer-19357.exe
2014-05-08 13:23 - 2014-05-08 20:30 - 02063872 _____ (Farbar) C:\Users\XXXXX\Desktop\FRST64.exe
2014-05-08 13:22 - 2014-05-08 20:30 - 00050477 _____ () C:\Users\XXXXX\Desktop\Defogger.exe
2014-05-07 23:02 - 2009-07-14 06:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-07 23:02 - 2009-07-14 06:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-07 22:55 - 2014-05-07 22:53 - 00000508 _____ () C:\Windows\error.log
2014-05-07 22:55 - 2009-07-14 04:34 - 00000498 _____ () C:\Windows\win.ini
2014-05-07 22:54 - 2014-05-07 22:54 - 00002858 _____ () C:\Windows\PFRO.log
2014-05-07 22:54 - 2014-05-07 22:54 - 00000162 _____ () C:\Windows\errord.log
2014-05-07 22:54 - 2014-05-07 22:54 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-07 22:54 - 2011-03-19 22:10 - 00045056 _____ () C:\Windows\system32\acovcnt.exe
2014-05-07 22:54 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-07 22:31 - 2014-05-07 22:31 - 00000000 ____D () C:\Program Files (x86)\MediaPlayerplus
2014-05-07 22:30 - 2014-05-07 22:30 - 00004508 _____ () C:\Windows\System32\Tasks\9c402e05-3dbb-480c-ac63-356184b4cc5b-5
2014-05-07 22:30 - 2014-05-07 22:30 - 00000000 ____D () C:\Program Files (x86)\Freeven pro 1.2
2014-05-07 22:28 - 2014-05-07 22:28 - 00614496 _____ () C:\Users\XXXXX\Downloads\Setup.exe
2014-05-07 21:15 - 2011-12-11 22:59 - 00000000 ____D () C:\Windows\Minidump
2014-05-07 20:25 - 2014-05-07 20:25 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-07 20:24 - 2012-12-16 01:00 - 00698032 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-07 20:24 - 2012-12-16 01:00 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-07 20:24 - 2012-12-09 14:39 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-07 20:23 - 2014-05-07 20:23 - 19151024 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-06 21:35 - 2014-05-04 23:15 - 00000000 ____D () C:\Program Files (x86)\PSHD-9.9
2014-05-06 21:32 - 2010-11-02 18:59 - 00002088 _____ () C:\Windows\system32\AutoRunFilter.ini
2014-05-06 21:32 - 2010-11-02 18:59 - 00001411 _____ () C:\Windows\system32\ServiceFilter.ini
2014-05-04 23:16 - 2014-05-04 23:16 - 00001170 _____ () C:\Users\XXXXX\Desktop\100 Euro Guthaben.lnk
2014-05-04 23:16 - 2014-05-04 23:16 - 00000000 ____D () C:\Users\XXXXX\AppData\Roaming\dlg
2014-05-04 23:16 - 2011-03-20 19:53 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-05-04 23:16 - 2011-03-20 19:53 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-04 23:15 - 2014-05-04 23:15 - 00006138 _____ () C:\Windows\System32\Tasks\060489a5-6909-4c45-b002-aad097050531-3
2014-05-04 23:15 - 2014-05-04 23:15 - 00005166 _____ () C:\Windows\System32\Tasks\060489a5-6909-4c45-b002-aad097050531-4
2014-05-04 23:15 - 2014-05-04 23:15 - 00004472 _____ () C:\Windows\System32\Tasks\060489a5-6909-4c45-b002-aad097050531-5
2014-05-04 23:15 - 2014-05-04 23:15 - 00000000 ____D () C:\Program Files (x86)\SparPilotAddon
2014-05-04 23:14 - 2014-05-04 23:14 - 00124928 _____ () C:\Windows\system32\DlProtectSvc.exe
2014-05-04 23:14 - 2014-05-04 23:14 - 00120832 _____ () C:\Windows\system32\cndial32.exe
2014-05-04 23:14 - 2014-05-04 23:14 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-05-04 23:10 - 2014-05-04 23:10 - 00462976 _____ () C:\Users\XXXXX\Downloads\ccleaner.exe
2014-04-30 17:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-29 16:01 - 2014-05-03 23:50 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 23:50 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-03 23:50 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 23:50 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-14 04:24 - 2014-05-06 21:37 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-05-06 21:37 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-11 21:47 - 2012-10-30 22:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-11 18:08 - 2011-03-25 17:34 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-11 18:07 - 2013-08-17 12:29 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-11 18:04 - 2011-03-25 07:44 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Files to move or delete:
====================
C:\ProgramData\dlprotect.exe


Some content of TEMP:
====================
C:\Users\XXXXX\AppData\Local\Temp\avgnt.exe
C:\Users\XXXXX\AppData\Local\Temp\nshC1F5.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-02 12:27

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-05-2014 01
Ran by Oliver at 2014-05-08 20:33:46
Running from C:\Users\Oliver\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
360Amigo System Speedup Free (HKLM-x32\...\360Amigo) (Version: 1.2.1.7900 - 360Amigo System SpeedUp)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.95 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.95 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{1F7424F8-F992-48BC-90EF-7C4DB0405E3F}) (Version: 1.7.17.25416 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.7.17.25416 - Alcor Micro Corp.) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
ASUS AI Recovery (HKLM-x32\...\{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}) (Version: 1.0.10 - ASUS)
ASUS AP Bank (HKLM-x32\...\ASUS AP Bank_is1) (Version: 1.0.0.0 - ASUSTEK)
ASUS FancyStart (HKLM-x32\...\{2B81872B-A054-48DA-BE3B-FA5C164C303A}) (Version: 1.0.8 - ASUSTeK Computer Inc.)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.20 - ASUS)
ASUS Live Update (HKLM-x32\...\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}) (Version: 2.5.9 - ASUS)
ASUS MultiFrame (HKLM-x32\...\{9D48531D-2135-49FC-BC29-ACCDA5396A76}) (Version: 1.0.0021 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}) (Version: 1.1.37 - ASUS)
ASUS SmartLogon (HKLM-x32\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0008 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.02.0029 - ASUS)
ASUS VIBE (HKLM-x32\...\ASUS VIBE) (Version: 1.0.182 - Ecareme, Inc.)
ASUS Video Magic (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.4015 - CyberLink Corp.)
ASUS Video Magic (x32 Version: 6.0.4015 - CyberLink Corp.) Hidden
ASUS Virtual Camera (HKLM-x32\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.20 - asus)
ASUS WebStorage (HKLM-x32\...\ASUS WebStorage) (Version: 2.0.46.1429 - eCareme Technologies, Inc.)
ASUS_N3_Series (HKLM-x32\...\ASUS_N3_Series) (Version: 1.0.0001 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0005 - ASUS)
Avira Internet Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
BUDNI Fotowelt (HKLM-x32\...\BUDNI Fotowelt) (Version:  - )
Canon MG5200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 4.13 - Piriform)
Choice Guard (x32 Version: 1.2.87.0 - Microsoft Corporation) Hidden
CIB pdf brewer (HKLM\...\{E9E6A9B7-89B7-41D3-90A1-710E82427097}) (Version: 2.6.0034 - CIB software GmbH)
ControlDeck (HKLM-x32\...\{5B65EF64-1DFA-414A-8C94-7BB726158E21}) (Version: 1.0.8 - ASUS)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1908 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.1908 - CyberLink Corp.) Hidden
CyberLink MediaShow Espresso (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 5.0.1606_25588 - CyberLink Corp.)
CyberLink MediaShow Espresso (x32 Version: 5.0.1606_25588 - CyberLink Corp.) Hidden
CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.)
CyberLink PhotoNow (x32 Version: 1.1.6904 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 6.1.3602c - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.2609a - CyberLink Corp.)
CyberLink PowerDirector (x32 Version: 8.0.2609a - CyberLink Corp.) Hidden
CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.3009.50 - CyberLink Corp.)
CyberLink PowerDVD 9 (x32 Version: 9.0.3009.50 - CyberLink Corp.) Hidden
Download Protect (HKCU\...\{132401a7-2006-4342-b43c-ccf5f02c2b01}) (Version:  - Download Protect)
ebi.BookReader3J (HKLM-x32\...\{F3D2DEDC-4732-4188-8A3A-1A3FFBD4D6C8}) (Version: 3.75.14 - eBOOK Initiative Japan Co., Ltd.)
ElsterFormular-Upgrade (HKLM-x32\...\ElsterFormular für Privatanwender 12.2.0.6412p) (Version: 14.4.12044 - Landesfinanzdirektion Thüringen)
ETDWare PS/2-x64 7.0.5.13_WHQL (HKLM\...\Elantech) (Version: 7.0.5.13 - ELAN Microelectronics Corp.)
ExpressGate Cloud (HKLM-x32\...\InstallShield_{499DED08-6FA8-4749-8E94-8526CC9D1CA8}) (Version: 2.1.69.343 - Asus)
ExpressGate Cloud (x32 Version: 2.1.69.343 - Asus) Hidden
Fast Boot (HKLM\...\{13F4A7F3-EABC-4261-AF6B-1317777F0755}) (Version: 1.0.5 - ASUS)
Freeven pro 1.2 (HKLM-x32\...\Freeven pro 1.2) (Version: 1.34.5.4 - Freeven) <==== ATTENTION
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version:  - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2189 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{D16A2127-B927-4379-B153-3DEC091E4EEB}) (Version: 13.02.1000 - Intel Corporation)
Intel(R) Turbo Boost Technology Monitor (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.115.11 - Intel)
Intel(R) Wireless Display (HKLM\...\{C298FF86-AB23-4B58-AC53-A23383C07B3A}) (Version: 1.2.20.0 - Intel Corporation)
Junk Mail filter update (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
MediaPlayerplus (HKLM-x32\...\MediaPlayerplus) (Version: 1.34.5.4 - Freeven) <==== ATTENTION
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM-x32\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM-x32\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5912 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA Updatus (x32 Version: 1.0.3 - NVIDIA Corporation) Hidden
PM FASTrack v6 (HKLM-x32\...\PM FASTrack v6) (Version: 6.0.0 - RMC Project Management)
PSHD-9.9 (HKLM-x32\...\PSHD-9.9) (Version: 1.34.4.10 - PlusVHD)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6162 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.50 - Piriform)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.5.0 - SAMSUNG Electronics Co., Ltd.)
Smileyville FREE (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117396510}) (Version:  - Oberon Media)
SonicMaster (HKLM-x32\...\{09BCB9CE-964B-4BDA-AE46-B5A0ABEF1D3F}) (Version: 1.00.0000 - Virage Logic, Corp.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
syncables desktop SE (HKLM-x32\...\{341697D8-9923-445E-B42A-529E5A99CB7A}) (Version: 5.5.746.11492 - syncables)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878297) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{9B1DEEA3-B4ED-49F0-9EF7-4A820EEEA7F1}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
USB2.0 UVC VGA WebCam (HKLM\...\USB2.0 UVC VGA WebCam) (Version: 5.8.54000.207 - Sonix)
Windows Live Anmelde-Assistent (HKLM-x32\...\{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}) (Version: 5.000.818.6 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8052.1208 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8051.1204 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{8C1E2925-14F8-45AA-B999-1E2A74BF5607}) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.30.3 - ASUS)
Wireless Console 3 (HKLM-x32\...\{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}) (Version: 3.0.16 - ASUS)
Yahoo! Detect (HKLM-x32\...\YTdetect) (Version:  - )

==================== Restore Points  =========================

11-04-2014 15:59:16 Windows Update
30-04-2014 07:04:43 Windows Update
03-05-2014 21:48:35 Windows Update
07-05-2014 18:23:30 Windows Update
07-05-2014 20:30:52 Uniblue SpeedUpMyPC installation

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {12A86EA4-87DD-4F2F-ACD8-55F6097CDD1C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-04-17] (Piriform Ltd)
Task: {29864A4C-1610-42E6-A3D9-3875F8DB97DF} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-05-28] (ATK)
Task: {32CB9A6B-D194-4C5A-9870-3055EE58DFA0} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: {3874D81E-E581-4044-BB16-EB87AD1277E2} - System32\Tasks\060489a5-6909-4c45-b002-aad097050531-4 => C:\Program Files (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-4.exe
Task: {39C7AFFB-30A7-41B9-A1B8-6950326D036E} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31] (ASUS)
Task: {730C2B8E-9373-4FBD-83B5-203263B24D66} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2010-08-02] (ASUS)
Task: {A188FD0F-C606-4F98-9E9D-F1DD527C004F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-07] (Adobe Systems Incorporated)
Task: {A8967F05-644A-47F7-902A-AEB0DEE6B2B8} - System32\Tasks\060489a5-6909-4c45-b002-aad097050531-3 => C:\Program Files (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-3.exe [2014-05-04] (PlusVHD)
Task: {B24822A6-E444-49AC-B5C3-241342DAFA59} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {CBB055AE-531D-493A-ACBC-65413F4E0F14} - System32\Tasks\060489a5-6909-4c45-b002-aad097050531-5 => C:\Program Files (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-5.exe
Task: {D0D3A67C-2EC9-4A8C-83D7-4AB0301190A2} - System32\Tasks\9c402e05-3dbb-480c-ac63-356184b4cc5b-5 => C:\Program Files (x86)\Freeven pro 1.2\9c402e05-3dbb-480c-ac63-356184b4cc5b-5.exe [2014-05-07] (Freeven) <==== ATTENTION
Task: {DA21E825-B02A-4675-BE6B-D0206DB1016D} - System32\Tasks\P4G Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)
Task: {DDBD0AA8-232E-4053-8BB5-A1BF986FD60C} - System32\Tasks\ASUSControlDeck => C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe [2010-06-09] (asus)
Task: C:\Windows\Tasks\060489a5-6909-4c45-b002-aad097050531-3.job => C:\Program Files (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-3.exe
Task: C:\Windows\Tasks\060489a5-6909-4c45-b002-aad097050531-4.job => C:\Program Files (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-4.exe
Task: C:\Windows\Tasks\060489a5-6909-4c45-b002-aad097050531-5.job => C:\Program Files (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-5.exe
Task: C:\Windows\Tasks\9c402e05-3dbb-480c-ac63-356184b4cc5b-5.job => C:\Program Files (x86)\Freeven pro 1.2\9c402e05-3dbb-480c-ac63-356184b4cc5b-5.exe <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2010-03-05 18:21 - 2010-03-05 18:21 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2014-05-04 23:14 - 2014-05-04 23:14 - 00120832 _____ () C:\Windows\system32\cndial32.exe
2014-05-04 23:14 - 2014-05-04 23:14 - 00124928 _____ () C:\Windows\System32\DlProtectSvc.exe
2010-11-02 18:59 - 2007-11-30 20:20 - 00051768 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
2010-04-03 04:21 - 2008-10-01 08:08 - 00011264 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
2010-03-16 03:48 - 2010-03-16 03:48 - 00148816 _____ () C:\Program Files (x86)\ASUS\ASUS WebStorage\EcaremeDLL.dll
2010-11-02 18:28 - 2010-11-02 18:28 - 00030032 _____ () C:\Windows\assembly\GAC_MSIL\SqliteShared\1.0.3726.20828__0d0f4b69e50e559b\SqliteShared.dll
2010-11-02 18:28 - 2010-11-02 18:28 - 00931840 _____ () C:\Windows\assembly\GAC_64\System.Data.SQLite\1.0.60.0__db937bc2d44ff139\System.Data.SQLite.dll
2010-01-11 19:27 - 2010-01-11 19:27 - 00017920 _____ () C:\Program Files\P4G\DevMng.dll
2010-05-06 03:22 - 2010-05-06 03:22 - 00108544 _____ () C:\Program Files\P4G\OvrClk.dll
2010-11-02 18:17 - 2010-04-06 08:29 - 00244904 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2010-03-16 03:48 - 2010-03-16 03:48 - 01754448 _____ () C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
2010-03-05 18:21 - 2010-03-05 18:21 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2010-04-26 18:37 - 2010-04-26 18:37 - 01597440 _____ () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
2014-05-04 23:14 - 2014-05-04 23:14 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-05-08 20:30 - 2014-05-08 13:22 - 00050477 _____ () C:\Users\Oliver\Desktop\Defogger.exe
2013-08-05 20:49 - 2013-08-05 20:41 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-08-05 20:49 - 2011-10-11 21:03 - 00447848 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\libxml2.dll
2013-08-05 20:49 - 2011-10-11 21:03 - 00060264 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\cares.dll
2009-11-02 23:20 - 2009-11-02 23:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 23:23 - 2009-11-02 23:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2010-02-24 00:14 - 2010-02-24 00:14 - 00041472 _____ () C:\Program Files (x86)\ASUS\ControlDeck\HelpFunc.dll
2010-02-24 00:14 - 2010-02-24 00:14 - 00071680 _____ () C:\Program Files (x86)\ASUS\ControlDeck\Brightness.dll
2010-02-24 00:11 - 2010-02-24 00:11 - 00076288 _____ () C:\Program Files (x86)\ASUS\ControlDeck\Volume.dll
2010-02-24 00:12 - 2010-02-24 00:12 - 00186880 _____ () C:\Program Files (x86)\ASUS\ControlDeck\Resolution.dll
2010-02-24 00:14 - 2010-02-24 00:14 - 00050688 _____ () C:\Program Files (x86)\ASUS\ControlDeck\P4GControl.dll
2010-07-26 16:26 - 2010-07-26 16:26 - 00010856 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2014-03-30 10:10 - 2014-03-30 10:10 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe
MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: VOPackage => C:\Users\Oliver\AppData\Roaming\VOPackage\VOPackage.exe /runonce

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/07/2014 10:55:44 PM) (Source: Windows Search Service) (User: ) (EventID: 7010)
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/07/2014 10:55:44 PM) (Source: Windows Search Service) (User: ) (EventID: 3058)
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/07/2014 10:55:44 PM) (Source: Windows Search Service) (User: ) (EventID: 3028)
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/07/2014 10:55:44 PM) (Source: Windows Search Service) (User: ) (EventID: 3029)
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (05/07/2014 10:55:38 PM) (Source: Windows Search Service) (User: ) (EventID: 3029)
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/07/2014 10:55:38 PM) (Source: Windows Search Service) (User: ) (EventID: 9002)
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (05/07/2014 10:55:38 PM) (Source: Windows Search Service) (User: ) (EventID: 7042)
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/07/2014 10:55:38 PM) (Source: Windows Search Service) (User: ) (EventID: 7040)
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/07/2014 10:55:38 PM) (Source: Windows Search Service) (User: ) (EventID: 9000)
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.


Details:
	0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (05/07/2014 10:55:37 PM) (Source: ESENT) (User: ) (EventID: 455)
Description: Windows (5092) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00025.log.


System errors:
=============
Error: (05/08/2014 11:17:22 AM) (Source: ACPI) (User: ) (EventID: 10)
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.

Error: (05/08/2014 11:17:22 AM) (Source: ACPI) (User: ) (EventID: 10)
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.

Error: (05/08/2014 10:17:42 AM) (Source: ACPI) (User: ) (EventID: 10)
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.

Error: (05/08/2014 10:17:42 AM) (Source: ACPI) (User: ) (EventID: 10)
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.

Error: (05/07/2014 10:55:45 PM) (Source: Service Control Manager) (User: ) (EventID: 7031)
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/07/2014 10:55:45 PM) (Source: Service Control Manager) (User: ) (EventID: 7024)
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (05/07/2014 10:55:28 PM) (Source: DCOM) (User: NT-AUTORITÄT) (EventID: 10016)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (05/07/2014 03:51:51 AM) (Source: Service Control Manager) (User: ) (EventID: 7011)
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.

Error: (05/07/2014 03:51:51 AM) (Source: Service Control Manager) (User: ) (EventID: 7011)
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (05/06/2014 09:33:51 PM) (Source: Service Control Manager) (User: ) (EventID: 7031)
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (06/01/2013 10:57:27 AM) (Source: Microsoft Office 12 Sessions) (User: ) (EventID: 7001)
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 478223 seconds with 720 seconds of active time.  This session ended with a crash.

Error: (10/14/2012 01:25:49 PM) (Source: Microsoft Office 12 Sessions) (User: ) (EventID: 7001)
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 3230 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 47%
Total physical RAM: 3883.85 MB
Available physical RAM: 2040.79 MB
Total Pagefile: 7765.88 MB
Available Pagefile: 5278.72 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:149.05 GB) (Free:87.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:427.59 GB) (Free:427.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 76BC31A2)
Partition 1: (Not Active) - (Size=20 GB) - (Type=1C)
Partition 2: (Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=428 GB) - (Type=OF Extended)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-08 21:36:55
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD64 rev.01.0 596,17GB
Running: Gmer-19357.exe; Driver: C:\Users\Oliver\AppData\Local\Temp\ufdiapob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                           fffff80002fba000 45 bytes [00, 00, 00, 00, D8, 48, 85, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                           fffff80002fba02f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- Processes - GMER 2.1 ----

Process   C:\ProgramData\dlprotect.exe (*** suspicious ***) @ C:\ProgramData\dlprotect.exe [5084](2014-05-04 21:14:55)                                 0000000000400000

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{2250A694-E0B9-4B0A-A25C-C5BFF910CF36}\Connection@Name  isatap.{C1616C1E-C76A-4EC2-9935-CC8908DD80D0}
Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind     \Device\{2250A694-E0B9-4B0A-A25C-C5BFF910CF36}?\Device\{C23AB68D-898C-4DC4-96AE-41CC5C6E860E}?\Device\{14385820-EE09-4817-9259-1570D0325737}?\Device\{4BB046DB-33A9-41E3-9B26-4EA168EAD718}?
Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route    "{2250A694-E0B9-4B0A-A25C-C5BFF910CF36}"?"{C23AB68D-898C-4DC4-96AE-41CC5C6E860E}"?"{14385820-EE09-4817-9259-1570D0325737}"?"{4BB046DB-33A9-41E3-9B26-4EA168EAD718}"?
Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export   \Device\TCPIP6TUNNEL_{2250A694-E0B9-4B0A-A25C-C5BFF910CF36}?\Device\TCPIP6TUNNEL_{C23AB68D-898C-4DC4-96AE-41CC5C6E860E}?\Device\TCPIP6TUNNEL_{14385820-EE09-4817-9259-1570D0325737}?\Device\TCPIP6TUNNEL_{4BB046DB-33A9-41E3-9B26-4EA168EAD718}?
Reg       HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{2250A694-E0B9-4B0A-A25C-C5BFF910CF36}@InterfaceName                       isatap.{C1616C1E-C76A-4EC2-9935-CC8908DD80D0}
Reg       HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{2250A694-E0B9-4B0A-A25C-C5BFF910CF36}@ReusableType                        0

---- EOF - GMER 2.1 ----
         

Exportierte Ereignisse:

07.05.2014 22:31 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nsz82D3.tmp\489563'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2865' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:31 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nsz82D3.tmp\489563'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2865' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:31 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nsz82D3.tmp\489563'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2888' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:31 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nsz82D3.tmp\489563'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2888' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:31 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nsz82D3.tmp\489563'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2870' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:31 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nsz82D3.tmp\489563'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2870' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

07.05.2014 22:31 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nsz82D3.tmp\489563'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2875' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:31 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nsz82D3.tmp\489563'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2875' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:30 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nse18EA.tmp\271807'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2853' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:30 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nse18EA.tmp\271807'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2853' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:30 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nse18EA.tmp\271807'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2879' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:30 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nse18EA.tmp\271807'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2879' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

07.05.2014 22:30 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nse18EA.tmp\271807'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2855' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

07.05.2014 22:30 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nse18EA.tmp\271807'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2855' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

06.05.2014 21:35 [System-Scanner] Malware gefunden
      Die Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-5.exe'
      enthielt einen Virus oder unerwünschtes Programm 'Adware/CrossRider.A.2542' 
      [adware].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4d138531.qua' 
      verschoben!

06.05.2014 21:35 [System-Scanner] Malware gefunden
      Die Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-4.exe'
      enthielt einen Virus oder unerwünschtes Programm 'Adware/CrossRider.A.2592' 
      [adware].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5584aa97.qua' 
      verschoben!

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-5.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2542' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-4.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2592' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-5.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2542' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-4.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2592' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-5.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2542' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-4.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2592' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-5.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2542' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-4.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2592' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-5.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2542' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-4.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2592' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-5.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2542' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

06.05.2014 21:33 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files 
      (x86)\PSHD-9.9\060489a5-6909-4c45-b002-aad097050531-4.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.A.2592' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

04.05.2014 23:15 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nsyFB7A.tmp\493071'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.AC' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

04.05.2014 23:15 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Local\Temp\nsyFB7A.tmp\493071'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/CrossRider.AC' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

04.05.2014 23:14 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Roaming\Security System 2\data\serv.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

04.05.2014 23:14 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Roaming\Security System 2\data\serv.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

04.05.2014 23:14 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Roaming\Security System 2\data\serv.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben

04.05.2014 23:14 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\XXXXX\AppData\Roaming\Security System 2\data\serv.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AgentCV.A.3743' [adware] 
      gefunden.
      Ausgeführte Aktion: Zugriff erlauben