Windows Vista: Browser öffnet immer mit Starsseite IE WEBSEARCHES

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-11-2014
Ran by Maiwald (administrator) on MAIWALD-PC on 13-11-2014 20:59:59
Running from C:\Users\Maiwald\Downloads
Loaded Profile: Maiwald (Available profiles: Maiwald & UpdatusUser)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Norman AS) C:\Program Files\Norman\Npm\Bin\elogsvc.exe
(Norman AS) C:\Program Files\Norman\Npm\Bin\nvoy.exe
(Norman Safeground AS) C:\Program Files\Norman\Ngs\bin\nnf.exe
(Norman Safeground AS) C:\Program Files\Norman\Ngs\bin\nprosec.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Norman AS) C:\Program Files\Norman\Npm\Bin\zanda.exe
() C:\ProgramData\IePluginServices\PluginService.exe
() C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Norman\Nvc\bin\nhs.exe
() C:\Windows\System32\PnkBstrA.exe
(Norman AS) C:\Program Files\Norman\Npm\Bin\scheduler.exe
() C:\Program Files\Norman\Npm\Bin\njeeves.exe
(Norman ASA) C:\Program Files\Norman\Nse\Bin\nsesvc.exe
(Norman AS) C:\Program Files\Norman\Nvc\bin\nvcoas.exe
(Norman AS) C:\Program Files\Norman\Npm\Bin\zlh.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files\SupTab\HpUI.exe
(Norman AS) C:\Program Files\Norman\Npm\Bin\zlhh.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Norman ASA) C:\Program Files\Norman\Nvc\bin\cclaw.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\APSDaemon.exe
(Apple Inc.) C:\Program Files\iTunes\iTunes.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_223.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_223.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [Norman ZANDA] => C:\Program Files\Norman\Npm\Bin\ZLH.EXE [66888 2013-03-08] (Norman AS)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Maiwald\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Maiwald\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Maiwald\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x5A7C402B165CCC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428&q={searchTerms}
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2958699206-1471774151-649911503-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428&q={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=foxysecurity
BHO: mySecureSurfer -> {52EA1989-D16E-4560-9021-F0AD247DE4D1} -> C:\Users\Maiwald\AppData\LocalLow\mySecureSurfer\IE\mySecureSurfer.dll (Soft-Ware International Ltd.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Maiwald\AppData\Roaming\Mozilla\Firefox\Profiles\chvgwx36.default
FF NewTab: hxxp://istart.webssearches.com/newtab/?type=nt&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428
FF DefaultSearchEngine: webssearches
FF SelectedSearchEngine: webssearches
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Maiwald\AppData\Roaming\Mozilla\Firefox\Profiles\chvgwx36.default\user.js
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\ddg.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\webssearches.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Fast Start - C:\Users\Maiwald\AppData\Roaming\Mozilla\Firefox\Profiles\chvgwx36.default\Extensions\faststartff@gmail.com [2014-11-13]
FF Extension: SparPilot - Gutscheine &amp; mehr... - C:\Users\Maiwald\AppData\Roaming\Mozilla\Firefox\Profiles\chvgwx36.default\Extensions\sparpilot@sparpilot.com [2014-11-13]
FF Extension: WEB.DE MailCheck - C:\Users\Maiwald\AppData\Roaming\Mozilla\Firefox\Profiles\chvgwx36.default\Extensions\toolbar@web.de [2014-10-28]
FF Extension: mySecureSurfer - C:\Users\Maiwald\AppData\Roaming\Mozilla\Firefox\Profiles\chvgwx36.default\Extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157} [2014-11-13]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-08-15]
FF HKLM\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Maiwald\AppData\Roaming\Mozilla\Firefox\Profiles\chvgwx36.default\extensions\faststartff@gmail.com
FF Extension: No Name - C:\Users\Maiwald\AppData\Roaming\Mozilla\Firefox\Profiles\chvgwx36.default\extensions\foxi@securitii-dhfjs.com [Not Found]
FF Extension: No Name - foxi@securitii-dhfjs.com [Not Found]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe hxxp://istart.webssearches.com/?type=sc&ts=1415902877&from=cvs&uid=WDCXWD5000AAKS-07YGA0_WD-WCAS8657242872428

Chrome: 
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 eLoggerSvc6; C:\Program Files\Norman\Npm\Bin\elogsvc.exe [104920 2013-03-04] (Norman AS)
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [715656 2014-11-13] () [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NHS; C:\Program Files\Norman\Nvc\bin\nhs.exe [793520 2012-10-17] ()
R2 NNFSVC; C:\Program Files\Norman\Ngs\Bin\Nnf.exe [279592 2013-12-06] (Norman Safeground AS)
R3 Norman NJeeves; C:\Program Files\Norman\Npm\Bin\Njeeves.exe [150120 2013-02-13] ()
R2 Norman ZANDA; C:\Program Files\Norman\Npm\Bin\Zanda.exe [433504 2013-03-20] (Norman AS)
R2 NPROSECSVC; C:\Program Files\Norman\Ngs\Bin\Nprosec.exe [120456 2013-08-16] (Norman Safeground AS)
R3 nsesvc; C:\Program Files\Norman\Nse\Bin\NSESVC.EXE [289048 2013-02-27] (Norman ASA)
R3 nvcoas; C:\Program Files\Norman\Nvc\Bin\nvcoas.exe [320696 2013-01-21] (Norman AS)
R2 NVOY; C:\Program Files\Norman\Npm\Bin\Nvoy.exe [222864 2013-06-27] (Norman AS)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2014-03-28] ()
R3 Scheduler; C:\Program Files\Norman\Npm\Bin\scheduler.exe [102976 2013-03-13] (Norman AS)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [490640 2014-11-13] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-22] (AVM Berlin) [File not signed]
S3 fwlanusb4; C:\Windows\System32\DRIVERS\fwlanusb4.sys [926080 2010-10-22] (AVM GmbH)
R3 L1E; C:\Windows\System32\DRIVERS\L1E60x86.sys [48640 2009-08-05] (Atheros Communications, Inc.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [7680 2006-10-18] ()
R2 Ndiskio; C:\Program Files\Norman\Nse\Bin\NDISKIO.SYS [22880 2010-12-09] (Norman ASA)
R1 NGS; c:\program files\norman\ngs\bin\ngs.sys [28120 2014-02-04] (Norman Safeground AS)
R1 NPROSEC; C:\Program Files\Norman\Ngs\Bin\nprosec.sys [108360 2013-08-16] (Norman Safeground AS)
R2 nregsec; C:\Program Files\Norman\Ngs\Bin\nregsec.sys [67256 2013-08-13] (Norman Safeground AS)
R3 NvcMFlt; C:\Windows\System32\DRIVERS\nvcv32mf.sys [51264 2013-09-16] (Norman ASA)
S3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-29] (America Online, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EverestDriver; \??\F:\Software\Testsoftware\Everest Ultimate Edition v.4.60.1601 beta\kerneld.wnt [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-13 20:59 - 2014-11-13 21:00 - 00014290 _____ () C:\Users\Maiwald\Downloads\FRST.txt
2014-11-13 20:59 - 2014-11-13 21:00 - 00000000 ____D () C:\FRST
2014-11-13 20:58 - 2014-11-13 20:59 - 00000476 _____ () C:\Users\Maiwald\Downloads\defogger_disable.log
2014-11-13 20:58 - 2014-11-13 20:58 - 00000000 _____ () C:\Users\Maiwald\defogger_reenable
2014-11-13 20:56 - 2014-11-13 20:56 - 01108480 _____ (Farbar) C:\Users\Maiwald\Downloads\FRST.exe
2014-11-13 20:55 - 2014-11-13 20:55 - 00050477 _____ () C:\Users\Maiwald\Downloads\Defogger.exe
2014-11-13 19:31 - 2014-11-13 19:31 - 00000000 ____D () C:\Users\Maiwald\AppData\Roaming\dlg
2014-11-13 19:24 - 2014-11-13 19:24 - 00000000 ____D () C:\Users\Maiwald\AppData\Roaming\Ashampoo
2014-11-13 19:24 - 2014-11-13 19:24 - 00000000 ____D () C:\Users\Maiwald\AppData\Local\ashampoo
2014-11-13 19:24 - 2014-11-13 19:24 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-11-13 19:22 - 2014-11-13 20:37 - 00000000 ____D () C:\Program Files\SupTab
2014-11-13 19:22 - 2014-11-13 19:22 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-11-13 19:22 - 2014-11-13 19:22 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-11-13 19:19 - 2014-11-13 19:19 - 00684408 _____ () C:\Users\Maiwald\Downloads\ashampoo_burning_studio_6_free_6.82_4312.exe
2014-11-13 18:09 - 2014-10-10 02:01 - 00449536 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-13 18:09 - 2014-10-10 02:00 - 01259008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-13 18:09 - 2014-10-10 02:00 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-13 18:09 - 2014-10-10 00:22 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-13 18:09 - 2014-08-27 01:55 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-13 18:09 - 2014-08-27 01:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-13 18:08 - 2014-10-24 02:04 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-13 18:08 - 2014-09-19 01:50 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-13 18:08 - 2014-08-12 03:25 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-13 18:06 - 2014-10-18 02:08 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-13 18:06 - 2014-10-03 02:18 - 00274432 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-13 18:06 - 2014-10-03 02:17 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-13 18:06 - 2014-10-03 02:17 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-13 18:06 - 2014-10-03 02:17 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-13 18:01 - 2014-10-13 00:34 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-13 16:36 - 2014-11-13 16:36 - 00000000 ____D () C:\Users\Maiwald\Desktop\OpenOffice 4.1.1 (de) Installation Files
2014-11-13 16:32 - 2014-11-13 16:33 - 164858324 _____ () C:\Users\Maiwald\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2014-11-13 15:56 - 2014-10-27 20:10 - 12366848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-13 15:56 - 2014-10-27 20:05 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-13 15:56 - 2014-10-27 20:02 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-13 15:56 - 2014-10-27 19:59 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-13 15:56 - 2014-10-27 19:59 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-13 15:56 - 2014-10-27 19:58 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-13 15:56 - 2014-10-27 19:57 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-11-13 15:56 - 2014-10-27 19:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-13 15:56 - 2014-10-27 19:56 - 01802752 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-13 15:56 - 2014-10-27 19:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-11-13 15:56 - 2014-10-27 19:56 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-13 15:56 - 2014-10-27 19:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-13 15:56 - 2014-10-27 19:56 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-13 15:56 - 2014-10-27 19:55 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-13 15:56 - 2014-10-27 19:55 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-13 15:56 - 2014-10-27 19:55 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-13 15:56 - 2014-10-27 19:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-13 15:56 - 2014-10-27 19:55 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-11-13 15:56 - 2014-10-27 19:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-11-13 15:56 - 2014-10-27 19:55 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-11-13 15:56 - 2014-10-27 19:54 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-03 17:32 - 2014-11-03 17:32 - 00001483 _____ () C:\Users\Public\Desktop\Call of Duty - United Offensive Mehrspieler.lnk
2014-11-03 17:32 - 2014-11-03 17:32 - 00001483 _____ () C:\Users\Public\Desktop\Call of Duty - United Offensive Einzelspieler.lnk
2014-11-03 17:32 - 2014-11-03 17:32 - 00000347 _____ () C:\Windows\CODUO.ini
2014-11-03 17:32 - 2014-11-03 17:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Call of Duty - United Offensive
2014-11-03 17:15 - 2014-11-03 17:15 - 00000795 _____ () C:\Users\UpdatusUser\Desktop\Call of Duty Mehrspieler.lnk
2014-11-03 17:15 - 2014-11-03 17:15 - 00000795 _____ () C:\Users\UpdatusUser\Desktop\Call of Duty Einzelspieler.lnk
2014-11-03 17:15 - 2014-11-03 17:15 - 00000795 _____ () C:\Users\Maiwald\Desktop\Call of Duty Mehrspieler.lnk
2014-11-03 17:15 - 2014-11-03 17:15 - 00000795 _____ () C:\Users\Maiwald\Desktop\Call of Duty Einzelspieler.lnk
2014-11-03 17:15 - 2014-11-03 17:15 - 00000745 _____ () C:\Windows\COD.INI
2014-11-03 17:15 - 2014-11-03 17:15 - 00000000 ____D () C:\Users\Maiwald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Call of Duty
2014-11-03 17:15 - 2014-11-03 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Call of Duty
2014-11-03 17:08 - 2014-11-03 17:32 - 00000000 ____D () C:\Program Files\Call of Duty
2014-11-03 17:03 - 2014-11-03 17:03 - 00000000 ____D () C:\Program Files\Common Files\InstallShield
2014-10-28 19:14 - 2014-10-28 19:14 - 00000000 ____D () C:\ProgramData\WindowsSearch
2014-10-24 20:47 - 2014-10-24 20:47 - 00001726 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-10-24 20:47 - 2014-10-24 20:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-10-24 20:47 - 2014-10-24 20:47 - 00000000 ____D () C:\Program Files\QuickTime
2014-10-24 15:00 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\system32\dhRichClient3.dll
2014-10-24 15:00 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\system32\sqlite36_engine.dll
2014-10-24 14:55 - 2014-10-24 14:55 - 72331056 _____ (Apple Inc.) C:\Users\Maiwald\Downloads\iCloudSetup.exe
2014-10-19 10:13 - 2014-10-19 10:13 - 00001664 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-10-19 10:13 - 2014-10-19 10:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-10-19 10:12 - 2014-10-19 10:13 - 00000000 ____D () C:\ProgramData\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB
2014-10-19 10:12 - 2014-10-19 10:13 - 00000000 ____D () C:\Program Files\iTunes
2014-10-19 10:12 - 2014-10-19 10:12 - 00000000 ____D () C:\Program Files\iPod
2014-10-15 19:36 - 2014-06-15 23:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 19:36 - 2014-06-13 19:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 19:36 - 2014-06-13 19:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-15 19:31 - 2014-09-05 00:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-13 20:58 - 2011-08-15 21:53 - 00000000 ____D () C:\Users\Maiwald
2014-11-13 20:31 - 2012-05-01 09:46 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-13 20:31 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2014-11-13 20:24 - 2008-01-21 02:35 - 01345748 _____ () C:\Windows\WindowsUpdate.log
2014-11-13 20:24 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-11-13 20:22 - 2008-01-21 08:16 - 01567488 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-13 20:15 - 2011-08-15 16:49 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-11-13 20:15 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-13 20:15 - 2006-11-02 13:47 - 00261312 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-13 20:15 - 2006-11-02 13:47 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-13 20:15 - 2006-11-02 13:47 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-13 20:14 - 2008-01-21 03:47 - 00077618 _____ () C:\Windows\PFRO.log
2014-11-13 20:13 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-13 20:12 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-11-13 19:21 - 2014-05-23 19:38 - 00001078 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-13 19:21 - 2014-05-23 19:38 - 00001066 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-11-13 19:21 - 2011-08-16 09:05 - 00001169 _____ () C:\Users\Maiwald\Desktop\Launch Internet Explorer Browser.lnk
2014-11-13 19:21 - 2011-08-15 21:53 - 00001199 _____ () C:\Users\Maiwald\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-13 18:05 - 2013-08-16 15:46 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-13 18:02 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-11-13 17:31 - 2012-05-01 09:46 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-13 17:31 - 2011-08-16 14:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-13 15:42 - 2014-05-23 19:38 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-11 18:11 - 2013-02-11 20:52 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-07 19:20 - 2013-01-13 18:24 - 00000000 ____D () C:\Program Files\Steam
2014-11-04 14:30 - 2011-08-15 17:47 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-03 17:34 - 2013-01-13 17:06 - 00103685 _____ () C:\Windows\DirectX.log
2014-11-03 17:34 - 2011-08-15 16:04 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-10-28 19:07 - 2013-01-13 18:24 - 00000000 ____D () C:\Program Files\Common Files\Steam
2014-10-26 15:58 - 2013-01-27 16:09 - 00000215 _____ () C:\Users\Maiwald\Desktop\Call of Duty Black Ops.url
2014-10-26 14:56 - 2013-01-27 16:09 - 00000215 _____ () C:\Users\Maiwald\Desktop\Call of Duty Black Ops - Multiplayer.url
2014-10-24 21:04 - 2012-09-05 16:56 - 00000000 ____D () C:\Program Files\Google
2014-10-24 21:03 - 2014-01-19 11:51 - 00000000 ____D () C:\Windows\pss
2014-10-24 21:00 - 2013-02-12 13:30 - 00000000 ____D () C:\Windows\Minidump
2014-10-24 20:52 - 2011-08-17 13:49 - 00034667 _____ () C:\Windows\AVMInstall.Log
2014-10-24 20:51 - 2014-05-14 17:57 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-10-24 20:51 - 2012-09-05 16:57 - 00000000 ____D () C:\Users\Maiwald\AppData\Local\Google
2014-10-24 18:47 - 2011-08-26 17:51 - 00000000 ____D () C:\Users\Maiwald\AppData\Local\Adobe
2014-10-19 10:12 - 2014-09-17 19:11 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-10-19 10:12 - 2012-01-12 18:23 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-10-15 18:23 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles

Some content of TEMP:
====================
C:\Users\Maiwald\AppData\Local\temp\sqlite3.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-13 20:20

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-11-2014
Ran by Maiwald at 2014-11-13 21:01:04
Running from C:\Users\Maiwald\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norman Security Suite (Enabled - Up to date) {F86A2F90-6CAD-D491-E1E0-29799D9EE21F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norman Security Suite (Enabled - Up to date) {430BCE74-4A97-DB1F-DB50-120BE619A8A2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{235EBB33-3DA1-46DF-AADE-9955123409CB}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.45 - Atheros Communications Inc.)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Call of Duty - United Offensive (HKLM\...\InstallShield_{A662E280-64A8-4CF5-8407-13D0808602B3}) (Version: 1.00.0000 - Activision)
Call of Duty - United Offensive (Version: 1.00.0000 - Activision) Hidden
Call of Duty (HKLM\...\Call of Duty) (Version:  - )
Call of Duty(R) 4 - Modern Warfare(TM) (HKLM\...\InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}) (Version: 1.00.0000 - Activision)
Call of Duty(R) 4 - Modern Warfare(TM) (Version: 1.00.0000 - Activision) Hidden
Call of Duty: Black Ops - Multiplayer (HKLM\...\Steam App 42710) (Version:  - Treyarch)
Call of Duty: Black Ops (HKLM\...\Steam App 42700) (Version:  - Treyarch)
DivX-Setup (HKLM\...\DivX Setup) (Version: 2.6.1.87 - DivX, LLC)
HP Photosmart 5510 series - Grundlegende Software für das Gerät (HKLM\...\{9951F1F7-773D-45FE-B6AE-FDFC481655B1}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Photosmart 5510 series Hilfe (HKLM\...\{E02964EA-0E1B-4620-A26E-CBAB0341B1BB}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
iCloud (HKLM\...\{79BD66B2-4DAE-4C3B-B08E-DC72E507C163}) (Version: 2.1.3.25 - Apple Inc.)
iTunes (HKLM\...\{5D928931-D1D2-4A93-A82D-BF60D0E7CFA5}) (Version: 12.0.1.26 - Apple Inc.)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 33.1 (x86 de) (HKLM\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Norman Security Suite (HKLM\...\{6A8BAF68-6748-4127-A437-D73D3A396EDE}) (Version: 9.01.0600 - Norman ASA)
NVIDIA 3D Vision Controller-Treiber 310.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 310.70 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.1031 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Safari (HKLM\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Steam (HKLM\...\Steam) (Version:  - Valve Corporation)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
webssearches uninstall (HKLM\...\webssearches uninstall) (Version:  - webssearches) <==== ATTENTION
WindowsMangerProtect20.0.0.1270 (HKLM\...\WindowsMangerProtect) (Version: 20.0.0.1270 - WindowsProtect LIMITED) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2958699206-1471774151-649911503-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Maiwald\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2958699206-1471774151-649911503-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maiwald\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2958699206-1471774151-649911503-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maiwald\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2958699206-1471774151-649911503-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maiwald\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2958699206-1471774151-649911503-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maiwald\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)

==================== Restore Points  =========================

17-09-2014 18:05:57 Gerätetreiber-Paketinstallation: Apple, Inc. USB-Controller
19-09-2014 14:31:18 Windows Update
23-09-2014 17:55:09 Windows Update
23-09-2014 19:05:10 Windows Update
30-09-2014 15:47:19 Windows Update
03-10-2014 16:52:14 Windows Update
08-10-2014 16:26:52 Windows Update
15-10-2014 17:24:02 Windows Update
15-10-2014 18:29:40 Windows Update
19-10-2014 08:36:42 Windows Update
24-10-2014 10:17:42 Windows Update
24-10-2014 19:53:30 Removed Angry Birds
28-10-2014 11:16:49 Windows Update
02-11-2014 16:55:49 Windows Update
03-11-2014 16:03:51 Installiert Call of Duty - United Offensive
03-11-2014 16:19:25 Installiert Call of Duty - United Offensive
07-11-2014 16:48:14 Windows Update
11-11-2014 15:24:56 Windows Update
13-11-2014 15:37:12 OpenOffice 4.1.1 wird installiert
13-11-2014 15:39:17 OpenOffice 4.1.1 wird installiert
13-11-2014 17:00:26 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2014-05-14 18:56 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {439CFC33-19FD-46DA-B7B0-A23DF7D3FF45} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-13] (Adobe Systems Incorporated)
Task: {8BD06F07-5754-4583-9375-57A8A44FCF61} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-01-19 12:22 - 2013-04-18 09:26 - 00946176 _____ () C:\Program Files\Norman\Ngs\Bin\sdklitewin.dll
2014-11-13 19:22 - 2014-11-13 19:22 - 00715656 _____ () C:\ProgramData\IePluginServices\PluginService.exe
2014-11-13 19:22 - 2014-11-13 19:22 - 00490640 _____ () C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
2014-02-12 19:58 - 2014-02-12 19:58 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-02-11 21:18 - 2012-10-17 16:03 - 00793520 _____ () C:\Program Files\Norman\Nvc\bin\nhs.exe
2013-01-13 17:04 - 2014-03-28 20:51 - 00066872 _____ () C:\Windows\system32\PnkBstrA.exe
2013-02-11 21:18 - 2013-02-13 13:20 - 00150120 _____ () C:\Program Files\Norman\Npm\Bin\Njeeves.exe
2013-02-11 21:18 - 2013-07-02 11:14 - 00218208 _____ () C:\Program Files\Norman\Npm\Bin\lua.dll
2014-11-13 19:22 - 2014-11-10 16:22 - 02242560 _____ () C:\Users\Maiwald\AppData\LocalLow\IE-BHO\bho.dll
2014-08-21 12:32 - 2014-11-13 19:22 - 00733576 _____ () C:\Program Files\SupTab\HpUI.exe
2011-09-02 12:37 - 2013-06-18 14:55 - 00302792 _____ () C:\Program Files\Norman\Npm\Bin\noemrc.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files\Common Files\Apple\Internet Services\libxml2.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 00237352 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxslt.dll
2014-05-23 19:38 - 2014-11-11 18:11 - 03649648 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-11-13 17:31 - 2014-11-13 17:31 - 16840880 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_223.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^Maiwald^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Maiwald^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Tintenwarnungen überwachen - HP Photosmart 5510 series.lnk => C:\Windows\pss\Tintenwarnungen überwachen - HP Photosmart 5510 series.lnk.Startup
MSCONFIG\startupreg: ApplePhotoStreams => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: com.apple.dav.bookmarks.daemon => C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
MSCONFIG\startupreg: DivXMediaServer => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: HP Photosmart 5510 series (NET) => "C:\Program Files\HP\HP Photosmart 5510 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN1BD25KF605NR:NW" -scfn "HP Photosmart 5510 series (NET)" -AutoStart 1
MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: iCloudServices => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime

========================= Accounts: ==========================

Administrator (S-1-5-21-2958699206-1471774151-649911503-500 - Administrator - Disabled)
Gast (S-1-5-21-2958699206-1471774151-649911503-501 - Limited - Disabled)
Maiwald (S-1-5-21-2958699206-1471774151-649911503-1000 - Administrator - Enabled) => C:\Users\Maiwald
UpdatusUser (S-1-5-21-2958699206-1471774151-649911503-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/13/2014 09:02:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6002.18005, Zeitstempel 0x49e01da5, fehlerhaftes Modul DropboxExt.22.dll, Version 1.0.0.22, Zeitstempel 0x522fb121, Ausnahmecode 0xc0000005, Fehleroffset 0x0000726b,
Prozess-ID 0xae4, Anwendungsstartzeit Explorer.EXE0.

Error: (11/13/2014 08:37:35 PM) (Source: Nvcoas) (EventID: 1) (User: )
Description: NVC OnAccess scanner error: Messaging system received an unknown alert

Error: (11/13/2014 08:16:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/13/2014 08:10:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung FlashPlayerPlugin_15_0_0_223.exe, Version 15.0.0.223, Zeitstempel 0x544ece05, fehlerhaftes Modul ShimEng.dll_unloaded, Version 0.0.0.0, Zeitstempel 0x4549bdb7, Ausnahmecode 0xc0000005, Fehleroffset 0x60ef4618,
Prozess-ID 0x1418, Anwendungsstartzeit FlashPlayerPlugin_15_0_0_223.exe0.

Error: (11/13/2014 08:10:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung FlashPlayerPlugin_15_0_0_223.exe, Version 15.0.0.223, Zeitstempel 0x544ece05, fehlerhaftes Modul ShimEng.dll_unloaded, Version 0.0.0.0, Zeitstempel 0x4549bdb7, Ausnahmecode 0xc0000005, Fehleroffset 0x60ef4618,
Prozess-ID 0x14a8, Anwendungsstartzeit FlashPlayerPlugin_15_0_0_223.exe0.

Error: (11/13/2014 08:09:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung FlashPlayerPlugin_15_0_0_223.exe, Version 15.0.0.223, Zeitstempel 0x544ece05, fehlerhaftes Modul ShimEng.dll_unloaded, Version 0.0.0.0, Zeitstempel 0x4549bdb7, Ausnahmecode 0xc0000005, Fehleroffset 0x60ef4618,
Prozess-ID 0xe78, Anwendungsstartzeit FlashPlayerPlugin_15_0_0_223.exe0.

Error: (11/13/2014 07:43:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung FlashPlayerPlugin_15_0_0_223.exe, Version 15.0.0.223, Zeitstempel 0x544ece05, fehlerhaftes Modul ShimEng.dll_unloaded, Version 0.0.0.0, Zeitstempel 0x4549bdb7, Ausnahmecode 0xc0000005, Fehleroffset 0x60ef4618,
Prozess-ID 0x1610, Anwendungsstartzeit FlashPlayerPlugin_15_0_0_223.exe0.

Error: (11/13/2014 07:43:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung FlashPlayerPlugin_15_0_0_223.exe, Version 15.0.0.223, Zeitstempel 0x544ece05, fehlerhaftes Modul ShimEng.dll_unloaded, Version 0.0.0.0, Zeitstempel 0x4549bdb7, Ausnahmecode 0xc0000005, Fehleroffset 0x60ef4618,
Prozess-ID 0x16a4, Anwendungsstartzeit FlashPlayerPlugin_15_0_0_223.exe0.

Error: (11/13/2014 07:35:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung FlashPlayerPlugin_15_0_0_223.exe, Version 15.0.0.223, Zeitstempel 0x544ece05, fehlerhaftes Modul ShimEng.dll_unloaded, Version 0.0.0.0, Zeitstempel 0x4549bdb7, Ausnahmecode 0xc0000005, Fehleroffset 0x60ef4618,
Prozess-ID 0x690, Anwendungsstartzeit FlashPlayerPlugin_15_0_0_223.exe0.

Error: (11/13/2014 07:35:15 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung FlashPlayerPlugin_15_0_0_223.exe, Version 15.0.0.223, Zeitstempel 0x544ece05, fehlerhaftes Modul ShimEng.dll_unloaded, Version 0.0.0.0, Zeitstempel 0x4549bdb7, Ausnahmecode 0xc0000005, Fehleroffset 0x60ef4618,
Prozess-ID 0x16c0, Anwendungsstartzeit FlashPlayerPlugin_15_0_0_223.exe0.


System errors:
=============
Error: (11/13/2014 08:18:01 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (11/13/2014 08:18:01 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330

Error: (11/13/2014 07:22:52 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: OpenService

Error: (11/13/2014 03:45:13 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (11/13/2014 03:45:13 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330

Error: (11/11/2014 04:34:38 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Definition Update for Windows Defender - KB915597 (Definition 1.187.1861.0){CF982BDC-E117-4273-A7D3-1EB6FA08FE89}200

Error: (11/11/2014 04:21:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (11/11/2014 04:21:21 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330

Error: (11/07/2014 05:58:33 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Definition Update for Windows Defender - KB915597 (Definition 1.187.1532.0){379451A4-C500-4641-B032-8F4CE0D2BD3B}200

Error: (11/07/2014 05:44:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069


Microsoft Office Sessions:
=========================
Error: (11/13/2014 09:02:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.0.6002.1800549e01da5DropboxExt.22.dll1.0.0.22522fb121c00000050000726bae401cfff7935e3e8db

Error: (11/13/2014 08:37:35 PM) (Source: Nvcoas) (EventID: 1) (User: )
Description: NVC OnAccess scanner error: Messaging system received an unknown alert

Error: (11/13/2014 08:16:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/13/2014 08:10:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_15_0_0_223.exe15.0.0.223544ece05ShimEng.dll_unloaded0.0.0.04549bdb7c000000560ef4618141801cfff75809ec71f

Error: (11/13/2014 08:10:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_15_0_0_223.exe15.0.0.223544ece05ShimEng.dll_unloaded0.0.0.04549bdb7c000000560ef461814a801cfff7571016ecf

Error: (11/13/2014 08:09:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_15_0_0_223.exe15.0.0.223544ece05ShimEng.dll_unloaded0.0.0.04549bdb7c000000560ef4618e7801cfff7565ee327f

Error: (11/13/2014 07:43:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_15_0_0_223.exe15.0.0.223544ece05ShimEng.dll_unloaded0.0.0.04549bdb7c000000560ef4618161001cfff71bdb8179f

Error: (11/13/2014 07:43:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_15_0_0_223.exe15.0.0.223544ece05ShimEng.dll_unloaded0.0.0.04549bdb7c000000560ef461816a401cfff71b15d672f

Error: (11/13/2014 07:35:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_15_0_0_223.exe15.0.0.223544ece05ShimEng.dll_unloaded0.0.0.04549bdb7c000000560ef461869001cfff7095a3202f

Error: (11/13/2014 07:35:15 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_15_0_0_223.exe15.0.0.223544ece05ShimEng.dll_unloaded0.0.0.04549bdb7c000000560ef461816c001cfff70912d015f


CodeIntegrity Errors:
===================================
  Date: 2014-05-17 17:39:21.176
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-17 17:39:21.021
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-17 17:39:20.874
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-17 17:39:20.426
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-17 17:39:19.755
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-17 17:39:19.615
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-17 17:39:19.459
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-17 17:39:19.271
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-17 17:27:21.918
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-16 13:48:01.471
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz
Percentage of memory in use: 74%
Total physical RAM: 2046.38 MB
Available physical RAM: 528.32 MB
Total Pagefile: 4339.81 MB
Available Pagefile: 2376.11 MB
Total Virtual: 2047.88 MB
Available Virtual: 1907.11 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:303.35 GB) (Free:166.93 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:150.69 GB) (Free:128.27 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 13ED8339)
Partition 1: (Not Active) - (Size=11.7 GB) - (Type=27)
Partition 2: (Active) - (Size=303.3 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=150.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-11-13 21:20:54
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-3 WDC_WD5000AAKS-07YGA0 rev.12.01C02 465,76GB
Running: tl3wn7gq.exe; Driver: C:\Users\Maiwald\AppData\Local\Temp\uwliifob.sys


---- System - GMER 2.1 ----

SSDT   \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys                                          ZwCreateFile [0x8E04FF36]
SSDT   \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys                                          ZwCreateProcess [0x8E04E95A]
SSDT   \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys                                          ZwCreateProcessEx [0x8E04E98A]
SSDT   \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys                                          ZwCreateThread [0x8E04E9BA]
SSDT   \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys                                          ZwSetSystemInformation [0x8E05008E]
SSDT   \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys                                          ZwTerminateProcess [0x8E04F792]
SSDT   \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys                                          ZwWriteVirtualMemory [0x8E04F9E8]
SSDT   \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys                                          ZwCreateThreadEx [0x8E04F048]
SSDT   \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys                                          ZwCreateUserProcess [0x8E04E4F0]

---- Kernel code sections - GMER 2.1 ----

.text  ntkrnlpa.exe!KeSetEvent + 1D9                                                            82AC9824 4 Bytes  [36, FF, 04, 8E] {INC DWORD [SS:ESI+ECX*4]}
.text  ntkrnlpa.exe!KeSetEvent + 209                                                            82AC9854 8 Bytes  [5A, E9, 04, 8E, 8A, E9, 04, ...] {POP EDX; JMP 0xe98a8e0a; ADD AL, 0x8e}
.text  ntkrnlpa.exe!KeSetEvent + 221                                                            82AC986C 4 Bytes  JMP FDA92675 
.text  ntkrnlpa.exe!KeSetEvent + 5DD                                                            82AC9C28 4 Bytes  [8E, 00, 05, 8E]
.text  ntkrnlpa.exe!KeSetEvent + 621                                                            82AC9C6C 4 Bytes  [92, F7, 04, 8E]
.text  ...                                                                                      

---- User code sections - GMER 2.1 ----

.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] ntdll.dll!LdrLoadDll                  77709348 5 Bytes  JMP 6A341F43 C:\Program Files\Mozilla Firefox\mozglue.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] ntdll.dll!NtCreateFile                77744220 5 Bytes  JMP 5662C6E0 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] ntdll.dll!NtFlushBuffersFile          77744720 5 Bytes  JMP 5632D3A3 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] ntdll.dll!NtQueryFullAttributesFile   77744C50 5 Bytes  JMP 5632D620 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] ntdll.dll!NtReadFile                  77744E80 5 Bytes  JMP 5632D400 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] ntdll.dll!NtReadFileScatter           77744E90 5 Bytes  JMP 56F56F6A C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] ntdll.dll!NtWriteFile                 77745490 5 Bytes  JMP 5662D5B0 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] ntdll.dll!NtWriteFileGather           777454A0 5 Bytes  JMP 56F56F19 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] kernel32.dll!HeapSetInformation + 26  770CA9B8 7 Bytes  JMP 5662913E C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] kernel32.dll!LockResource + C         770E6BD3 7 Bytes  JMP 56EBEAD2 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] kernel32.dll!VirtualAllocEx + 54      770EB030 7 Bytes  JMP 56EBEAF5 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] USER32.dll!GetWindowInfo              7607428E 5 Bytes  JMP 56DC5F20 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2392] GDI32.dll!SetStretchBltMode + 256     75DA745C 7 Bytes  JMP 56EBEA53 C:\Program Files\Mozilla Firefox\xul.dll

---- EOF - GMER 2.1 ----