Keylogger oder browsergestützter Trojaner?

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 28-01-2015
Ran by utopian at 2015-02-26 21:56:43
Running from C:\Users\utopian\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Ashampoo Burning Studio 15 (HKLM\...\{91B33C97-5B38-0A92-D04A-A0F26F3F87D4}_is1) (Version: 15.0.2 - Ashampoo GmbH & Co. KG)
Ashampoo Burning Studio FREE v.1.14.5 (HKLM\...\{91B33C97-91F8-FFB3-581B-BC952C901685}_is1) (Version: 1.14.5 - Ashampoo GmbH & Co. KG)
Avast Free Antivirus (HKLM\...\Avast) (Version: 10.0.2208 - AVAST Software)
Canon ScanGear Starter (HKLM\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version: - )
CanoScan Toolbox Ver4.9 (HKLM\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform)
DICOM Converter 1 (HKLM\...\DICOM Converter_is1) (Version: - DICOM Apps)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 15.3.20141009 - Landesfinanzdirektion Thüringen)
Final Media Player 2014 (HKLM\...\FinalMediaPlayer_is1) (Version: 2014.08.04.00 - Bitberry Software) <==== ATTENTION
Foxit Cloud (HKLM\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 2.8.49.213 - Foxit Software Inc.)
Foxit Reader (HKLM\...\Foxit Reader_is1) (Version: 7.0.6.1126 - Foxit Software Inc.)
FreeOCR v5.0 (HKLM\...\freeocr_is1) (Version: - )
Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Chrome Download Packages (HKU\S-1-5-21-1821304591-3013156229-3420743475-1001\...\Google Chrome Download Packages) (Version: - ) <==== ATTENTION
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Gpg4win (2.2.2) (HKLM\...\GPG4Win) (Version: 2.2.2 - The Gpg4win Project)
HP Deskjet 2540 series - Grundlegende Software für das Gerät (HKLM\...\{8A7CB3D4-0C49-4A19-8504-CF250CE1F5E8}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Deskjet 2540 series Hilfe (HKLM\...\{B3E5B153-CC4B-40F2-9802-288B0AF2A966}) (Version: 30.0.0 - Hewlett Packard)
HP FWUpdateEDO2 (HKLM\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photo Creations (HKLM\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0001 - Microsoft) Hidden
Macromedia Dreamweaver UltraDev 4 (HKLM\...\{ABDA9912-5D00-11D4-BAE7-9367CA097955}) (Version: 4.0 - Macromedia)
Macromedia Extension Manager (HKLM\...\{A5BA14E0-7384-11D4-BAE7-00409631A2C8}) (Version: 1.2 - Macromedia)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office (HKLM\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{4fd02573-5f12-4ae4-8027-c63f8e1115af}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
NVIDIA Grafiktreiber 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Pdf995 (HKLM\...\Pdf995) (Version: 14.2s - )
PdfEdit995 (HKLM\...\PdfEdit995) (Version: - )
PGP 8.1 (HKLM\...\PGP) (Version: - )
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
Signature995 (HKLM\...\Signature995) (Version: - )
Skype™ 7.1 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
Steganos Security Suite 4.15 (HKLM\...\{2F817DA7-545D-419F-AB8A-A25C2A19543A}) (Version: 4.15 - Steganos GmbH)
Studie zur Verbesserung von HP Deskjet 2540 series (HKLM\...\{FC16C025-71D3-430F-BE61-B7E713E5B582}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
The Bat! Professional v4.0.38 (HKLM\...\{207E4051-D715-4DFB-AD24-81C7EF3B49DB}) (Version: 4.0.38 - Ritlabs)
WinSCP 5.5.6 (HKLM\...\winscp3_is1) (Version: 5.5.6 - Martin Prikryl)
ZIPmagic (Version: 12.74 - Simon King) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1821304591-3013156229-3420743475-1001_Classes\CLSID\{49BBAA3C-C574-419E-8378-783C362E9C15}\InprocServer32 -> C:\Program Files\HP\Common\FWUpdateEDO2.dll (Hewlett-Packard Co.)

==================== Restore Points =========================

07-11-2014 08:02:59 Windows Update
11-11-2014 08:39:19 Windows Update
12-11-2014 15:18:09 Windows Update
19-11-2014 09:28:03 Windows Update
20-11-2014 07:33:19 Windows Modules Installer
25-11-2014 07:50:53 Windows Update
27-11-2014 08:27:12 avast! antivirus system restore point
28-11-2014 08:24:39 Windows Update
02-12-2014 09:51:58 Windows Update
05-12-2014 11:42:50 Windows Update
09-12-2014 09:56:22 Windows Update
10-12-2014 16:32:14 Installed ZIPmagic
10-12-2014 18:58:03 Windows Update
13-12-2014 00:14:18 Windows Update
16-12-2014 08:55:58 Windows Update
18-12-2014 23:36:06 Windows Update
23-12-2014 08:25:39 Windows Update
26-12-2014 09:29:37 Windows Update
30-12-2014 09:44:12 Windows Update
02-01-2015 10:43:12 Windows Update
06-01-2015 10:36:33 Windows Update
13-01-2015 19:27:35 Geplanter Prüfpunkt
14-01-2015 09:06:55 Windows Update
15-01-2015 00:15:17 Windows Update
20-01-2015 08:20:55 Windows Update
23-01-2015 09:21:15 Windows Update
27-01-2015 09:56:46 Windows Update
30-01-2015 12:37:27 Windows Update
03-02-2015 09:56:25 Windows Update
10-02-2015 09:40:47 Windows Update
11-02-2015 22:20:44 Windows Update
12-02-2015 10:26:42 Windows Update
17-02-2015 09:20:32 Windows Update
20-02-2015 10:12:05 Windows Update
24-02-2015 08:50:24 Windows Update
25-02-2015 23:37:58 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1B0C11E1-48C5-480D-8B4A-5676E0E1120B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-16] (Google Inc.)
Task: {4B7FD78F-9C42-4D23-932A-7523D5018C70} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-27] (AVAST Software)
Task: {8ED04241-1CCA-4E9B-B6CD-30CB004B8D6C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-10-30] (Piriform Ltd)
Task: {BA242375-537B-427F-A0C4-6CFA037DBBC8} - System32\Tasks\Final Media Player Update Checker => C:\Program Files\FinalMediaPlayer\FMPCheckForUpdates.exe [2013-03-25] (Bitberry Software)
Task: {BA48B30C-24FA-489D-83DE-EB40D92C0249} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-16] (Google Inc.)
Task: {CD6A6974-2E25-4C6D-B652-353173AA8DC1} - System32\Tasks\HPCustParticipation HP Deskjet 2540 series => C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Final Media Player Update Checker.job => C:\Program Files\FinalMediaPlayer\FMPCheckForUpdates.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2015-02-26 16:55 - 2015-02-26 16:55 - 02913792 _____ () C:\Program Files\AVAST Software\Avast\defs\15022600\algo.dll
2015-02-26 21:48 - 2015-02-26 21:48 - 02913792 _____ () C:\Program Files\AVAST Software\Avast\defs\15022601\algo.dll
2014-10-16 11:50 - 2013-01-31 10:00 - 00079648 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2014-10-23 08:05 - 2014-10-23 08:05 - 00036864 _____ () C:\Windows\System32\pdf995mon.dll
2014-09-03 12:07 - 2014-09-03 12:07 - 00216576 _____ () C:\Program Files\GNU\GnuPG\dirmngr.exe
2014-09-03 11:53 - 2014-09-03 11:53 - 00221184 _____ () C:\Program Files\GNU\GnuPG\libksba-8.dll
2014-09-03 11:48 - 2014-09-03 11:48 - 00038400 _____ () C:\Program Files\GNU\GnuPG\libgpg-error-0.dll
2014-09-03 11:41 - 2014-09-03 11:41 - 00050176 _____ () C:\Program Files\GNU\GnuPG\libw32pth-0.dll
2014-09-03 11:53 - 2014-09-03 11:53 - 00069632 _____ () C:\Program Files\GNU\GnuPG\libassuan-0.dll
2014-09-03 11:56 - 2014-09-03 11:56 - 00742400 _____ () C:\Program Files\GNU\GnuPG\libgcrypt-20.dll
2002-11-01 11:41 - 2002-11-01 11:41 - 00180224 _____ () c:\program files\steganos security suite 4\steganosshell4.dll
2014-11-27 08:28 - 2014-11-27 08:28 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2002-11-01 11:31 - 2002-11-01 11:31 - 00245760 _____ () C:\Program Files\Steganos Security Suite 4\SSS4.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-1821304591-3013156229-3420743475-500 - Administrator - Disabled)
Gast (S-1-5-21-1821304591-3013156229-3420743475-501 - Limited - Disabled)
utopian (S-1-5-21-1821304591-3013156229-3420743475-1001 - Administrator - Enabled) => C:\Users\utopian

==================== Faulty Device Manager Devices =============

Name: ccnfd_1_10_0_2
Description: ccnfd_1_10_0_2
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: ccnfd_1_10_0_2
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/26/2015 09:49:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: thebat.exe, Version: 4.0.38.0, Zeitstempel: 0x4926c400
Name des fehlerhaften Moduls: thebat.exe, Version: 4.0.38.0, Zeitstempel: 0x4926c400
Ausnahmecode: 0xc0000005
Fehleroffset: 0x004fdf2f
ID des fehlerhaften Prozesses: 0x900
Startzeit der fehlerhaften Anwendung: 0xthebat.exe0
Pfad der fehlerhaften Anwendung: thebat.exe1
Pfad des fehlerhaften Moduls: thebat.exe2
Berichtskennung: thebat.exe3

Error: (02/26/2015 09:48:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/26/2015 01:41:33 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (02/26/2015 01:41:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (02/26/2015 00:36:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: thebat.exe, Version: 4.0.38.0, Zeitstempel: 0x4926c400
Name des fehlerhaften Moduls: thebat.exe, Version: 4.0.38.0, Zeitstempel: 0x4926c400
Ausnahmecode: 0xc0000005
Fehleroffset: 0x004fdf2f
ID des fehlerhaften Prozesses: 0x11fc
Startzeit der fehlerhaften Anwendung: 0xthebat.exe0
Pfad der fehlerhaften Anwendung: thebat.exe1
Pfad des fehlerhaften Moduls: thebat.exe2
Berichtskennung: thebat.exe3

Error: (02/26/2015 08:57:18 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: thebat.exe, Version: 4.0.38.0, Zeitstempel: 0x4926c400
Name des fehlerhaften Moduls: thebat.exe, Version: 4.0.38.0, Zeitstempel: 0x4926c400
Ausnahmecode: 0xc0000005
Fehleroffset: 0x004fdf2f
ID des fehlerhaften Prozesses: 0x8e8
Startzeit der fehlerhaften Anwendung: 0xthebat.exe0
Pfad der fehlerhaften Anwendung: thebat.exe1
Pfad des fehlerhaften Moduls: thebat.exe2
Berichtskennung: thebat.exe3

Error: (02/26/2015 08:55:45 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
    Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/26/2015 08:55:45 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
    Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/26/2015 08:55:45 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
    Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/26/2015 08:55:45 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
    Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)


System errors:
=============
Error: (02/26/2015 09:48:36 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
ccnfd_1_10_0_2

Error: (02/26/2015 09:48:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "PGPserv" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (02/26/2015 09:48:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "PGPsdkDriver" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (02/26/2015 08:55:45 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/26/2015 08:55:45 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (02/26/2015 08:55:02 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
ccnfd_1_10_0_2

Error: (02/26/2015 08:55:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "PGPserv" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (02/26/2015 08:55:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "PGPsdkDriver" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (02/26/2015 08:54:16 AM) (Source: NetBT) (EventID: 4300) (User: )
Description: Der Treiber konnte nicht erstellt werden.

Error: (02/26/2015 08:54:16 AM) (Source: NetBT) (EventID: 4300) (User: )
Description: Der Treiber konnte nicht erstellt werden.


Microsoft Office Sessions:
=========================
Error: (02/26/2015 09:49:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: thebat.exe4.0.38.04926c400thebat.exe4.0.38.04926c400c0000005004fdf2f90001d05205a7fb48e3C:\Program Files\The Bat!\thebat.exeC:\Program Files\The Bat!\thebat.exe01563453-bdf9-11e4-8afb-00016c64c202

Error: (02/26/2015 09:48:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/26/2015 01:41:33 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Deskjet 2540 series\DriverStore\Yeti\V3\amd64\hpinkinsC211.exe

Error: (02/26/2015 01:41:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\pdf995\res\drivedir\copy64.exe

Error: (02/26/2015 00:36:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: thebat.exe4.0.38.04926c400thebat.exe4.0.38.04926c400c0000005004fdf2f11fc01d051b86d38cc59C:\Program Files\The Bat!\thebat.exeC:\Program Files\The Bat!\thebat.exec178f66f-bdab-11e4-a344-00016c64c202

Error: (02/26/2015 08:57:18 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: thebat.exe4.0.38.04926c400thebat.exe4.0.38.04926c400c0000005004fdf2f8e801d05199ac8c359aC:\Program Files\The Bat!\thebat.exeC:\Program Files\The Bat!\thebat.exe1570bc74-bd8d-11e4-a344-00016c64c202

Error: (02/26/2015 08:55:45 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: 
Details:
    Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/26/2015 08:55:45 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
    Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/26/2015 08:55:45 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
    Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (02/26/2015 08:55:45 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
    Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer


==================== Memory info =========================== 

Processor: Pentium(R) Dual-Core CPU E5300 @ 2.60GHz
Percentage of memory in use: 38%
Total physical RAM: 2046.18 MB
Available physical RAM: 1257.27 MB
Total Pagefile: 4092.36 MB
Available Pagefile: 3048.84 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.82 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:232.88 GB) (Free:16.18 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: A3D396EF)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-01-2015 (ATTENTION: ====> FRST version is 29 days old and could be outdated)
Ran by utopian (administrator) on UTOPIA_NIEMAND on 26-02-2015 21:55:57
Running from C:\Users\utopian\Desktop
Loaded Profiles: utopian (Available profiles: utopian)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files\GNU\GnuPG\dirmngr.exe
(Foxit Software Inc.) C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Steganos) C:\Program Files\Steganos Security Suite 4\Steganos4.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Ritlabs S.R.L.) C:\Program Files\The Bat!\thebat.exe
(Foxit Software Inc.) C:\Program Files\Foxit Software\Foxit Reader\FoxitReader.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12021464 2014-05-09] (Realtek Semiconductor)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-23] (AVAST Software)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-1821304591-3013156229-3420743475-1001\...\Run: [SDE] => C:\Program Files\Steganos Security Suite 4\sde.exe [581632 2002-11-01] (Steganos GmbH)
HKU\S-1-5-21-1821304591-3013156229-3420743475-1001\...\Run: [SSS] => C:\Program Files\Steganos Security Suite 4\steganos4.exe [1687552 2002-11-01] (Steganos)
HKU\S-1-5-21-1821304591-3013156229-3420743475-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [4826904 2014-10-30] (Piriform Ltd)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-10-16]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\utopian\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\utopian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-16]
CHR Extension: (Google Drive) - C:\Users\utopian\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-16]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\utopian\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-16]
CHR Extension: (YouTube) - C:\Users\utopian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-16]
CHR Extension: (Adblock for Youtube™) - C:\Users\utopian\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk [2014-12-25]
CHR Extension: (Google-Suche) - C:\Users\utopian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-16]
CHR Extension: (Avast Online Security) - C:\Users\utopian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-10-16]
CHR Extension: (Google Wallet) - C:\Users\utopian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-16]
CHR Extension: (Google Mail) - C:\Users\utopian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-16]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-27]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-27] (AVAST Software)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3192344 2014-11-27] (Avast Software)
R2 DirMngr; C:\Program Files\GNU\GnuPG\dirmngr.exe [216576 2014-09-03] () [File not signed]
R2 FoxitCloudUpdateService; C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [243880 2015-02-13] (Foxit Software Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-12-20] (Microsoft Corporation)
S2 PGPserv; C:\Windows\system32\PGPserv.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-11-27] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-11-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-11-27] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-11-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-11-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423784 2014-11-27] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [91496 2014-11-27] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2014-11-27] ()
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [218192 2014-11-27] (Avast Software)
S1 ccnfd_1_10_0_2; system32\drivers\ccnfd_1_10_0_2.sys [X]
S2 PGPsdkDriver; System32\Drivers\PGPsdk.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-26 21:55 - 2015-02-26 21:56 - 00007831 _____ () C:\Users\utopian\Desktop\FRST.txt
2015-02-26 21:55 - 2015-02-26 21:55 - 00000248 _____ () C:\Users\utopian\Desktop\defogger_enable.log
2015-02-26 21:55 - 2015-02-26 21:55 - 00000000 ____D () C:\FRST
2015-02-26 21:54 - 2015-02-26 21:54 - 00000476 _____ () C:\Users\utopian\Desktop\defogger_disable.log
2015-02-26 21:48 - 2015-02-26 21:48 - 00000022 _____ () C:\Windows\S.dirmngr
2015-02-26 17:32 - 2015-02-26 17:32 - 00380416 _____ () C:\Users\utopian\Desktop\Gmer-19357.exe
2015-02-26 17:31 - 2015-02-26 17:31 - 01121280 _____ (Farbar) C:\Users\utopian\Desktop\FRST.exe
2015-02-26 17:30 - 2015-02-26 17:30 - 00050477 _____ () C:\Users\utopian\Desktop\Defogger.exe
2015-02-26 17:15 - 2015-02-26 17:16 - 23579536 _____ (Wireshark development team) C:\Users\utopian\Downloads\Wireshark-win32-1.12.3.exe
2015-02-26 12:00 - 2015-02-26 12:00 - 00000027 _____ () C:\Users\utopian\Desktop\marianne.txt
2015-02-26 10:38 - 2015-02-26 10:38 - 00551913 _____ () C:\Users\utopian\Downloads\BMZ Bund (@BMZ_Bund) Twitter.html
2015-02-26 10:38 - 2015-02-26 10:38 - 00000000 ____D () C:\Users\utopian\Downloads\BMZ Bund (@BMZ_Bund) Twitter_files
2015-02-26 09:22 - 2015-02-26 09:23 - 00000067 _____ () C:\Users\utopian\Desktop\BBKKaspari.txt
2015-02-25 23:38 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-25 11:50 - 2015-02-25 11:50 - 00000000 ____D () C:\Users\utopian\Desktop\Schlaf
2015-02-25 11:28 - 2015-02-25 12:49 - 00000000 ____D () C:\Users\utopian\Desktop\EvergreenConesta_korian
2015-02-24 15:45 - 2015-02-24 15:45 - 00347136 _____ () C:\Users\utopian\Downloads\PNAS 2008 Sep 105(39) 15160-5, Fig. 3.ppt
2015-02-24 13:10 - 2015-02-24 13:11 - 00702976 _____ () C:\Users\utopian\Desktop\MS_praesifebr15united.ppt
2015-02-24 09:30 - 2015-02-24 09:30 - 00000256 _____ () C:\Users\utopian\Desktop\braun.txt
2015-02-22 22:48 - 2015-02-22 22:54 - 00000247 _____ () C:\Windows\system32\2015-02-22-21-48-28.090-aswFe.exe-5596.log
2015-02-22 20:26 - 2015-02-22 20:26 - 00076127 _____ () C:\Users\utopian\Desktop\fbB-eMvfGCUAAP1C6.jpg-large
2015-02-22 11:58 - 2015-02-22 11:59 - 00000197 _____ () C:\Windows\system32\2015-02-22-10-58-36.051-AvastVBoxSVC.exe-2328.log
2015-02-21 14:59 - 2015-02-21 14:59 - 00000000 ____D () C:\Users\utopian\AppData\Local\Foxit Reader
2015-02-21 10:25 - 2015-02-21 10:25 - 00000197 _____ () C:\Windows\system32\2015-02-21-09-25-28.097-AvastVBoxSVC.exe-2204.log
2015-02-20 10:40 - 2015-02-20 12:02 - 00000231 _____ () C:\Users\utopian\Desktop\wfgrheinerft.txt
2015-02-19 22:32 - 2015-02-19 22:32 - 00000197 _____ () C:\Windows\system32\2015-02-19-21-32-26.010-AvastVBoxSVC.exe-2144.log
2015-02-19 16:51 - 2015-02-19 16:51 - 00000000 ____D () C:\Users\utopian\Documents\Ashampoo Burning Studio 15
2015-02-19 13:36 - 2015-02-19 13:58 - 951764992 _____ () C:\Users\utopian\Downloads\tails-i386-1.2.3.iso
2015-02-19 09:45 - 2015-02-19 09:45 - 00000197 _____ () C:\Windows\system32\2015-02-19-08-45-01.006-AvastVBoxSVC.exe-2104.log
2015-02-18 08:41 - 2015-02-18 08:42 - 00000197 _____ () C:\Windows\system32\2015-02-18-07-41-26.096-AvastVBoxSVC.exe-2128.log
2015-02-17 21:39 - 2015-02-17 21:39 - 00000197 _____ () C:\Windows\system32\2015-02-17-20-39-17.026-AvastVBoxSVC.exe-2132.log
2015-02-17 09:18 - 2015-02-17 09:18 - 00000197 _____ () C:\Windows\system32\2015-02-17-08-18-04.061-AvastVBoxSVC.exe-2152.log
2015-02-16 16:33 - 2015-02-16 16:33 - 00000197 _____ () C:\Windows\system32\2015-02-16-15-33-44.002-AvastVBoxSVC.exe-2152.log
2015-02-16 09:53 - 2015-02-16 09:53 - 00000197 _____ () C:\Windows\system32\2015-02-16-08-53-01.049-AvastVBoxSVC.exe-2224.log
2015-02-15 23:37 - 2015-02-15 23:37 - 00000197 _____ () C:\Windows\system32\2015-02-15-22-37-42.027-AvastVBoxSVC.exe-2176.log
2015-02-15 12:29 - 2015-02-15 12:29 - 00000197 _____ () C:\Windows\system32\2015-02-15-11-29-52.014-AvastVBoxSVC.exe-2236.log
2015-02-15 09:55 - 2015-02-15 09:56 - 00000197 _____ () C:\Windows\system32\2015-02-15-08-55-25.089-AvastVBoxSVC.exe-2344.log
2015-02-14 15:32 - 2015-02-14 15:33 - 00000197 _____ () C:\Windows\system32\2015-02-14-14-32-23.075-AvastVBoxSVC.exe-2144.log
2015-02-14 09:58 - 2015-02-14 09:58 - 00000197 _____ () C:\Windows\system32\2015-02-14-08-58-25.037-AvastVBoxSVC.exe-2148.log
2015-02-13 09:07 - 2015-02-13 09:07 - 00000197 _____ () C:\Windows\system32\2015-02-13-08-07-49.070-AvastVBoxSVC.exe-2104.log
2015-02-12 20:44 - 2015-02-12 20:44 - 02391693 _____ () C:\Users\utopian\Downloads\07-097_Reference_Model_for_the_ORCHESTRA_Architecture_V2_Rev._2.1.zip
2015-02-12 14:56 - 2015-02-12 14:56 - 00000197 _____ () C:\Windows\system32\2015-02-12-13-56-12.065-AvastVBoxSVC.exe-2288.log
2015-02-12 12:43 - 2015-02-12 12:43 - 00000247 _____ () C:\Windows\system32\2015-02-12-11-43-28.095-aswFe.exe-4868.log
2015-02-12 12:36 - 2015-02-12 12:43 - 00000247 _____ () C:\Windows\system32\2015-02-12-11-36-40.071-aswFe.exe-4852.log
2015-02-12 12:36 - 2015-02-12 12:36 - 00000197 _____ () C:\Windows\system32\2015-02-12-11-36-33.018-AvastVBoxSVC.exe-4032.log
2015-02-12 08:47 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 08:47 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 08:41 - 2015-02-12 08:42 - 00000197 _____ () C:\Windows\system32\2015-02-12-07-41-58.026-AvastVBoxSVC.exe-1276.log
2015-02-11 09:16 - 2015-01-09 02:45 - 02380288 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 09:15 - 2015-02-04 03:54 - 00482304 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 09:15 - 2015-02-04 03:53 - 00767488 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 09:15 - 2015-02-04 03:53 - 00621056 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 09:15 - 2015-02-04 03:53 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 09:15 - 2015-02-04 03:53 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 09:15 - 2015-02-04 03:53 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 09:15 - 2015-02-04 03:49 - 00886784 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 09:15 - 2015-01-28 00:36 - 01167520 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 09:15 - 2015-01-15 08:46 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 09:15 - 2015-01-15 08:46 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 09:15 - 2015-01-15 08:43 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 09:15 - 2015-01-15 08:43 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 09:15 - 2015-01-15 08:42 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 09:15 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 09:15 - 2015-01-15 08:42 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 09:15 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 09:15 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 09:15 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 09:15 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 09:15 - 2015-01-15 05:21 - 00369968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 09:15 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-02-11 09:15 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 09:15 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 09:15 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 09:15 - 2015-01-12 03:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 09:15 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 09:15 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 09:15 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 09:15 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 09:15 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 09:15 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 09:15 - 2015-01-12 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 09:15 - 2015-01-12 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 09:15 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 09:15 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 09:15 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 09:15 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 09:15 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 09:15 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 09:15 - 2015-01-12 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 09:15 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 09:15 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 09:15 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 09:15 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 09:15 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 09:15 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 09:15 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 09:15 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 09:15 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 09:15 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 09:15 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 09:15 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 09:14 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 09:14 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 09:14 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 09:14 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 09:14 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 09:14 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 09:14 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 09:14 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 09:14 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 09:14 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 09:14 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 09:07 - 2015-02-11 09:07 - 00000197 _____ () C:\Windows\system32\2015-02-11-08-07-20.090-AvastVBoxSVC.exe-2168.log
2015-02-10 17:01 - 2015-02-10 17:01 - 00050866 _____ () C:\Users\utopian\Downloads\B9Bh5oLIYAEheUL.jpg-large
2015-02-10 09:37 - 2015-02-10 09:37 - 00000197 _____ () C:\Windows\system32\2015-02-10-08-37-19.049-AvastVBoxSVC.exe-2212.log
2015-02-09 20:25 - 2015-02-09 20:25 - 00000197 _____ () C:\Windows\system32\2015-02-09-19-25-04.071-AvastVBoxSVC.exe-2192.log
2015-02-09 09:48 - 2015-02-09 09:48 - 00000197 _____ () C:\Windows\system32\2015-02-09-08-48-17.087-AvastVBoxSVC.exe-2104.log
2015-02-08 22:06 - 2015-02-08 22:06 - 00000197 _____ () C:\Windows\system32\2015-02-08-21-06-47.031-AvastVBoxSVC.exe-2304.log
2015-02-07 17:49 - 2015-02-23 12:02 - 00000000 ____D () C:\Users\utopian\Desktop\SocialMediaRefBAKFebr15
2015-02-07 10:28 - 2015-02-07 10:34 - 00008639 _____ () C:\Users\utopian\Desktop\uebrtrsicht.ods
2015-02-07 10:15 - 2015-02-07 10:15 - 00000197 _____ () C:\Windows\system32\2015-02-07-09-15-49.064-AvastVBoxSVC.exe-2212.log
2015-02-06 23:21 - 2015-02-06 23:21 - 00000197 _____ () C:\Windows\system32\2015-02-06-22-21-30.077-AvastVBoxSVC.exe-2204.log
2015-02-06 17:39 - 2015-02-06 17:39 - 00000197 _____ () C:\Windows\system32\2015-02-06-16-39-03.000-AvastVBoxSVC.exe-2116.log
2015-02-06 08:33 - 2015-02-06 08:33 - 00000197 _____ () C:\Windows\system32\2015-02-06-07-33-11.070-AvastVBoxSVC.exe-2088.log
2015-02-05 22:06 - 2015-02-05 22:06 - 00000197 _____ () C:\Windows\system32\2015-02-05-21-06-54.087-AvastVBoxSVC.exe-2204.log
2015-02-05 09:15 - 2015-02-05 09:16 - 00000197 _____ () C:\Windows\system32\2015-02-05-08-15-59.027-AvastVBoxSVC.exe-2056.log
2015-02-04 21:59 - 2015-02-04 22:00 - 00000197 _____ () C:\Windows\system32\2015-02-04-20-59-36.004-AvastVBoxSVC.exe-2296.log
2015-02-04 10:21 - 2015-02-04 11:08 - 00000096 _____ () C:\Users\utopian\Desktop\sofort.txt
2015-02-04 08:58 - 2015-02-04 08:58 - 00000197 _____ () C:\Windows\system32\2015-02-04-07-58-37.025-AvastVBoxSVC.exe-2092.log
2015-02-03 09:52 - 2015-02-03 09:53 - 00000197 _____ () C:\Windows\system32\2015-02-03-08-52-26.098-AvastVBoxSVC.exe-2052.log
2015-02-02 20:11 - 2015-02-02 20:12 - 00000197 _____ () C:\Windows\system32\2015-02-02-19-11-37.015-AvastVBoxSVC.exe-2124.log
2015-02-02 12:49 - 2015-02-02 12:49 - 00000120 _____ () C:\Users\utopian\Desktop\SPDOVABTRKto.txt
2015-02-02 09:28 - 2015-02-02 09:29 - 00000197 _____ () C:\Windows\system32\2015-02-02-08-28-28.055-AvastVBoxSVC.exe-2184.log
2015-01-31 16:31 - 2015-01-31 16:32 - 80239907 _____ (The Scribus Team) C:\Users\utopian\Downloads\scribus-1.4.5-windows.exe
2015-01-31 10:16 - 2015-01-31 10:16 - 00000197 _____ () C:\Windows\system32\2015-01-31-09-16-24.099-AvastVBoxSVC.exe-2144.log
2015-01-30 12:35 - 2015-01-30 12:35 - 00000197 _____ () C:\Windows\system32\2015-01-30-11-35-41.037-AvastVBoxSVC.exe-2096.log
2015-01-29 15:20 - 2015-01-29 15:21 - 00000197 _____ () C:\Windows\system32\2015-01-29-14-20-48.065-AvastVBoxSVC.exe-2172.log
2015-01-29 09:32 - 2015-01-29 09:32 - 00000197 _____ () C:\Windows\system32\2015-01-29-08-32-33.018-AvastVBoxSVC.exe-2084.log
2015-01-28 09:44 - 2015-01-28 09:44 - 00000197 _____ () C:\Windows\system32\2015-01-28-08-44-21.013-AvastVBoxSVC.exe-2124.log
2015-01-27 14:24 - 2015-01-27 14:24 - 00000197 _____ () C:\Windows\system32\2015-01-27-13-24-36.034-AvastVBoxSVC.exe-2188.log
2015-01-27 11:07 - 2015-01-27 11:07 - 00091337 _____ () C:\Users\utopian\Downloads\Nachbarschaftskampagne fuer 23-01-2015.pptx
2015-01-27 09:52 - 2015-01-27 09:53 - 00000197 _____ () C:\Windows\system32\2015-01-27-08-52-43.023-AvastVBoxSVC.exe-736.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-26 21:55 - 2014-10-16 11:37 - 00000000 ____D () C:\Users\utopian
2015-02-26 21:55 - 2009-07-14 05:34 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-26 21:55 - 2009-07-14 05:34 - 00028720 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-26 21:51 - 2014-10-16 11:31 - 01941979 _____ () C:\Windows\WindowsUpdate.log
2015-02-26 21:50 - 2014-10-16 15:09 - 00000000 ____D () C:\Users\utopian\AppData\Roaming\The Bat!
2015-02-26 21:48 - 2014-10-31 15:26 - 00000390 _____ () C:\Windows\Tasks\Final Media Player Update Checker.job
2015-02-26 21:48 - 2014-10-16 13:27 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-26 21:48 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-26 21:48 - 2009-07-14 05:39 - 00080788 _____ () C:\Windows\setupact.log
2015-02-26 17:34 - 2014-10-16 13:27 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-24 14:59 - 2010-11-20 22:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-21 18:28 - 2014-09-23 09:54 - 00000000 ____D () C:\Users\utopian\Desktop\Ged_B
2015-02-21 15:02 - 2014-10-16 13:21 - 00000000 ____D () C:\Users\utopian\DatenGiota
2015-02-20 21:16 - 2015-01-11 11:05 - 00001976 _____ () C:\Users\Public\Desktop\HP Print and Scan Doctor.lnk
2015-02-20 13:49 - 2014-10-23 08:05 - 00000059 _____ () C:\Windows\wpd99.drv
2015-02-18 20:32 - 2013-05-27 09:57 - 00000000 ____D () C:\Users\utopian\Desktop\Fi_Youtube
2015-02-17 09:15 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-15 21:04 - 2014-10-16 11:48 - 00000000 ____D () C:\Users\utopian\DatenPapa
2015-02-12 20:03 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2015-02-12 14:58 - 2015-01-19 13:58 - 00000000 ____D () C:\Users\utopian\Desktop\CCCleanerBackup
2015-02-12 08:41 - 2009-07-14 05:33 - 00286616 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 08:39 - 2014-12-10 19:07 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 08:39 - 2014-10-18 05:54 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 08:39 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-02-11 22:27 - 2014-10-17 08:04 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 22:24 - 2014-10-17 08:03 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-09 20:19 - 2014-10-16 16:28 - 00000000 ___RD () C:\Program Files\Skype
2015-02-09 20:19 - 2014-10-16 16:28 - 00000000 ____D () C:\Users\utopian\AppData\Roaming\Skype
2015-02-09 20:19 - 2014-10-16 16:28 - 00000000 ____D () C:\ProgramData\Skype
2015-02-03 10:10 - 2015-01-15 12:41 - 00013857 _____ () C:\Users\utopian\Desktop\SPDAbtretungenRest.ods
2015-01-28 14:50 - 2015-01-16 11:46 - 00000000 ____D () C:\Users\utopian\Desktop\Jan15_runningAppl
2015-01-28 13:20 - 2014-09-09 11:12 - 00054156 _____ () C:\Users\utopian\Desktop\webde.odt

==================== Files in the root of some directories =======

2014-10-22 09:29 - 2014-12-19 13:55 - 0000600 _____ () C:\Users\utopian\AppData\Roaming\winscp.rnd
2014-10-18 14:29 - 2014-10-18 14:29 - 0007600 _____ () C:\Users\utopian\AppData\Local\Resmon.ResmonCfg
2014-10-31 13:06 - 2014-10-31 13:06 - 0000057 _____ () C:\ProgramData\Ament.ini
2014-09-19 07:03 - 2014-09-19 07:03 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-23 10:24

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-26 22:25:59
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 SAMSUNG_HD252HJ rev.1AC01118 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\utopian\AppData\Local\Temp\agrcyaod.sys


---- System - GMER 2.1 ----

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAddBootEntry [0x8DE30AC4]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwAllocateVirtualMemory [0x8DEEC0BA]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAssignProcessToJobObject [0x8DE315A2]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEvent [0x8DE3D63C]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEventPair [0x8DE3D688]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateIoCompletion [0x8DE3D822]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateMutant [0x8DE3D5AA]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateSection [0x8DEEC494]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSemaphore [0x8DE3D5F2]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateThread [0x8DEEC724]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateThreadEx [0x8DEEC80E]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateTimer [0x8DE3D7DC]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDebugActiveProcess [0x8DE32390]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteBootEntry [0x8DE30B2A]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDuplicateObject [0x8DE35B86]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwLoadDriver [0x8DE30716]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwMapViewOfSection [0x8DEEC574]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwModifyBootEntry [0x8DE30B90]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeKey [0x8DE35F7C]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeMultipleKeys [0x8DE32E78]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEvent [0x8DE3D666]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEventPair [0x8DE3D6AA]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenIoCompletion [0x8DE3D846]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenMutant [0x8DE3D5D0]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenProcess [0x8DE3547E]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSection [0x8DE3D75A]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSemaphore [0x8DE3D61A]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenThread [0x8DE3586A]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenTimer [0x8DE3D800]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwProtectVirtualMemory [0x8DEEC312]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryObject [0x8DE32CEC]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueueApcThreadEx [0x8DE329FA]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootEntryOrder [0x8DE30BF6]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootOptions [0x8DE30C5C]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwSetContextThread [0x8DEEC670]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemInformation [0x8DE307B0]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemPowerState [0x8DE30982]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwShutdownSystem [0x8DE30910]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendProcess [0x8DE3255A]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendThread [0x8DE326BC]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSystemDebugControl [0x8DE30A0A]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwTerminateProcess [0x8DEEC3E0]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateThread [0x8DE321EA]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwVdmControl [0x8DE30CC2]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwWriteVirtualMemory [0x8DEEC244]

---- Kernel code sections - GMER 2.1 ----

.text ntkrnlpa.exe!ZwRequestWaitReplyPort + 1495 82C4A9E5 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C84312 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 10CB 82C8B550 4 Bytes [C4, 0A, E3, 8D] {LES ECX, [EDX]; JECXZ 0xffffff91}
.text ntkrnlpa.exe!KeRemoveQueueEx + 10F3 82C8B578 4 Bytes [BA, C0, EE, 8D]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1153 82C8B5D8 4 Bytes [A2, 15, E3, 8D]
.text ntkrnlpa.exe!KeRemoveQueueEx + 11A7 82C8B62C 8 Bytes [3C, D6, E3, 8D, 88, D6, E3, ...] {CMP AL, 0xd6; JECXZ 0xffffff91; MOV DH, DL; JECXZ 0xffffff95}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11B3 82C8B638 4 Bytes [22, D8, E3, 8D] {AND BL, AL; JECXZ 0xffffff91}
.text ... 

---- User code sections - GMER 2.1 ----

.text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1264] kernel32.dll!SetUnhandledExceptionFilter 75B3F5AB 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text C:\Program Files\AVAST Software\Avast\avastui.exe[3184] kernel32.dll!SetUnhandledExceptionFilter 75B3F5AB 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015833d0a57 
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015833d0a57@001ccc507781 0x1C 0x74 0x5E 0x88 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\240a64b63587 
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015833d0a57 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015833d0a57@001ccc507781 0x1C 0x74 0x5E 0x88 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\240a64b63587 (not active ControlSet) 
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active 
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@EAE370D5 282

---- EOF - GMER 2.1 ----