Windows XP : Windows Explorer öffnet Werbung

Jona333

Hallo liebes TB-Team,
mein Problem ist, dass sich mein Windows Explorer ständig öffnet und Werbung, von mir unbekannten Seiten, öffnet. Er öffnet auch oft mehere Tabs gleichzeitig mit Werbung. Mein AVG-Antivirusprogramm meldet auch ständig das Trojaner gefunden worden.

defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:16 on 01/07/2014 (User)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


FRST:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:29-06-2014
Ran by User (administrator) on HOME-PC on 01-07-2014 23:20:18
Running from C:\Dokumente und Einstellungen\User\Eigene Dateien\Downloads
Platform: Microsoft Windows XP Professional Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 6
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2014\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Programme\AVG\AVG2014\avgcsrvx.exe
() C:\WINDOWS\system32\WLTRYSVC.EXE
(Dell Inc.) C:\WINDOWS\system32\BCMWLTRY.EXE
(AVG) C:\Programme\AVG\AVG PC Tuneup 2011\BoostSpeed.exe
(AVG Technologies CZ, s.r.o.) C:\Programme\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Programme\AVG\AVG2014\avgwdsvc.exe
(Sun Microsystems, Inc.) C:\Programme\Java\jre6\bin\jqs.exe
(AVG Secure Search) C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\18.1.7\ToolbarUpdater.exe
() C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\18.1.7\loggingserver.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(AVG Technologies CZ, s.r.o.) C:\Programme\AVG\AVG2014\avgnsx.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(SigmaTel, Inc.) C:\Programme\SigmaTel\C-Major Audio\WDM\stsystra.exe
(Dell Inc.) C:\WINDOWS\system32\WLTRAY.EXE
(Alps Electric Co., Ltd.) C:\Programme\Apoint\Apoint.exe
() C:\Programme\AVG Secure Search\vprot.exe
(Sun Microsystems, Inc.) C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
(shbox.de) C:\Programme\FreePDF_XP\fpassist.exe
(Alps Electric Co., Ltd.) C:\Programme\Apoint\hidfind.exe
(Alps Electric Co., Ltd.) C:\Programme\Apoint\ApntEx.exe
(Samsung Electronics Co., Ltd.) C:\Programme\Samsung\Kies\KiesTrayAgent.exe
(AVG Technologies CZ, s.r.o.) C:\Programme\AVG\AVG2014\avgui.exe
(Spotify Ltd) C:\Dokumente und Einstellungen\User\Anwendungsdaten\Spotify\Data\SpotifyWebHelper.exe
(Samsung) C:\Programme\Samsung\Kies\Kies.exe
(BVRP Software) C:\Programme\Digital Line Detect\DLG.exe
(Dropbox, Inc.) C:\Dokumente und Einstellungen\User\Anwendungsdaten\Dropbox\bin\Dropbox.exe
(OpenOffice.org) C:\Programme\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Programme\OpenOffice.org 3\program\soffice.bin
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SigmatelSysTrayApp] => C:\Programme\SigmaTel\C-Major Audio\WDM\stsystra.exe [405504 2007-05-10] (SigmaTel, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\WINDOWS\system32\WLTRAY.exe [2498560 2009-10-07] (Dell Inc.)
HKLM\...\Run: [Apoint] => C:\Programme\Apoint\Apoint.exe [176128 2005-10-07] (Alps Electric Co., Ltd.)
HKLM\...\Run: [BluetoothAuthenticationAgent] => rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
HKLM\...\Run: [vProt] => C:\Programme\AVG Secure Search\vprot.exe [2571288 2014-06-23] ()
HKLM\...\Run: [SunJavaUpdateSched] => C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k
HKLM\...\Run: [FreePDF Assistant] => C:\Programme\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe [40368 2009-12-18] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-09-21] (Adobe Systems Incorporated)
HKLM\...\Run: [KiesTrayAgent] => C:\Programme\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-14] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [AVG_UI] => C:\Programme\AVG\AVG2014\avgui.exe [5181456 2014-05-13] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-21-790525478-115176313-725345543-1003\...\Run: [Spotify] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Spotify\Spotify.exe [6189624 2014-06-27] (Spotify Ltd)
HKU\S-1-5-21-790525478-115176313-725345543-1003\...\Run: [Spotify Web Helper] => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-06-27] (Spotify Ltd)
HKU\S-1-5-21-790525478-115176313-725345543-1003\...\Run: [KiesPreload] => C:\Programme\Samsung\Kies\Kies.exe [1564992 2014-02-14] (Samsung)
HKU\S-1-5-21-790525478-115176313-725345543-1003\...\Run: [KiesAirMessage] => C:\Programme\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-790525478-115176313-725345543-500\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] => C:\Programme\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe [1266712 2013-06-03] (AVG Secure Search)
HKU\S-1-5-21-790525478-115176313-725345543-500\...\Policies\Explorer: [NoCDBurning] 1
HKU\S-1-5-21-790525478-115176313-725345543-500\...\Policies\Explorer: [NoRecentDocsMenu] 1
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Programme\Digital Line Detect\DLG.exe (BVRP Software)
Startup: C:\Dokumente und Einstellungen\User\Startmenü\Programme\Autostart\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Dokumente und Einstellungen\User\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Dokumente und Einstellungen\User\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
BootExecute: autocheck autochk * C:\PROGRA~1\AVG\AVG2014\avgrsx.exe /sync /restart

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={6C3A6348-0B3D-450D-BA35-D5647587392D}&mid=426bd45c2ab047d1bddad1532d1b45b6-6868903894a809d08089c443b513b5f5c6e71fbe&lang=de&ds=AVG&pr=fr&d=2011-10-12 11:11:01&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={6C3A6348-0B3D-450D-BA35-D5647587392D}&mid=426bd45c2ab047d1bddad1532d1b45b6-6868903894a809d08089c443b513b5f5c6e71fbe&lang=de&ds=AVG&pr=fr&d=2011-10-12 11:11:01&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG2012\avgssie.dll No File
BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\18.1.7.644\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\18.1.7.644\AVG Secure Search_toolbar.dll (AVG Secure Search)
Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG2012\avgpp.dll No File
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Programme\Gemeinsame Dateien\AVG Secure Search\ViProtocolInstaller\18.1.7\ViProtocol.dll (AVG Secure Search)

Hosts: Hosts file not detected in the default directory
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\14poc7dh.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Programme\Gemeinsame Dateien\AVG Secure Search\SiteSafetyInstaller\18.1.7\\npsitesafety.dll No File
FF Plugin: @java.com/JavaPlugin - C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Programme\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF user.js: detected! => C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\14poc7dh.default\user.js
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FileZilla - C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\14poc7dh.default\Extensions\client@filezilla.org [2011-10-13]
FF Extension: Yahoo! Toolbar - C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\14poc7dh.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2014-06-11]
FF Extension: Adblock Plus - C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\14poc7dh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-06]
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programme\Java\jre6\lib\deploy\jqs\ff [2011-11-23]
FF HKLM\...\Firefox\Extensions: [avg@toolbar] - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Secure Search\FireFoxExt\18.1.7.644
FF Extension: AVG Security Toolbar - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Secure Search\FireFoxExt\18.1.7.644 [2014-06-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-10-21]

========================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Programme\AVG\AVG2014\avgidsagent.exe [3644432 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Programme\AVG\AVG2014\avgwdsvc.exe [292424 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 JavaQuickStarterService; C:\Programme\Java\jre6\bin\jqs.exe [153376 2011-11-23] (Sun Microsystems, Inc.)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [119408 2014-06-11] (Mozilla Foundation)
S3 odserv; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [441136 2006-10-26] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S3 TUWinStylerThemeSvc; C:\Programme\TuneUpUtilities2006\WinStylerThemeSvc.exe [118272 2005-08-24] (TuneUp Software GmbH) [File not signed]
R2 vToolbarUpdater18.1.7; C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\18.1.7\ToolbarUpdater.exe [1813528 2014-06-23] (AVG Secure Search)
R2 wltrysvc; C:\WINDOWS\System32\bcmwltry.exe [2232320 2009-10-07] (Dell Inc.) [File not signed]
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [829440 2006-05-10] (Microsoft Corporation)
S2 AMService; C:\WINDOWS\TEMP\jecynt\setup.exe run [X]

==================== Drivers (Whitelisted) ====================

R1 Avgdiskx; C:\WINDOWS\System32\DRIVERS\avgdiskx.sys [122136 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\WINDOWS\System32\DRIVERS\avgidsdriverx.sys [198936 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\WINDOWS\System32\DRIVERS\avgidshx.sys [149784 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\WINDOWS\System32\DRIVERS\avgidsshimx.sys [21272 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\WINDOWS\System32\DRIVERS\avgldx86.sys [192280 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\WINDOWS\System32\DRIVERS\avglogx.sys [237848 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\WINDOWS\System32\DRIVERS\avgmfx86.sys [107288 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\WINDOWS\System32\DRIVERS\avgrkx86.sys [27416 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\WINDOWS\System32\DRIVERS\avgtdix.sys [210200 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [42784 2014-06-23] (AVG Technologies)
R3 BCM43XX; C:\WINDOWS\System32\DRIVERS\bcmwl5.sys [2649216 2009-10-07] (Broadcom Corporation)
R2 BCMWLNPF; C:\WINDOWS\System32\drivers\bcmwlnpf.sys [33664 2009-10-07] (CACE Technologies) [File not signed]
S3 Secdrv; C:\WINDOWS\System32\DRIVERS\secdrv.sys [27440 2006-06-01] ()
R3 STHDA; C:\WINDOWS\System32\drivers\sthda.sys [1222840 2007-05-10] (SigmaTel, Inc.)
S4 IntelIde; No ImagePath
U1 WS2IFSL;
U3 kxtdipow; \??\C:\DOKUME~1\User\LOKALE~1\Temp\kxtdipow.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-01 22:23 - 2014-07-01 23:20 - 00000000 ____D () C:\FRST
2014-07-01 22:14 - 2014-07-01 22:14 - 00000000 _____ () C:\Dokumente und Einstellungen\User\defogger_reenable
2014-06-19 22:43 - 2014-04-11 10:39 - 00184192 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\WINDOWS\system32\Drivers\ssudmdm.sys
2014-06-19 22:43 - 2014-04-11 10:39 - 00089856 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\WINDOWS\system32\Drivers\ssudbus.sys
2014-06-11 11:04 - 2014-06-11 11:05 - 00000000 ____D () C:\Programme\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-07-01 23:20 - 2014-07-01 22:23 - 00000000 ____D () C:\FRST
2014-07-01 23:20 - 2011-10-12 13:52 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2014-07-01 23:20 - 2011-07-20 07:38 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp
2014-07-01 22:14 - 2014-07-01 22:14 - 00000000 _____ () C:\Dokumente und Einstellungen\User\defogger_reenable
2014-07-01 21:52 - 2013-08-07 21:18 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Spotify
2014-07-01 21:50 - 2013-08-07 21:19 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Spotify
2014-07-01 21:15 - 2011-10-12 11:06 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MFAData
2014-07-01 21:14 - 2013-01-20 20:36 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Eigene Dateien\Dropbox
2014-07-01 21:14 - 2013-01-20 20:32 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Dropbox
2014-07-01 21:13 - 2014-05-16 00:00 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Anwendungsdaten\DropboxMaster
2014-07-01 21:13 - 2011-07-19 15:08 - 01324826 _____ () C:\WINDOWS\WindowsUpdate.log
2014-07-01 21:11 - 2013-07-10 11:08 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\FreePDF_XP
2014-07-01 21:11 - 2011-07-19 16:04 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-07-01 21:10 - 2013-06-03 20:57 - 00000350 _____ () C:\WINDOWS\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2014-07-01 21:10 - 2011-10-12 13:52 - 00000400 _____ () C:\WINDOWS\Tasks\AVG PC Tuneup 2011 Integrator Start On User Logon.job
2014-07-01 21:10 - 2011-07-19 16:04 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-07-01 21:10 - 2011-07-19 15:18 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-07-01 15:11 - 2011-07-20 07:38 - 00000190 ___SH () C:\Dokumente und Einstellungen\User\ntuser.ini
2014-07-01 15:11 - 2011-07-19 15:18 - 00032626 _____ () C:\WINDOWS\SchedLgU.Txt
2014-06-30 12:26 - 2014-04-07 23:08 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG2014
2014-06-29 23:43 - 2013-06-05 21:27 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Desktop\Anderes
2014-06-29 20:23 - 2006-06-01 21:06 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2014-06-24 01:45 - 2011-07-22 14:46 - 00065536 _____ () C:\WINDOWS\system32\config\ODiag.evt
2014-06-23 18:10 - 2013-11-14 21:58 - 00003725 _____ () C:\Programme\Mozilla Firefoxavg-secure-search.xml
2014-06-23 18:10 - 2012-11-12 19:29 - 00042784 _____ (AVG Technologies) C:\WINDOWS\system32\Drivers\avgtpx86.sys
2014-06-23 18:10 - 2011-11-10 16:18 - 00000000 ____D () C:\WINDOWS\system32\cache
2014-06-23 18:10 - 2011-10-12 11:10 - 00000000 ____D () C:\Programme\AVG Secure Search
2014-06-20 16:56 - 2014-03-19 11:37 - 00547784 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
2014-06-19 22:45 - 2011-07-19 16:01 - 00545952 _____ () C:\WINDOWS\setupapi.log
2014-06-19 22:45 - 2011-07-19 16:00 - 00208014 _____ () C:\WINDOWS\setupact.log
2014-06-12 13:56 - 2013-10-23 17:07 - 00000000 ____D () C:\Programme\Mozilla Maintenance Service
2014-06-12 09:15 - 2011-07-19 16:02 - 00000000 ___RD () C:\Programme
2014-06-11 20:02 - 2014-04-22 11:26 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-06-11 20:00 - 2011-07-19 15:21 - 92708840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-06-11 11:05 - 2014-06-11 11:04 - 00000000 ____D () C:\Programme\Mozilla Firefox
2014-06-06 22:39 - 2011-07-20 07:38 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Eigene Dateien\Eigene Bilder
2014-06-01 21:43 - 2011-07-20 07:38 - 00000000 ___RD () C:\Dokumente und Einstellungen\User\Startmenü\Programme\Autostart
2014-06-01 21:42 - 2013-01-20 20:36 - 00001021 _____ () C:\Dokumente und Einstellungen\User\Desktop\Dropbox.lnk
2014-06-01 21:42 - 2013-01-20 20:33 - 00000000 ____D () C:\Dokumente und Einstellungen\User\Startmenü\Programme\Dropbox

Some content of TEMP:
====================
C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzrnrrt.dll
C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\r7sn4iqt.dll


==================== Bamital & volsnap Check =================

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================


Addition:

Additional scan result of Farbar Recovery Scan Tool (x86) Version:29-06-2014
Ran by User at 2014-07-01 23:20:51
Running from C:\Dokumente und Einstellungen\User\Eigene Dateien\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG update module (Disabled - Up to date) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

==================== Installed Programs ======================

7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Adobe Flash Player 11 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 11.9.900.117 - Adobe Systems Incorporated)
Adobe Reader 8.2.0 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A82000000003}) (Version: 8.2.0 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: - )
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4592 - AVG Technologies)
AVG 2014 (Version: 14.0.3986 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4592 - AVG Technologies) Hidden
AVG PC Tuneup 2011 (HKLM\...\{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1) (Version: 10.0.0.26 - AVG)
AVG Security Toolbar (HKLM\...\AVG Secure Search) (Version: 18.1.7.644 - AVG Technologies)
Broadcom 440x 10/100 Integrated Controller (HKLM\...\{9C9D0F85-5658-4A5E-95A9-65F7DB2916EE}) (Version: 8.03.09 - Ihr Firmenname)
Dienstprogramm für die DW WLAN-Karte (HKLM\...\Dienstprogramm für die DW WLAN-Karte) (Version: 5.60.18.9 - Dell Inc.)
Digital Line Detect (HKLM\...\{E646DCF0-5A68-11D5-B229-002078017FBF}) (Version: 1.15 - BVRP Software, Inc)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version: - )
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs (HKLM\...\{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}) (Version: 1.1.1905.1 - Microsoft Corporation)
Hotfix für Windows XP (KB952287) (HKLM\...\KB952287) (Version: 1 - Microsoft Corporation)
Hotfix für Windows XP (KB961118) (HKLM\...\KB961118) (Version: 1 - Microsoft Corporation)
Hotfix für Windows XP (KB981793) (HKLM\...\KB981793) (Version: 1 - Microsoft Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )
Java Auto Updater (Version: 2.0.2.4 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 22 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle)
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Standard 2007 (HKLM\...\STANDARD) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Standard 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Software Update for Web Folders (German) 12 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348) (HKLM\...\Wudf01000) (Version: - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 6 Service Pack 2 (KB973686) (HKLM\...\{56EA8BC0-3751-4B93-BC9D-6651CC36E5AA}) (Version: 6.20.2003.0 - Microsoft Corporation)
OpenOffice.org 3.3 (HKLM\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.43.0 - SAMSUNG Electronics Co., Ltd.)
Sicherheitsupdate für Windows Media Player 10 (KB911565) (Version: - Microsoft Corporation) Hidden
Sicherheitsupdate für Windows XP (KB2229593) (HKLM\...\KB2229593) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB923561) (HKLM\...\KB923561) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB923789) (HKLM\...\KB923789) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB929969) (HKLM\...\KB929969) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB944338-v2) (HKLM\...\KB944338-v2) (Version: 2 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB950762) (HKLM\...\KB950762) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB950974) (HKLM\...\KB950974) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB951376-v2) (HKLM\...\KB951376-v2) (Version: 2 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB951748) (HKLM\...\KB951748) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB952004) (HKLM\...\KB952004) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB952954) (HKLM\...\KB952954) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB955069) (HKLM\...\KB955069) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB956572) (HKLM\...\KB956572) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB956802) (HKLM\...\KB956802) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB956803) (HKLM\...\KB956803) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB956844) (HKLM\...\KB956844) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB958470) (HKLM\...\KB958470) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB958644) (HKLM\...\KB958644) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB958869) (HKLM\...\KB958869) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB959426) (HKLM\...\KB959426) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB960225) (HKLM\...\KB960225) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB960803) (HKLM\...\KB960803) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB960859) (HKLM\...\KB960859) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB961501) (HKLM\...\KB961501) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB969059) (HKLM\...\KB969059) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB970238) (HKLM\...\KB970238) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB970430) (HKLM\...\KB970430) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB971032) (HKLM\...\KB971032) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB971468) (HKLM\...\KB971468) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB971657) (HKLM\...\KB971657) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB971961) (HKLM\...\KB971961) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB972270) (HKLM\...\KB972270) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB973507) (HKLM\...\KB973507) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB973869) (HKLM\...\KB973869) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB973904) (HKLM\...\KB973904) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB974112) (HKLM\...\KB974112) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB974318) (HKLM\...\KB974318) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB974392) (HKLM\...\KB974392) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB974571) (HKLM\...\KB974571) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975025) (HKLM\...\KB975025) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975467) (HKLM\...\KB975467) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975560) (HKLM\...\KB975560) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975561) (HKLM\...\KB975561) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975562) (HKLM\...\KB975562) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB977816) (HKLM\...\KB977816) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB977914) (HKLM\...\KB977914) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB978037) (HKLM\...\KB978037) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB978338) (HKLM\...\KB978338) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB978542) (HKLM\...\KB978542) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB978601) (HKLM\...\KB978601) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB978706) (HKLM\...\KB978706) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB979309) (HKLM\...\KB979309) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB979482) (HKLM\...\KB979482) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB979559) (HKLM\...\KB979559) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB979683) (HKLM\...\KB979683) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB980195) (HKLM\...\KB980195) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB980218) (HKLM\...\KB980218) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB980232) (HKLM\...\KB980232) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB981350) (HKLM\...\KB981350) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB982381) (HKLM\...\KB982381) (Version: 1 - Microsoft Corporation)
SigmaTel Audio (HKLM\...\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}) (Version: 5.10.5210.0 - SigmaTel)
SleepTimer Ultimate 1.2 (HKLM\...\{0EE56463-49B2-45E1-B74F-3E0139DBC986}_is1) (Version: - Christian Handorf)
Spotify (HKCU\...\Spotify) (Version: 0.9.10.22.gf87988f9 - Spotify AB)
TuneUp Utilities 2006 (HKLM\...\{868D7896-99D4-4513-BC62-2B3AD3E24926}) (Version: 5.0.2327 - TuneUp Software)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB925720) (HKLM\...\KB925720) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB955759) (HKLM\...\KB955759) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB967715) (HKLM\...\KB967715) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB968389) (HKLM\...\KB968389) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB971737) (HKLM\...\KB971737) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB973687) (HKLM\...\KB973687) (Version: 1 - Microsoft Corporation)
Update für Windows XP (KB973815) (HKLM\...\KB973815) (Version: 1 - Microsoft Corporation)
VideoLAN VLC media player 0.8.6a (HKLM\...\VLC media player) (Version: 0.8.6a - VideoLAN Team)
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows Imaging Component (HKLM\...\WIC) (Version: 3.0.0.0 - Microsoft Corporation)
Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
Windows Media Format 11 runtime (Version: - Microsoft Corporation) Hidden
Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
Windows Media Player 11 (Version: - Microsoft Corporation) Hidden
WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Restore Points =========================

01-04-2014 14:20:34 Systemprüfpunkt
02-04-2014 21:18:22 Systemprüfpunkt
06-04-2014 21:37:44 Systemprüfpunkt
07-04-2014 21:07:41 AVG 2014 wurde installiert
07-04-2014 21:07:54 AVG 2012 wurde entfernt
07-04-2014 21:08:25 AVG 2014 wurde installiert
07-04-2014 21:13:23 AVG 2012 wurde entfernt
08-04-2014 10:27:00 AVG 2014 wurde entfernt
09-04-2014 19:19:40 Systemprüfpunkt
10-04-2014 22:12:51 Systemprüfpunkt
12-04-2014 08:27:06 Systemprüfpunkt
13-04-2014 21:30:25 Systemprüfpunkt
15-04-2014 13:16:55 Systemprüfpunkt
16-04-2014 20:51:43 Systemprüfpunkt
22-04-2014 09:25:42 Software Distribution Service 3.0
23-04-2014 07:46:23 AVG 2014 wurde entfernt
24-04-2014 09:58:51 Systemprüfpunkt
25-04-2014 08:25:42 AVG 2014 wurde entfernt
28-04-2014 18:29:52 AVG 2014 wurde entfernt
04-05-2014 22:50:31 Systemprüfpunkt
05-05-2014 13:58:03 AVG 2014 wurde installiert
05-05-2014 13:59:55 AVG 2014 wurde entfernt
06-05-2014 19:40:43 Systemprüfpunkt
08-05-2014 12:03:00 Systemprüfpunkt
12-05-2014 09:42:41 Systemprüfpunkt
13-05-2014 08:19:29 AVG 2014 wurde entfernt
14-05-2014 23:17:43 Systemprüfpunkt
15-05-2014 02:23:31 Software Distribution Service 3.0
16-05-2014 10:59:20 Systemprüfpunkt
18-05-2014 21:17:45 Systemprüfpunkt
19-05-2014 23:44:53 Systemprüfpunkt
20-05-2014 07:21:50 AVG 2014 wurde entfernt
21-05-2014 14:40:20 Systemprüfpunkt
22-05-2014 22:10:22 Systemprüfpunkt
01-06-2014 19:39:42 AVG 2014 wurde entfernt
02-06-2014 22:23:27 Systemprüfpunkt
04-06-2014 20:49:55 Systemprüfpunkt
05-06-2014 21:38:36 Systemprüfpunkt
06-06-2014 21:48:23 Systemprüfpunkt
07-06-2014 22:30:57 Systemprüfpunkt
08-06-2014 23:59:26 Systemprüfpunkt
11-06-2014 18:00:16 Software Distribution Service 3.0
12-06-2014 08:07:23 AVG 2014 wurde entfernt
15-06-2014 21:18:50 Systemprüfpunkt
17-06-2014 17:06:14 AVG 2014 wurde entfernt
18-06-2014 18:00:40 Systemprüfpunkt
19-06-2014 20:34:20 Systemprüfpunkt
21-06-2014 09:29:23 Systemprüfpunkt
22-06-2014 16:34:54 Systemprüfpunkt
23-06-2014 17:14:28 Systemprüfpunkt
24-06-2014 17:41:20 Systemprüfpunkt
25-06-2014 18:09:24 AVG 2014 wurde entfernt
29-06-2014 22:01:14 Systemprüfpunkt

==================== Scheduled Tasks (whitelisted) =============

Task: C:\WINDOWS\Tasks\1-Klick-Wartung.job => C:\Programme\TuneUpUtilities2006\SystemOptimizer.exe
Task: C:\WINDOWS\Tasks\AVG PC Tuneup 2011 Integrator Start On User Logon.job => C:\Programme\AVG\AVG PC Tuneup 2011\BoostSpeed.exe
Task: C:\WINDOWS\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\WINDOWS\TEMP\{583FBF7A-4F7B-41C5-BE06-7B4CCA052625}.exe

==================== Loaded Modules (whitelisted) =============

2011-07-20 08:48 - 2009-10-07 15:01 - 00025088 _____ () C:\WINDOWS\System32\WLTRYSVC.EXE
2011-07-20 08:48 - 2009-10-07 15:01 - 00757760 _____ () C:\WINDOWS\System32\bcm1xsup.dll
2013-07-10 11:01 - 2012-08-18 11:31 - 00116224 _____ () C:\WINDOWS\system32\redmonnt.dll
2011-10-12 13:52 - 2011-05-25 10:53 - 00350024 _____ () C:\Programme\AVG\AVG PC Tuneup 2011\madExcept_.bpl
2011-10-12 13:52 - 2011-05-25 10:53 - 00184136 _____ () C:\Programme\AVG\AVG PC Tuneup 2011\madBasic_.bpl
2011-10-12 13:52 - 2011-05-25 10:53 - 00050504 _____ () C:\Programme\AVG\AVG PC Tuneup 2011\madDisAsm_.bpl
2014-06-23 18:10 - 2014-06-23 18:10 - 00159768 _____ () C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\18.1.7\loggingserver.exe
2014-06-23 18:10 - 2014-06-23 18:10 - 00519704 _____ () C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\18.1.7\log4cplusU.dll
2011-07-20 08:48 - 2009-10-07 15:01 - 00143360 _____ () C:\WINDOWS\system32\preflib.dll
2011-10-12 11:10 - 2014-06-23 18:10 - 02571288 _____ () C:\Programme\AVG Secure Search\vprot.exe
2014-03-17 19:57 - 2014-03-31 20:46 - 01603608 _____ () C:\Programme\AVG Secure Search\TBAPI.dll
2014-02-14 22:53 - 2014-02-14 22:53 - 00036864 _____ () C:\Programme\Samsung\Kies\Common\Kies.Common.DeviceServiceLib.Interface.dll
2014-02-14 22:54 - 2014-02-14 22:54 - 14959616 _____ () C:\Programme\Samsung\Kies\Theme\Kies.Theme.dll
2014-02-14 22:53 - 2014-02-14 22:53 - 00594944 _____ () C:\Programme\Samsung\Kies\Common\Kies.UI.dll
2014-02-14 22:53 - 2014-02-14 22:53 - 00023040 _____ () C:\Programme\Samsung\Kies\MVVM\Kies.MVVM.dll
2014-01-23 19:23 - 2014-01-23 19:23 - 00057856 _____ () C:\Programme\Samsung\Kies\External\MediaModules\ASF_cSharpAPI.dll
2014-07-01 21:13 - 2014-07-01 21:13 - 00043008 _____ () c:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzrnrrt.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Dokumente und Einstellungen\User\Anwendungsdaten\Dropbox\bin\libcef.dll
2011-01-17 17:19 - 2011-11-23 19:39 - 00985088 _____ () C:\Programme\OpenOffice.org 3\program\libxml2.dll
2014-06-11 11:05 - 2014-06-11 11:05 - 03852912 _____ () C:\Programme\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:0B4227B4

==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: Modem Device on High Definition Audio Bus
Description: Modem Device on High Definition Audio Bus
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 1394-Netzwerkadapter
Description: 1394-Netzwerkadapter
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: NIC1394
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/30/2014 08:29:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung plugin-container.exe, Version 30.0.0.5269, fehlgeschlagenes Modul mozalloc.dll, Version 30.0.0.5269, Fehleradresse 0x0000141b.
Das medienspezifische Ereignis für [plugin-container.exe!ws!] wird verarbeitet.

Error: (06/23/2014 03:11:58 PM) (Source: Microsoft Office 12) (EventID: 1000) (User: )
Description: Faulting application winword.exe, version 12.0.4518.1014, stamp 45428028, faulting module mso.dll, version 12.0.4518.1014, stamp 4542867b, debug? 0, fault address 0x008f4f36.

Error: (06/19/2014 10:48:50 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
Description: .NET Runtime version 2.0.50727.3603 - Unrecoverable system error.

Error: (06/19/2014 10:39:49 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
Description: .NET Runtime version 2.0.50727.3603 - Unrecoverable system error.

Error: (06/18/2014 03:05:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung plugin-container.exe, Version 30.0.0.5269, fehlgeschlagenes Modul mozalloc.dll, Version 30.0.0.5269, Fehleradresse 0x0000141b.
Das medienspezifische Ereignis für [plugin-container.exe!ws!] wird verarbeitet.

Error: (04/11/2014 09:25:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung acrord32.exe, Version 8.2.0.81, fehlgeschlagenes Modul msvcr80.dll, Version 8.0.50727.3053, Fehleradresse 0x000173f7.
Das medienspezifische Ereignis für [acrord32.exe!ws!] wird verarbeitet.

Error: (04/07/2014 11:14:57 PM) (Source: crypt32) (EventID: 11) (User: )
Description: Die Extrahierung der Drittanbieterstammlisten aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (04/07/2014 11:14:57 PM) (Source: crypt32) (EventID: 11) (User: )
Description: Die Extrahierung der Drittanbieterstammlisten aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (02/02/2014 09:36:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung wmplayer.exe, Version 11.0.5358.4827, fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0x01169b50.
Das medienspezifische Ereignis für [wmplayer.exe!ws!] wird verarbeitet.

Error: (11/26/2013 06:39:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlgeschlagene Anwendung plugin-container.exe, Version 25.0.1.5064, fehlgeschlagenes Modul mozalloc.dll, Version 25.0.1.5064, Fehleradresse 0x0000119c.
Das medienspezifische Ereignis für [plugin-container.exe!ws!] wird verarbeitet.


System errors:
=============
Error: (07/01/2014 11:12:54 PM) (Source: 0) (EventID: 9) (User: )
Description: \Device\Ide\IdePort0

Error: (07/01/2014 11:12:52 PM) (Source: 0) (EventID: 9) (User: )
Description: \Device\Ide\IdePort0

Error: (07/01/2014 11:11:54 PM) (Source: 0) (EventID: 9) (User: )
Description: \Device\Ide\IdePort0

Error: (07/01/2014 11:11:30 PM) (Source: 0) (EventID: 9) (User: )
Description: \Device\Ide\IdePort0

Error: (07/01/2014 11:11:17 PM) (Source: 0) (EventID: 9) (User: )
Description: \Device\Ide\IdePort0

Error: (07/01/2014 11:11:10 PM) (Source: 0) (EventID: 9) (User: )
Description: \Device\Ide\IdePort0

Error: (07/01/2014 11:09:34 PM) (Source: 0) (EventID: 9) (User: )
Description: \Device\Ide\IdePort0

Error: (07/01/2014 11:08:43 PM) (Source: 0) (EventID: 9) (User: )
Description: \Device\Ide\IdePort0

Error: (07/01/2014 11:05:52 PM) (Source: 0) (EventID: 9) (User: )
Description: \Device\Ide\IdePort0

Error: (07/01/2014 11:05:08 PM) (Source: 0) (EventID: 9) (User: )
Description: \Device\Ide\IdePort0


Microsoft Office Sessions:
=========================
Error: (06/23/2014 03:11:55 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 9063 seconds with 5100 seconds of active time. This session ended with a crash.


==================== Memory info ===========================

Percentage of memory in use: 42%
Total physical RAM: 2038.27 MB
Available physical RAM: 1179.94 MB
Total Pagefile: 3930.64 MB
Available Pagefile: 2946.17 MB
Total Virtual: 2047.88 MB
Available Virtual: 1956.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:74.53 GB) (Free:37.06 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 75 GB) (Disk ID: C9C1C9C1)
Partition 1: (Active) - (Size=75 GB) - (Type=07 NTFS)

==================== End Of Log ============================


Gmer:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-01 23:15:16
Windows 5.1.2600 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST980813AS rev.3.AAB 74,53GB
Running: Gmer-19357.exe; Driver: C:\DOKUME~1\User\LOKALE~1\Temp\kxtdipow.sys


---- System - GMER 2.1 ----

SSDT \??\C:\WINDOWS\system32\drivers\avgtpx86.sys ZwEnumerateKey [0xB8360342]
SSDT \??\C:\WINDOWS\system32\drivers\avgtpx86.sys ZwEnumerateValueKey [0xB83603F2]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwNotifyChangeKey [0xA636C6E0]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwNotifyChangeMultipleKeys [0xA636C800]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwOpenProcess [0xA636C010]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwOpenThread [0xA636C4D0]
SSDT \??\C:\WINDOWS\system32\drivers\avgtpx86.sys ZwQueryValueKey [0xB836022A]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwSuspendProcess [0xA636C300]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwSuspendThread [0xA636C3E0]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwTerminateProcess [0xA636C120]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwTerminateThread [0xA636C210]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwWriteVirtualMemory [0xA636C5E0]

---- User code sections - GMER 2.1 ----

.text C:\Programme\Internet Explorer\iexplore.exe[3032] ntdll.dll!NtCreateProcess 7C91D14E 2 Bytes [68, 0F]
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ntdll.dll!NtCreateProcess + 3 7C91D151 1 Byte [EB]
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ntdll.dll!NtCreateProcess + 3 7C91D151 3 Bytes [EB, 00, C3] {JMP 0x2; RET }
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ntdll.dll!NtCreateProcessEx 7C91D15E 2 Bytes [68, 0F]
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ntdll.dll!NtCreateProcessEx + 3 7C91D161 1 Byte [EC]
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ntdll.dll!NtCreateProcessEx + 3 7C91D161 3 Bytes [EC, 00, C3] {IN AL, DX; ADD BL, AL}
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ntdll.dll!RtlCreateUserProcess 7C940C29 6 Bytes PUSH 00ED000C; RET
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!GetProcessWindowStation + 2C 77D191C1 7 Bytes JMP 00C60005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!GetShellWindow + 44 77D19296 7 Bytes JMP 00C80005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!PtInRect + 30 77D1BD71 7 Bytes JMP 00C30005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!GetMessagePos 77D1BF94 6 Bytes PUSH 00C2000C; RET
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!UnionRect + 24A 77D1C967 7 Bytes JMP 00C70005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!LoadStringA + 55 77D2103D 7 Bytes JMP 00C50005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!CreateDialogIndirectParamA + 555 77D3A055 7 Bytes JMP 00AE0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!GetMenuCheckMarkDimensions + 4EC 77D504E5 7 Bytes JMP 00AA0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!MessageBoxA + 49 77D50533 7 Bytes JMP 00AD0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!MessageBoxExW + 1F 77D50557 7 Bytes JMP 00AC0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!RegisterSystemThread + 16 77D55E46 7 Bytes JMP 00C40005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!MessageBoxTimeoutA + CA 77D6608E 7 Bytes JMP 00AF0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!MessageBoxIndirectW + 5A 77D660ED 7 Bytes JMP 00AB0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!GetCursorInfo 77D6C786 4 Bytes [68, 0F, 00, C1]
.text C:\Programme\Internet Explorer\iexplore.exe[3032] USER32.dll!GetCursorInfo + 5 77D6C78B 1 Byte [C3]
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!ElfFlushEventLog 77DA6A8A 7 Bytes JMP 00B80005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!RegOpenKeyExW + 173 77DA6C02 7 Bytes JMP 00B00005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!RegCloseKey + 3D3 77DA6FDA 2 Bytes JMP 00C00005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!RegCloseKey + 3D6 77DA6FDD 4 Bytes [E5, 88, EB, F9] {IN EAX, 0x88; JMP 0xfffffffd}
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!GetSecurityDescriptorLength + 2AC 77DA7747 7 Bytes JMP 00BC0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!RegCreateKeyExW + E1 77DA782D 7 Bytes JMP 00B70005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!RegOpenKeyExA + EF 77DA7921 7 Bytes JMP 00B60005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!SetSecurityDescriptorDacl + CB 77DA7A96 7 Bytes JMP 00BF0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!RegQueryValueExA + 119 77DA7BB4 7 Bytes JMP 00B20005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!GetLengthSid + 18C 77DA7EC8 7 Bytes JMP 00B40005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!RegNotifyChangeKeyValue + 1031 77DAE82F 7 Bytes JMP 00BB0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!RegDeleteValueW + 1D2 77DAEE03 7 Bytes JMP 00B50005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW + 1040 77DB3E1E 7 Bytes JMP 00BE0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!ImpersonateSelf + 84 77DB45E9 7 Bytes JMP 00BA0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!AccessCheckAndAuditAlarmW + 82 77DB4701 7 Bytes JMP 00B90005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!UnregisterTraceGuids + 3CE 77DC5AD3 7 Bytes JMP 00B30005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!WmiFreeBuffer + 2D 77DC849C 7 Bytes JMP 00B10005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] ADVAPI32.dll!RegDeleteKeyA + 8D 77DCB74B 7 Bytes JMP 00BD0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] WININET.dll!GetUrlCacheHeaderData + 391E 7718AEE8 7 Bytes JMP 00EA0005
.text C:\Programme\Internet Explorer\iexplore.exe[3032] WININET.dll!InternetCloseHandle + 9FD 77195739 7 Bytes JMP 00E90005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ntdll.dll!NtCreateProcess 7C91D14E 2 Bytes [68, 0F]
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ntdll.dll!NtCreateProcess + 3 7C91D151 1 Byte [EB]
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ntdll.dll!NtCreateProcess + 3 7C91D151 3 Bytes [EB, 00, C3] {JMP 0x2; RET }
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ntdll.dll!NtCreateProcessEx 7C91D15E 2 Bytes [68, 0F]
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ntdll.dll!NtCreateProcessEx + 3 7C91D161 1 Byte [EC]
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ntdll.dll!NtCreateProcessEx + 3 7C91D161 3 Bytes [EC, 00, C3] {IN AL, DX; ADD BL, AL}
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ntdll.dll!RtlCreateUserProcess 7C940C29 6 Bytes PUSH 00ED000C; RET
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!GetProcessWindowStation + 2C 77D191C1 7 Bytes JMP 00C60005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!GetShellWindow + 44 77D19296 7 Bytes JMP 00C80005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!PtInRect + 30 77D1BD71 7 Bytes JMP 00C30005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!GetMessagePos 77D1BF94 6 Bytes PUSH 00C2000C; RET
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!UnionRect + 24A 77D1C967 7 Bytes JMP 00C70005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!LoadStringA + 55 77D2103D 7 Bytes JMP 00C50005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!CreateDialogIndirectParamA + 555 77D3A055 7 Bytes JMP 00AE0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!GetMenuCheckMarkDimensions + 4EC 77D504E5 7 Bytes JMP 00AA0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!MessageBoxA + 49 77D50533 7 Bytes JMP 00AD0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!MessageBoxExW + 1F 77D50557 7 Bytes JMP 00AC0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!RegisterSystemThread + 16 77D55E46 7 Bytes JMP 00C40005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!MessageBoxTimeoutA + CA 77D6608E 7 Bytes JMP 00AF0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!MessageBoxIndirectW + 5A 77D660ED 7 Bytes JMP 00AB0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!GetCursorInfo 77D6C786 4 Bytes [68, 0F, 00, C1]
.text C:\Programme\Internet Explorer\iexplore.exe[4256] USER32.dll!GetCursorInfo + 5 77D6C78B 1 Byte [C3]
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!ElfFlushEventLog 77DA6A8A 7 Bytes JMP 00B80005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!RegOpenKeyExW + 173 77DA6C02 7 Bytes JMP 00B00005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!RegCloseKey + 3D3 77DA6FDA 2 Bytes JMP 00C00005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!RegCloseKey + 3D6 77DA6FDD 4 Bytes [E5, 88, EB, F9] {IN EAX, 0x88; JMP 0xfffffffd}
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!GetSecurityDescriptorLength + 2AC 77DA7747 7 Bytes JMP 00BC0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!RegCreateKeyExW + E1 77DA782D 7 Bytes JMP 00B70005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!RegOpenKeyExA + EF 77DA7921 7 Bytes JMP 00B60005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!SetSecurityDescriptorDacl + CB 77DA7A96 7 Bytes JMP 00BF0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!RegQueryValueExA + 119 77DA7BB4 7 Bytes JMP 00B20005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!GetLengthSid + 18C 77DA7EC8 7 Bytes JMP 00B40005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!RegNotifyChangeKeyValue + 1031 77DAE82F 7 Bytes JMP 00BB0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!RegDeleteValueW + 1D2 77DAEE03 7 Bytes JMP 00B50005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW + 1040 77DB3E1E 7 Bytes JMP 00BE0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!ImpersonateSelf + 84 77DB45E9 7 Bytes JMP 00BA0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!AccessCheckAndAuditAlarmW + 82 77DB4701 7 Bytes JMP 00B90005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!UnregisterTraceGuids + 3CE 77DC5AD3 7 Bytes JMP 00B30005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!WmiFreeBuffer + 2D 77DC849C 7 Bytes JMP 00B10005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] ADVAPI32.dll!RegDeleteKeyA + 8D 77DCB74B 7 Bytes JMP 00BD0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] WININET.dll!GetUrlCacheHeaderData + 391E 7718AEE8 7 Bytes JMP 00EA0005
.text C:\Programme\Internet Explorer\iexplore.exe[4256] WININET.dll!InternetCloseHandle + 9FD 77195739 7 Bytes JMP 00E90005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ntdll.dll!NtCreateProcess 7C91D14E 2 Bytes [68, 0F]
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ntdll.dll!NtCreateProcess + 3 7C91D151 1 Byte [EB]
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ntdll.dll!NtCreateProcess + 3 7C91D151 3 Bytes [EB, 00, C3] {JMP 0x2; RET }
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ntdll.dll!NtCreateProcessEx 7C91D15E 2 Bytes [68, 0F]
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ntdll.dll!NtCreateProcessEx + 3 7C91D161 1 Byte [EC]
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ntdll.dll!NtCreateProcessEx + 3 7C91D161 3 Bytes [EC, 00, C3] {IN AL, DX; ADD BL, AL}
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ntdll.dll!RtlCreateUserProcess 7C940C29 6 Bytes PUSH 00ED000C; RET
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!GetProcessWindowStation + 2C 77D191C1 7 Bytes JMP 00C60005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!GetShellWindow + 44 77D19296 7 Bytes JMP 00C80005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!PtInRect + 30 77D1BD71 7 Bytes JMP 00C30005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!GetMessagePos 77D1BF94 6 Bytes PUSH 00C2000C; RET
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!UnionRect + 24A 77D1C967 7 Bytes JMP 00C70005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!LoadStringA + 55 77D2103D 7 Bytes JMP 00C50005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!CreateDialogIndirectParamA + 555 77D3A055 7 Bytes JMP 00AE0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!GetMenuCheckMarkDimensions + 4EC 77D504E5 7 Bytes JMP 00AA0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!MessageBoxA + 49 77D50533 7 Bytes JMP 00AD0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!MessageBoxExW + 1F 77D50557 7 Bytes JMP 00AC0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!RegisterSystemThread + 16 77D55E46 7 Bytes JMP 00C40005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!MessageBoxTimeoutA + CA 77D6608E 7 Bytes JMP 00AF0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!MessageBoxIndirectW + 5A 77D660ED 7 Bytes JMP 00AB0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!GetCursorInfo 77D6C786 4 Bytes [68, 0F, 00, C1]
.text C:\Programme\Internet Explorer\iexplore.exe[5608] USER32.dll!GetCursorInfo + 5 77D6C78B 1 Byte [C3]
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!ElfFlushEventLog 77DA6A8A 7 Bytes JMP 00B80005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!RegOpenKeyExW + 173 77DA6C02 7 Bytes JMP 00B00005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!RegCloseKey + 3D3 77DA6FDA 2 Bytes JMP 00C00005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!RegCloseKey + 3D6 77DA6FDD 4 Bytes [E5, 88, EB, F9] {IN EAX, 0x88; JMP 0xfffffffd}
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!GetSecurityDescriptorLength + 2AC 77DA7747 7 Bytes JMP 00BC0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!RegCreateKeyExW + E1 77DA782D 7 Bytes JMP 00B70005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!RegOpenKeyExA + EF 77DA7921 7 Bytes JMP 00B60005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!SetSecurityDescriptorDacl + CB 77DA7A96 7 Bytes JMP 00BF0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!RegQueryValueExA + 119 77DA7BB4 7 Bytes JMP 00B20005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!GetLengthSid + 18C 77DA7EC8 7 Bytes JMP 00B40005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!RegNotifyChangeKeyValue + 1031 77DAE82F 7 Bytes JMP 00BB0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!RegDeleteValueW + 1D2 77DAEE03 7 Bytes JMP 00B50005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW + 1040 77DB3E1E 7 Bytes JMP 00BE0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!ImpersonateSelf + 84 77DB45E9 7 Bytes JMP 00BA0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!AccessCheckAndAuditAlarmW + 82 77DB4701 7 Bytes JMP 00B90005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!UnregisterTraceGuids + 3CE 77DC5AD3 7 Bytes JMP 00B30005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!WmiFreeBuffer + 2D 77DC849C 7 Bytes JMP 00B10005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] ADVAPI32.dll!RegDeleteKeyA + 8D 77DCB74B 7 Bytes JMP 00BD0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] WININET.dll!GetUrlCacheHeaderData + 391E 7718AEE8 7 Bytes JMP 00EA0005
.text C:\Programme\Internet Explorer\iexplore.exe[5608] WININET.dll!InternetCloseHandle + 9FD 77195739 7 Bytes JMP 00E90005

---- Devices - GMER 2.1 ----

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys

Device \Driver\ACPI \Device\00000040 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000041 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000042 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000050 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000043 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000051 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000055 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000048 ntkrnlpa.exe

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys

Device \Driver\ACPI \Device\00000062 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000056 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000049 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000058 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000064 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000059 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000065 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000080 ntkrnlpa.exe
Device \Driver\ACPI \Device\0000003c ntkrnlpa.exe
Device \Driver\ACPI \Device\00000082 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000076 ntkrnlpa.exe
Device \Driver\ACPI \Device\00000077 ntkrnlpa.exe
Device \Driver\ACPI \Device\0000004a ntkrnlpa.exe
Device \Driver\ACPI \Device\0000003e ntkrnlpa.exe
Device \Driver\ACPI \Device\00000084 ntkrnlpa.exe
Device \Driver\ACPI \Device\0000003f ntkrnlpa.exe
Device \Driver\ACPI \Device\0000004b ntkrnlpa.exe
Device \Driver\ACPI \Device\0000004c ntkrnlpa.exe
Device \Driver\ACPI \Device\0000005a ntkrnlpa.exe
Device \Driver\ACPI \Device\0000004d ntkrnlpa.exe
Device \Driver\ACPI \Device\00000087 ntkrnlpa.exe
Device \Driver\ACPI \Device\0000004f ntkrnlpa.exe

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys

Device \Driver\ACPI \Device\0000007c ntkrnlpa.exe
Device \Driver\ACPI \Device\0000007e ntkrnlpa.exe

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a6bffac45
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001a6bffac45 (not active ControlSet)
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}@StartTimeLo 772004732
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}@StartTimeHi 30381408
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}@EndTimeLo 772004732
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}@EndTimeHi 30381408
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-790525478-115176313-725345543-1003\Extension-List\{00000000-0000-0000-0000-000000000000}@StartTimeLo 772004732
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-790525478-115176313-725345543-1003\Extension-List\{00000000-0000-0000-0000-000000000000}@StartTimeHi 30381408
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-790525478-115176313-725345543-1003\Extension-List\{00000000-0000-0000-0000-000000000000}@EndTimeLo 772004732
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\S-1-5-21-790525478-115176313-725345543-1003\Extension-List\{00000000-0000-0000-0000-000000000000}@EndTimeHi 30381408
Reg HKLM\SOFTWARE\Classes\CLSID\{A5246BC4-2C0E-7426-4150-BDCF61960FDE}\eeyvn@ ZNUo_^VWf[_xiiffGt
Reg HKLM\SOFTWARE\Classes\CLSID\{A5246BC4-2C0E-7426-4150-BDCF61960FDE}\egbEdkhznc@ GJDhuDwaT@of]Svu
Reg HKLM\SOFTWARE\Classes\CLSID\{A5246BC4-2C0E-7426-4150-BDCF61960FDE}\rnogImjFOdp@ S?TMR~dQkVk

---- EOF - GMER 2.1 ----



Ich hoffe man kann mir weiter helfen. Falls ich etwas vergessen oder falsch gemacht habe, werde ich es sofort korrigieren, wenn ihr mir Bescheidgebt.
Ich bedanke mich bei allen Helfern, die sich die Zeit nehmen und mir versuchen zu helfen.

jona333