Hallo zusammen,
habe das Problem,dass sich beim browsen ungefragt Tabs und Pop Ups öffenen. Habe in weiser Voraussicht schon einmal mit Farbar gescannt (hatte das Thema vor ein paar Tagen bereits mit meinem Desktop PC besprochen.

Hier FRST
FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2013
Ran by NACHNAME (administrator) on 25-07-2013 08:07:03
Running from C:\Users\NACHNAME\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(IDT, Inc.) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe
(Hewlett-Packard Company) C:\windows\system32\Hpservice.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(ActivIdentity) C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
(Andrea Electronics Corporation) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Development Company, L.P) c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Hewlett-Packard Company) c:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(SonicWALL, Inc.) C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(McAfee, Inc.) c:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe
(DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\acevents.exe
(ActivIdentity) C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2010-01-08] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1691192 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [acevents] - C:\Program Files\ActivIdentity\ActivClient\acevents.exe [196648 2009-06-04] (ActivIdentity)
HKLM\...\Run: [] -  [x]
HKLM\...\Run: [accrdsub] - C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [483880 2009-06-04] (ActivIdentity)
HKLM\...\Run: [Trend Micro Client Framework] - C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [204584 2011-03-26] (Trend Micro Inc.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-03-17] (IDT, Inc.)
HKLM-x32\...\runonceex: [ContentMerger] - c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\ContentMerger10.exe [19952 2009-11-23] (Sonic Solutions)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-11-03] (Google Inc.)
MountPoints2: {1febc0b2-7e9b-11e1-8eff-e02a82f6b77c} - D:\LaunchU3.exe -a
HKLM-x32\...\Run: [File Sanitizer] - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11266048 2010-01-19] (Hewlett-Packard)
HKLM-x32\...\Run: [IMSS] - "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [111640 2010-03-04] ()
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-02-25] (PDF Complete Inc)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [79192 2011-02-18] (Research In Motion Limited)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-11-13] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe /start [333728 2012-06-20] (Hewlett-Packard Company)
HKLM-x32\...\Run: [] -  [x]
HKU\Default\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-10] ()
HKU\Default User\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-10] ()
HKU\Mahler\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-10] ()
HKU\Mahler\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\User\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2736128 2010-05-19] (Hewlett-Packard Company)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCOM/10
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCOM/10
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.uk.msn.com/HPCOM/10
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCOM/10
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.uk.msn.com/HPCOM/10
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {72EFFCD5-7C96-4B9A-A7D2-4C3C08E9FE8D} URL = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {72EFFCD5-7C96-4B9A-A7D2-4C3C08E9FE8D} URL = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1165\6.6.1081\TmIEPlg.dll (Trend Micro Inc.)
BHO: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg64.dll (Google Inc.)
BHO-x32: EabookBiRoowsEu - {13AD5579-1C22-1DE7-0A2C-07D793B33C27} - C:\ProgramData\EabookBiRoowsEu\51cc80ddecbaf.dll ()
BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1165\6.6.1081\TmIEPlg32.dll (Trend Micro Inc.)
BHO-x32: File Sanitizer for HP ProtectTools - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: safEE  save - {95A8BE25-6AC6-5B5F-5296-7C0F67939A04} - C:\ProgramData\safEE  save\51cc75326a286.dll ()
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {00134F72-5284-44F7-95A8-52A619F70751} https://dc1:4343/officescan/console/...l/WinNTChk.cab
DPF: HKLM-x32 {08D75BB0-D2B5-11D1-88FC-0080C859833B} https://dc1:4343/officescan/console/...l/setupini.cab
DPF: HKLM-x32 {08D75BC1-D2B5-11D1-88FC-0080C859833B} https://dc1:4343/officescan/console/...tall/setup.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/s...irector/sw.cab
DPF: HKLM-x32 {5EFE8CB1-D095-11D1-88FC-0080C859833B} https://dc1:4343/officescan/console/...RemoveCtrl.cab
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1165\6.6.1081\TmIEPlg.dll (Trend Micro Inc.)
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1165\6.6.1081\TmIEPlg32.dll (Trend Micro Inc.)
Handler-x32: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Client Server Security Agent\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\NACHNAME\AppData\Roaming\Mozilla\Firefox\Profiles\pr2p6ukj.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60129.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: safEE  save - C:\Users\NACHNAME\AppData\Roaming\Mozilla\Firefox\Profiles\pr2p6ukj.default\Extensions\eauo0rclt@araisc.com
FF Extension: EabookBiRoowsEu - C:\Users\NACHNAME\AppData\Roaming\Mozilla\Firefox\Profiles\pr2p6ukj.default\Extensions\txlxmkuioy@lauuy.org
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1165\6.6.1081\firefoxextension\
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1165\6.6.1081\firefoxextension\

Chrome: 
=======
CHR Extension: (EabookBiRoowsEu) - C:\Users\NACHNAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\liljpidhppdkgliaemeklpldheaipbed\1
CHR Extension: (safEE  save) - C:\Users\NACHNAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkdghpecpoghdgcnakclaikdceeofbd\1

==================== Services (Whitelisted) =================

R2 ac.sharedstore; C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe [277032 2009-06-04] (ActivIdentity)
R2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
S2 CCALib8; C:\Program Files (x86)\Canon\CAL\CALMAIN.exe [96341 2005-09-30] (Canon Inc.)
R3 DEBridge; c:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe [704512 2010-02-02] (McAfee, Inc.)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462088 2010-03-31] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [362040 2009-12-07] (Hewlett-Packard Ltd)
R2 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-03-17] (Hewlett-Packard Development Company, L.P)
R2 HpFkCryptService; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2010-02-02] (McAfee, Inc.)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [523680 2012-06-20] (Hewlett-Packard Company)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-02-25] (PDF Complete Inc)
R2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b20011ea53a6b83e\STacSV64.exe [244736 2010-03-17] (IDT, Inc.)
S3 TmListen; C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe [1007120 2011-03-29] (Trend Micro Inc.)
S2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=qb -dt=60000 [x]

==================== Drivers (Whitelisted) ====================

S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [40760 2009-10-21] (Hewlett-Packard Development Company L.P.)
R1 DNE; C:\Windows\System32\DRIVERS\dnelwf64.sys [131672 2010-12-06] (Deterministic Networks, Inc.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74240 2011-02-16] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
R1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [58184 2010-02-02] (McAfee, Inc.)
S3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [89344 2010-01-30] (Realtek Semiconductor Corp.)
R0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [56648 2010-02-02] ()
R0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [60160 2009-06-04] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [15688 2010-02-02] (McAfee, Inc.)
R2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [90896 2011-02-25] (Trend Micro Inc.)
R2 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [146192 2011-02-25] (Trend Micro Inc.)
R2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [69904 2011-02-25] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105552 2010-09-30] (Trend Micro Inc.)
U3 tmpfw; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-25 08:05 - 2013-07-25 08:05 - 01779761 _____ (Farbar) C:\Users\NACHNAME\Desktop\FRST64.exe
2013-07-25 08:05 - 2013-07-25 08:05 - 00000000 ____D C:\FRST
2013-07-19 06:47 - 2013-05-27 07:54 - 01188864 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-07-19 06:47 - 2013-05-27 07:53 - 01492992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-07-19 06:47 - 2013-05-27 07:53 - 00134144 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-07-19 06:47 - 2013-05-27 07:50 - 12295680 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-07-19 06:47 - 2013-05-27 07:50 - 02458112 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-07-19 06:47 - 2013-05-27 07:50 - 00735232 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-07-19 06:47 - 2013-05-27 07:50 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-07-19 06:47 - 2013-05-27 07:50 - 00097792 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-07-19 06:47 - 2013-05-27 07:50 - 00064512 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-07-19 06:47 - 2013-05-27 07:02 - 00981504 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-07-19 06:47 - 2013-05-27 07:01 - 01231872 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-07-19 06:47 - 2013-05-27 07:01 - 00132096 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-07-19 06:47 - 2013-05-27 06:57 - 00627712 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-07-19 06:47 - 2013-05-27 06:57 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-07-19 06:47 - 2013-05-27 06:56 - 11020800 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-07-19 06:47 - 2013-05-27 06:56 - 02078208 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-07-19 06:47 - 2013-05-27 06:56 - 00176640 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-07-19 06:47 - 2013-05-27 06:56 - 00048128 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-07-19 06:47 - 2013-05-27 05:58 - 01638912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-07-19 06:47 - 2013-05-27 05:20 - 01638912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-07-19 06:46 - 2013-05-27 07:50 - 09070080 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-07-19 06:46 - 2013-05-27 06:57 - 06035456 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-07-19 06:43 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2013-07-19 06:43 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2013-07-19 06:42 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-07-19 06:42 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-07-19 06:41 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-07-19 06:41 - 2013-04-10 07:45 - 01545728 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2013-07-19 06:41 - 2013-04-10 07:02 - 01077760 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2013-07-04 20:39 - 2013-07-04 20:51 - 00000000 ____D C:\Users\NACHNAME\Desktop\Videos Zumba
2013-07-03 01:17 - 2013-05-08 08:39 - 01910632 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-07-03 00:17 - 2013-07-03 00:05 - 08714493 _____ C:\Users\NACHNAME\Desktop\FVB Beteiligungsworkshop.pptx
2013-06-27 19:23 - 2013-06-27 19:47 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-06-27 19:23 - 2013-06-27 19:23 - 00000000 ____D C:\ProgramData\StarApp
2013-06-27 19:23 - 2013-06-27 19:23 - 00000000 ____D C:\ProgramData\EabookBiRoowsEu
2013-06-27 19:21 - 2013-06-27 19:23 - 00000000 ____D C:\ProgramData\InstallMate
2013-06-27 19:21 - 2013-06-27 19:21 - 00000000 ____D C:\ProgramData\safEE  save
2013-06-27 19:20 - 2013-06-27 19:20 - 00304088 _____ (StarApp) C:\Users\NACHNAME\Downloads\Gymnastik Zumba 2013 pdf.exe
2013-06-26 22:00 - 2013-06-26 22:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-26 08:36 - 2013-06-26 08:36 - 00000000 ____D C:\Users\NACHNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte

==================== One Month Modified Files and Folders =======

2013-07-25 08:05 - 2013-07-25 08:05 - 01779761 _____ (Farbar) C:\Users\NACHNAME\Desktop\FRST64.exe
2013-07-25 08:05 - 2013-07-25 08:05 - 00000000 ____D C:\FRST
2013-07-25 07:44 - 2011-03-07 23:09 - 01938698 _____ C:\windows\WindowsUpdate.log
2013-07-25 07:36 - 2012-09-19 22:50 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-07-25 07:19 - 2011-11-03 22:34 - 00001114 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-25 06:32 - 2011-04-14 08:53 - 00000136 _____ C:\windows\system32\config\netlogon.ftl
2013-07-24 23:19 - 2011-11-03 22:34 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-24 21:22 - 2011-04-24 10:45 - 00003926 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{DCD7CC38-A14C-4F68-9043-5B448CE8B444}
2013-07-23 19:12 - 2009-07-14 06:45 - 00020720 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-23 19:12 - 2009-07-14 06:45 - 00020720 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-23 19:11 - 2010-09-12 22:06 - 00656734 _____ C:\windows\system32\perfh007.dat
2013-07-23 19:11 - 2010-09-12 22:06 - 00130510 _____ C:\windows\system32\perfc007.dat
2013-07-23 19:11 - 2009-07-14 07:13 - 01501362 _____ C:\windows\system32\PerfStringBackup.INI
2013-07-23 19:10 - 2011-04-13 18:27 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-07-23 19:05 - 2010-09-12 22:05 - 00000000 ____D C:\ProgramData\PDFC
2013-07-23 19:05 - 2010-09-12 22:05 - 00000000 ____D C:\ProgramData\HPQLOG
2013-07-23 19:05 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-07-23 19:05 - 2009-07-14 06:51 - 00081118 _____ C:\windows\setupact.log
2013-07-22 19:48 - 2009-07-14 06:45 - 00458448 _____ C:\windows\system32\FNTCACHE.DAT
2013-07-22 19:47 - 2010-09-12 22:43 - 00909474 _____ C:\windows\PFRO.log
2013-07-22 19:47 - 2009-07-27 16:36 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-22 19:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-22 19:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-19 06:44 - 2011-04-13 20:55 - 78185248 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-07-19 06:43 - 2011-04-14 10:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-18 23:14 - 2011-11-03 22:34 - 00004110 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-18 23:14 - 2011-11-03 22:34 - 00003858 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-08 21:54 - 2012-11-16 08:34 - 00003204 _____ C:\windows\System32\Tasks\HPCeeScheduleForNACHNAME
2013-07-08 21:54 - 2012-11-16 08:34 - 00000344 _____ C:\windows\Tasks\HPCeeScheduleForNACHNAME.job
2013-07-04 20:51 - 2013-07-04 20:39 - 00000000 ____D C:\Users\NACHNAME\Desktop\Videos Zumba
2013-07-03 00:05 - 2013-07-03 00:17 - 08714493 _____ C:\Users\NACHNAME\Desktop\FVB Beteiligungsworkshop.pptx
2013-06-27 19:47 - 2013-06-27 19:23 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-06-27 19:23 - 2013-06-27 19:23 - 00000000 ____D C:\ProgramData\StarApp
2013-06-27 19:23 - 2013-06-27 19:23 - 00000000 ____D C:\ProgramData\EabookBiRoowsEu
2013-06-27 19:23 - 2013-06-27 19:21 - 00000000 ____D C:\ProgramData\InstallMate
2013-06-27 19:21 - 2013-06-27 19:21 - 00000000 ____D C:\ProgramData\safEE  save
2013-06-27 19:21 - 2011-11-03 22:34 - 00000000 ____D C:\Users\NACHNAME\AppData\Local\Google
2013-06-27 19:20 - 2013-06-27 19:20 - 00304088 _____ (StarApp) C:\Users\NACHNAME\Downloads\Gymnastik Zumba 2013 pdf.exe
2013-06-27 18:47 - 2012-09-19 22:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-26 22:01 - 2013-06-26 22:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-26 08:36 - 2013-06-26 08:36 - 00000000 ____D C:\Users\NACHNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-19 06:04

==================== End Of Log ============================
         

--- --- ---
und hier Addition:

FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2013
Ran by NACHNAME at 2013-07-25 08:08:30
Running from C:\Users\NACHNAME\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
 Update for Microsoft Office 2007 (KB2508958) (x32)
ActivClient x64 (Version: 6.2)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Adobe Shockwave Player 11.6 (x32 Version: 11.6.0.626)
Apple Application Support (x32 Version: 2.1.5)
Apple Mobile Device Support (Version: 4.0.0.97)
Apple Software Update (x32 Version: 2.1.3.127)
BlackBerry Desktop Software 6.1 (x32 Version: 6.1.0.35)
Bonjour (Version: 3.0.0.10)
Broadcom 2070 Bluetooth 2.1 + EDR (Version: 6.2.1.1100)
Broadcom 802.11 Wireless LAN Adapter (Version: 5.60.48.35)
Canon Camera Access Library (x32 Version: 8.1.1.17)
Canon Camera Support Core Library (x32 Version: 7.3.1.6)
Canon Camera Window DC_DV 5 for ZoomBrowser EX (x32 Version: 5.4.5.17)
Canon Camera Window DC_DV 6 for ZoomBrowser EX (x32 Version: 6.2.0.8)
Canon Camera Window MC 6 for ZoomBrowser EX (x32 Version: 6.1.0.7)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (x32 Version: 1.2.0.5)
Canon Internet Library for ZoomBrowser EX (x32 Version: 1.4.2.6)
Canon RAW Image Task for ZoomBrowser EX (x32 Version: 2.4.0.7)
Canon RemoteCapture Task for ZoomBrowser EX (x32 Version: 1.5.0.5)
Canon Utilities Digital Photo Professional 2.2 (x32 Version: 2.2.0.1)
Canon Utilities EOS Utility (x32 Version: 1.1.0.8)
Canon Utilities PhotoStitch (x32 Version: 3.1.18.42)
Canon Utilities ZoomBrowser EX (x32 Version: 5.7.0.74)
Device Access Manager for HP ProtectTools (Version: 5.0.1.6)
DirectX 9 Runtime (x32 Version: 1.00.0000)
dows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800)
Drive Encryption for HP ProtectTools (Version: 5.0.6.0)
Drive Encryption for HP ProtectTools (x32 Version: 5.0.6.0)
EabookBiRoowsEu (x32 Version: )
Energy Star Digital Logo (x32 Version: 1.0.1)
File Sanitizer For HP ProtectTools (x32 Version: 5.0.1.3)
Free WMA to MP3 Converter 1.16 (x32)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4209.2358)
Google Update Helper (x32 Version: 1.3.21.153)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
HP 3D DriveGuard (Version: 4.1.10.1)
HP Advisor (x32 Version: 3.4.10262.3295)
HP Customer Experience Enhancements (x32 Version: 6.0.1.4)
HP Documentation (x32 Version: 1.1.0.0)
HP ESU for Microsoft Windows 7 (x32 Version: 2.0.2.1)
HP Hotkey Support (x32 Version: 4.6.4.1)
HP Power Assistant (Version: 1.0.6.0)
HP Power Data (Version: 1.0.21.158)
HP ProtectTools Security Manager (Version: 5.07.711)
HP QuickLook (Version: 3.3.1.4)
HP QuickWeb (x32 Version: 1.0.1.62)
HP Setup (x32 Version: 8.2.4130.3367)
HP SoftPaq Download Manager (x32 Version: 3.0.5.0)
HP Software Framework (x32 Version: 4.5.10.1)
HP Software Setup (x32 Version: 7.0.1.6)
HP Support Assistant (x32 Version: 7.0.39.15)
HP Web Camera (Version: 1.0.0)
HP Webcam (x32 Version: 1.0.26.3)
HP Wireless Assistant (Version: 4.0.6.0)
IDT Audio (x32 Version: 1.0.6275.0)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2119)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Network Connections Drivers (Version: 16.3)
Intel® Matrix Storage Manager
iTunes (Version: 10.5.1.42)
Java Card Security for HP ProtectTools (Version: 5.0.4.1)
LightScribe System Software (x32 Version: 1.18.15.1)
LSI HDA Modem (Version: 2.2.98)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Professional 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Small Business 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (x32 Version: 4.0.60129.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
Mozilla Maintenance Service (x32 Version: 22.0)
PDF Complete Special Edition (x32 Version: 4.0.38)
Privacy Manager for HP ProtectTools (Version: 5.10.796)
Realtek PC Camera (x32 Version: 6.1.7600.0028)
RICOH Media Driver (x32 Version: 2.14.00.05)
Roxio Activation Module (x32 Version: 1.0)
Roxio Creator Audio (x32 Version: 3.8.0)
Roxio Creator Business (x32 Version: 10.3.56.20)
Roxio Creator Business v10 (x32 Version: 3.8.0)
Roxio Creator Copy (x32 Version: 3.8.0)
Roxio Creator Data (x32 Version: 3.8.0)
Roxio Creator Tools (x32 Version: 3.8.0)
Roxio Express Labeler 3 (x32 Version: 3.2.2)
Roxio MyDVD (x32 Version: 10.3.349)
safEE  save (x32 Version: )
Skype™ 4.1 (x32 Version: 4.1.179)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0)
SonicWALL Global VPN Client (Version: 4.6.4)
Synaptics Pointing Device Driver (Version: 15.0.24.0)
Theft Recovery (x32 Version: 5.1.0.21)
Trend Micro Worry-Free Business Security Agent (Version: 7.0)
Trend Micro Worry-Free Business Security Agent (Version: 7.0.1638)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Validity Fingerprint Driver (Version: 4.0.15.0)
VD64Inst (Version: 1.00.0000)
Windows 7 Default Setting (x32 Version: 1.0.1.6)
Windows Driver Package - Broadcom Bluetooth  (07/30/2009 6.2.0.9405) (Version: 07/30/2009 6.2.0.9405)
Windows Driver Package - Broadcom Bluetooth  (12/16/2009 6.2.0.9414) (Version: 12/16/2009 6.2.0.9414)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)

==================== Restore Points  =========================

31-05-2013 20:09:37 Windows Update
01-06-2013 10:00:13 Windows Update
06-06-2013 21:38:30 Windows Update
16-06-2013 07:31:06 Windows Update
23-06-2013 20:14:15 Geplanter Prüfpunkt
02-07-2013 22:24:30 Windows Update
02-07-2013 23:15:45 Windows Update
18-07-2013 21:51:17 Windows Update
19-07-2013 04:40:34 Windows Update
24-07-2013 19:32:53 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {04D8F893-D2AA-40FE-B19E-26F00927145D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSFUpdaterRedux => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-04-01] (Hewlett-Packard Company)
Task: {1E563059-AE6B-4770-94EB-C2A19729470A} - System32\Tasks\WPD\SqmUpload_S-1-5-21-2979344955-3751320461-1264610957-1390 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {2B270606-EF5F-441C-97AF-2D4B6C7746F7} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {2C3346E7-90EE-43E3-9E98-259A57995159} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {3623D6C4-B0AA-4FED-8B41-A2A1C8A765A5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-03] (Google Inc.)
Task: {3E58EB89-9741-4C54-88AE-1F704C781EA7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Assistant Restart => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {3F1D4383-B1D5-479B-98A5-F2D5F550D7CA} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {516A4C00-63E4-4424-98D5-F07DA9E32762} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-18] (Adobe Systems Incorporated)
Task: {558B75BF-F1A1-4D21-849E-F408F83AA118} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {5F249200-501D-42C7-A7E0-6DE08409EA7D} - System32\Tasks\HPCeeScheduleForNACHNAME => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {5FC308BD-612F-405F-85EB-12D0CCFC3C43} - System32\Tasks\User_Feed_Synchronization-{DCD7CC38-A14C-4F68-9043-5B448CE8B444} => C:\windows\system32\msfeedssync.exe [2010-11-20] (Microsoft Corporation)
Task: {7705C5C2-8247-4CE4-86F8-026D8EA37D24} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-03] (Google Inc.)
Task: {B38E50FE-20BE-42DB-8137-893BEE43D52E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {D55F1C04-AA69-4EEF-840E-B8B3FC9012FA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis Install => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {EEE467C9-3582-4558-9980-8B19BCDE3F0D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-04-01] (Hewlett-Packard Company)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForNACHNAME.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Faulty Device Manager Devices =============

Name: SonicWALL Virtual NIC
Description: SonicWALL Virtual NIC
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: SonicWALL
Service: SWVNIC
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/25/2013 07:53:14 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 240849

Error: (07/25/2013 07:53:14 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 240849

Error: (07/25/2013 07:53:14 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (07/25/2013 07:53:13 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 239851

Error: (07/25/2013 07:53:13 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 239851

Error: (07/25/2013 07:53:13 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (07/25/2013 07:49:25 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 12183

Error: (07/25/2013 07:49:25 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 12183

Error: (07/25/2013 07:49:25 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (07/25/2013 07:49:24 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 11185


System errors:
=============
Error: (07/25/2013 08:03:42 AM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (07/25/2013 07:42:40 AM) (Source: Tcpip) (User: )
Description: Das System hat einen Adressenkonflikt der IP-Adresse 192.168.178.22 mit dem Computer mit der
Netzwerkhardwareadresse C0-25-06-3A-12-DB ermittelt. Netzwerkvorgänge könnten daher auf diesem
System unterbrochen werden.

Error: (07/24/2013 09:23:12 PM) (Source: NETLOGON) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne CORP aufgrund der folgenden
Ursache nicht einrichten: 
%%1311

Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.



ZUSÄTZLICHE INFORMATIONEN

Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.

Error: (07/24/2013 09:21:30 PM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (07/24/2013 09:21:29 PM) (Source: Microsoft-Windows-GroupPolicy) (User: CORP)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (07/24/2013 02:32:29 AM) (Source: NETLOGON) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne CORP aufgrund der folgenden
Ursache nicht einrichten: 
%%1311

Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.



ZUSÄTZLICHE INFORMATIONEN

Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.

Error: (07/23/2013 09:04:27 PM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (07/23/2013 08:58:24 PM) (Source: Microsoft-Windows-GroupPolicy) (User: CORP)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (07/23/2013 08:03:02 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Canon Camera Access Library 8" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/23/2013 07:06:27 PM) (Source: Microsoft-Windows-GroupPolicy) (User: CORP)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.


Microsoft Office Sessions:
=========================
Error: (12/13/2012 05:59:58 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 27370 seconds with 9900 seconds of active time.  This session ended with a crash.

Error: (11/27/2012 02:11:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 14499 seconds with 6540 seconds of active time.  This session ended with a crash.

Error: (11/08/2012 04:53:40 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 2780 seconds with 1440 seconds of active time.  This session ended with a crash.

Error: (04/24/2012 10:40:03 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 98402 seconds with 4320 seconds of active time.  This session ended with a crash.

Error: (04/12/2012 08:41:25 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 39384 seconds with 4680 seconds of active time.  This session ended with a crash.

Error: (08/12/2011 02:15:57 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 5869 seconds with 1500 seconds of active time.  This session ended with a crash.

Error: (08/10/2011 00:59:30 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 277 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (05/07/2011 07:03:52 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6555.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 36202 seconds with 420 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 41%
Total physical RAM: 3887.43 MB
Available physical RAM: 2254.89 MB
Total Pagefile: 7773.04 MB
Available Pagefile: 5468.26 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (Win7Pro64) (Fixed) (Total:280.79 GB) (Free:183.99 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32 (Disk=0 Partition=4)
Drive z: (ZIN_45) (CDROM) (Total:5.44 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 8C949010)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=281 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)

==================== End Of Log ============================
         

--- --- ---
Soll ich jetzt vorgehen wie beim letzten Mal, oder ist das Ergebnis abhängig?

VG und danke für die Unterstützung

Hallo und

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Warum hast du eine Professional-Edition von Windows, brauchst du das als Heimanwender?
Oder ist das rein zufällig ein Büro-/Firmen-PC bzw. ein Uni-Rechner?


Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die jemals fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Hallo Cosinus,

das Notebook wird beruflich genutzt - deshalb sicher die Version.

Habe aktuell keine weiteren Logs, sondern nur die beiden aus FRST.

Danke für den Hinweis in Sachen Code Tags - war mir nach meinem Post aufgefallen und hatte ich geändert :-)

VG

das Notebook wird beruflich genutzt - deshalb sicher die Version.

Firmenrechner werden hier eigentlich nicht bereinigt

Siehe => http://www.trojaner-board.de/108422-...-anfragen.html


Bitte besonders das hier beachten:

Bedenkt jedoch, dass Logfiles viele heikle Informationen enthalten können ( Kundendaten, Bankdaten, etc ) sowie das Malware die Möglichkeit besitzt, diese auszuspähen und zu missbrauchen. Hier legen wir euch ein Formatieren und Neuaufsetzen nahe.

3. Grundsätzlich bereinigen wir keine gewerblich genutzten Rechner. Dafür ist die IT Abteilung eurer Firma zuständig.

Bei Kleinunternehmen, welche keinen IT Support haben, machen wir da eine Ausnahme und helfen gerne ( kleine Spende hilft auch uns ).
Voraussetzung: Ihr teilt uns dies in eurer ersten Antwort mit.