Windows7: PC extrem langsam, Skriptfehler beim surfen

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:09 on 01/02/2014 (Steffi)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-11-2013 (ATTENTION: ====> FRST version is 69 days old and could be outdated)
Ran by Steffi (administrator) on STEFFI-PC on 01-02-2014 13:59:27
Running from C:\Users\Steffi\Desktop
Microsoft Windows 7 Starter  (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Uniblue Systems Limited) C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Registration\GREGsvc.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LMworker.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Insyde Software Corp.) C:\Program Files\Acer\Android Manager\iSync.exe
(Insyde Software Corp.) C:\Program Files\Acer\Updater\iUpdate.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(InstallShield Software Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(ACD Systems) C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_12_0_0_43.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_12_0_0_43.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [960080 2010-05-25] (Dritek System Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-10-14] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9292392 2010-06-22] (Realtek Semiconductor)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe [41056 2013-05-09] (Adobe Systems Incorporated)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1692968 2010-02-05] (Synaptics Incorporated)
HKLM\...\Run: [iSyncData] - C:\Program Files\Acer\Android Manager\iSync.exe [407416 2010-01-08] (Insyde Software Corp.)
HKLM\...\Run: [AndroidManager] - C:\Program Files\Acer\Android Manager\AML.exe [508280 2010-01-08] ()
HKLM\...\Run: [iPatchData] - C:\Program Files\Acer\Updater\iUpdate.exe [490872 2010-01-08] (Insyde Software Corp.)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [715296 2010-06-11] (Acer Incorporated)
HKLM\...\Run: [ISUSScheduler] - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-16] (InstallShield Software Corporation)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [ACSW14DE] - C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe [1231472 2011-11-17] (ACD Systems)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2014-01-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-05] (Adobe Systems Incorporated)
HKCU\...\Run: [ISUSPM Startup] - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2005-02-16] (InstallShield Software Corporation)
MountPoints2: {02298f4b-2d6f-11e3-b313-88ae1d6ca442} - E:\HTC_Sync_Manager_PC.exe
MountPoints2: {84567945-0d10-11e3-b323-88ae1d6ca442} - E:\HTC_Sync_Manager_PC.exe
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe [ 2010-01-15] ()
Startup: C:\Users\Steffi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spiegel.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b50910m205l04h4wwl5w4712u23o
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b50910m205l04h4wwl5w4712u23o
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b50910m205l04h4wwl5w4712u23o
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 221.3.131.12 221.3.131.11

FireFox:
========
FF ProfilePath: C:\Users\Steffi\AppData\Roaming\Mozilla\Firefox\Profiles\t2hamu6j.default
FF Homepage: hxxp://www.spiegel.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

========================== Services (Whitelisted) =================

R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [896056 2014-01-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2014-01-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2014-01-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2014-01-22] (Avira Operations GmbH & Co. KG)
R2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [735776 2010-06-11] (Acer Incorporated)
R2 GREGService; C:\Program Files\Acer\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
R2 Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2014-01-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2014-01-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 EUCR; C:\Windows\System32\DRIVERS\EUCR6SK.SYS [82768 2010-06-17] (ENE Technology Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-02-20] (Avira GmbH)
U3 ugdiqpob; \??\C:\Users\Steffi\AppData\Local\Temp\ugdiqpob.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-01 13:59 - 2014-02-01 14:00 - 00011713 _____ C:\Users\Steffi\Desktop\FRST.txt
2014-02-01 13:59 - 2014-02-01 13:59 - 00000000 ____D C:\FRST
2014-02-01 13:57 - 2014-02-01 13:57 - 01091583 _____ (Farbar) C:\Users\Steffi\Desktop\FRST.exe
2014-02-01 13:49 - 2014-02-01 13:49 - 00004724 _____ C:\Users\Steffi\Desktop\gmer.txt
2014-02-01 13:14 - 2014-02-01 13:14 - 00380416 _____ C:\Users\Steffi\Desktop\Gmer-19357.exe
2014-02-01 13:09 - 2014-02-01 13:09 - 00000474 _____ C:\Users\Steffi\Desktop\defogger_disable.log
2014-02-01 13:09 - 2014-02-01 13:09 - 00000000 _____ C:\Users\Steffi\defogger_reenable
2014-02-01 13:07 - 2014-02-01 13:07 - 00050477 _____ C:\Users\Steffi\Desktop\Defogger.exe
2014-02-01 08:27 - 2014-02-01 08:35 - 00001988 _____ C:\Users\Public\Desktop\Adobe Reader 9.lnk
2014-01-31 02:24 - 2014-01-31 02:24 - 00000000 ____D C:\Users\Steffi\AppData\Roaming\Malwarebytes
2014-01-31 02:23 - 2014-01-31 02:24 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-31 02:23 - 2014-01-31 02:23 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-31 02:23 - 2014-01-31 02:23 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-31 02:23 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-22 14:21 - 2014-01-22 14:21 - 00000000 ____D C:\Program Files\Mozilla Firefox
2014-01-22 14:11 - 2014-01-22 14:11 - 00002174 _____ C:\Users\Public\Desktop\Google Earth.lnk

==================== One Month Modified Files and Folders =======

2014-02-01 14:00 - 2014-02-01 13:59 - 00011713 _____ C:\Users\Steffi\Desktop\FRST.txt
2014-02-01 13:59 - 2014-02-01 13:59 - 00000000 ____D C:\FRST
2014-02-01 13:57 - 2014-02-01 13:57 - 01091583 _____ (Farbar) C:\Users\Steffi\Desktop\FRST.exe
2014-02-01 13:51 - 2010-08-05 17:30 - 01380584 _____ C:\Windows\WindowsUpdate.log
2014-02-01 13:49 - 2014-02-01 13:49 - 00004724 _____ C:\Users\Steffi\Desktop\gmer.txt
2014-02-01 13:39 - 2013-10-06 11:47 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-01 13:14 - 2014-02-01 13:14 - 00380416 _____ C:\Users\Steffi\Desktop\Gmer-19357.exe
2014-02-01 13:09 - 2014-02-01 13:09 - 00000474 _____ C:\Users\Steffi\Desktop\defogger_disable.log
2014-02-01 13:09 - 2014-02-01 13:09 - 00000000 _____ C:\Users\Steffi\defogger_reenable
2014-02-01 13:09 - 2010-09-08 03:29 - 00000000 ____D C:\Users\Steffi
2014-02-01 13:07 - 2014-02-01 13:07 - 00050477 _____ C:\Users\Steffi\Desktop\Defogger.exe
2014-02-01 13:04 - 2010-09-12 06:03 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-01 13:02 - 2010-07-01 21:02 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2014-02-01 12:56 - 2012-05-21 22:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-01 12:56 - 2012-02-21 19:50 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-01 12:56 - 2010-11-07 04:54 - 00000000 ____D C:\Users\Steffi\AppData\Local\Adobe
2014-02-01 08:35 - 2014-02-01 08:27 - 00001988 _____ C:\Users\Public\Desktop\Adobe Reader 9.lnk
2014-02-01 08:28 - 2010-07-01 21:33 - 00000000 ____D C:\ProgramData\Adobe
2014-02-01 08:26 - 2010-07-01 21:32 - 00000000 ____D C:\Program Files\Common Files\Adobe
2014-02-01 07:44 - 2010-07-01 20:31 - 01472002 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-31 14:11 - 2012-01-24 02:03 - 00000000 ____D C:\Users\Steffi\AppData\Roaming\vlc
2014-01-31 14:04 - 2010-09-12 06:03 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-31 12:53 - 2009-07-14 12:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-31 12:53 - 2009-07-14 12:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-31 12:48 - 2013-02-17 12:37 - 00000302 _____ C:\Windows\Tasks\RegistryBooster.job
2014-01-31 12:45 - 2013-02-17 12:37 - 00000334 _____ C:\Windows\Tasks\rbmonitor.job
2014-01-31 12:45 - 2009-07-14 12:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-31 12:45 - 2009-07-14 12:39 - 00062062 _____ C:\Windows\setupact.log
2014-01-31 02:24 - 2014-01-31 02:24 - 00000000 ____D C:\Users\Steffi\AppData\Roaming\Malwarebytes
2014-01-31 02:24 - 2014-01-31 02:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-31 02:23 - 2014-01-31 02:23 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-31 02:23 - 2014-01-31 02:23 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-29 00:59 - 2013-02-18 17:42 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2014-01-29 00:59 - 2010-08-05 17:27 - 00098562 _____ C:\Windows\PFRO.log
2014-01-29 00:56 - 2010-07-01 21:15 - 00000000 ____D C:\Program Files\Acer GameZone
2014-01-28 10:10 - 2012-02-24 12:15 - 00000000 ____D C:\Users\Steffi\AppData\Roaming\Skype
2014-01-28 09:42 - 2012-02-24 12:14 - 00000000 ___RD C:\Program Files\Skype
2014-01-28 09:42 - 2012-02-24 12:14 - 00000000 ____D C:\ProgramData\Skype
2014-01-22 17:25 - 2013-09-26 02:20 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-01-22 17:25 - 2013-02-20 09:44 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-01-22 17:25 - 2013-02-20 09:44 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-01-22 14:21 - 2014-01-22 14:21 - 00000000 ____D C:\Program Files\Mozilla Firefox
2014-01-22 14:11 - 2014-01-22 14:11 - 00002174 _____ C:\Users\Public\Desktop\Google Earth.lnk
2014-01-22 14:09 - 2010-07-01 21:28 - 00000000 ____D C:\Program Files\Google

Some content of TEMP:
====================
C:\Users\Steffi\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-24 10:40

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-11-2013
Ran by Steffi at 2014-02-01 14:01:27
Running from C:\Users\Steffi\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958)
ACDSee 14 (Version: 14.1.137)
Acer Crystal Eye webcam (Version: 4.0.2.1)
Acer ePower Management (Version: 5.00.3005)
Acer eRecovery Management (Version: 4.05.3013)
Acer GameZone Console (Version: 6.1.0.9)
Acer Registration (Version: 1.03.3003)
Acer ScreenSaver (Version: 1.1.0624.2010)
Acer Updater (Version: 1.02.3001)
Acrobat.com (Version: 1.6.65)
Adobe AIR (Version: 1.5.0.7220)
Adobe Bridge 1.0 (Version: 001.000.001)
Adobe Common File Installer (Version: 1.00.001)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.170)
Adobe Flash Player 12 Plugin (Version: 12.0.0.43)
Adobe Help Center 1.0 (Version: 1.0.1)
Adobe Photoshop CS2 (Version: 9.0)
Adobe Reader 9.5.5 MUI (Version: 9.5.5)
Adobe Stock Photos 1.0 (Version: 1.0.1)
AndroidInstaller (Version: 1.00.022)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (Version: 1.0.0.31)
Avira Antivirus Premium (Version: 14.0.2.286)
CorelDRAW Graphics Suite X3
CorelDRAW Graphics Suite X3 (Version: 13.2)
DE (Version: 13.1)
eBay Worldwide (Version: 2.1.0901)
ENE USB Card Reader Driver (Version: 5.89.0.70)
FontNav (Version: 5.0)
Google Earth (Version: 7.1.2.2041)
Google Update Helper (Version: 1.3.22.3)
Identity Card (Version: 1.00.3003)
Intel(R) Graphics Media Accelerator Driver (Version: 8.14.10.2117)
Intel® Matrix Storage Manager
Junk Mail filter update (Version: 14.0.8089.726)
Launch Manager (Version: 4.0.10)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Merriam Websters Spell Jam
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office 2010 (Version: 14.0.4763.1000)
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 4.1.10329.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mozilla Firefox 26.0 (x86 de) (Version: 26.0)
Mozilla Maintenance Service (Version: 26.0)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Realtek High Definition Audio Driver (Version: 6.0.1.6141)
Skype™ 6.11 (Version: 6.11.102)
Synaptics Pointing Device Driver (Version: 15.0.7.0)
Uniblue RegistryBooster (Version: 6.1.1.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2767848) 32-Bit Edition
Update Manager (Version: 4.60)
VBA (Version: 6.2)
VLC media player 1.0.3 (Version: 1.0.3)
Welcome Center (Version: 1.02.3002)
Windows Live Anmelde-Assistent (Version: 5.000.818.5)
Windows Live Call (Version: 14.0.8064.0206)
Windows Live Communications Platform (Version: 14.0.8064.206)
Windows Live Essentials (Version: 14.0.8089.0726)
Windows Live Essentials (Version: 14.0.8089.726)
Windows Live Fotogalerie (Version: 14.0.8081.709)
Windows Live Mail (Version: 14.0.8089.0726)
Windows Live Messenger (Version: 14.0.8089.0726)
Windows Live Movie Maker (Version: 14.0.8091.0730)
Windows Live Sync (Version: 14.0.8089.726)
Windows Live Writer (Version: 14.0.8089.0726)
Windows Live-Uploadtool (Version: 14.0.8014.1029)

==================== Restore Points  =========================

24-01-2014 02:47:57 Geplanter Prüfpunkt
01-02-2014 05:00:50 Configured eSobi v2
01-02-2014 05:03:08 Removed Norton Online Backup

==================== Hosts content: ==========================

2009-07-14 10:04 - 2009-06-11 05:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {137B2CDA-E591-466F-9872-5B1D306E37CE} - System32\Tasks\rbmonitor => C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe [2012-12-05] (Uniblue Systems Limited)
Task: {22257957-8361-482C-88F4-A3064742B4D8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-01] (Adobe Systems Incorporated)
Task: {2FDB1087-9687-47F5-8061-179953FACC59} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {30CB2437-42F1-4DEA-AEA7-566FF06BE280} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-09-12] (Google Inc.)
Task: {99D23AE2-4A4E-4CF4-BE7E-B5601FCA6626} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-09-12] (Google Inc.)
Task: {D777F4E6-16CD-4A7C-8CCE-2F466C2AB2F1} - System32\Tasks\RegistryBooster => C:\Program Files\Uniblue\RegistryBooster\registrybooster.exe [2012-12-05] (Uniblue Systems Limited)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\rbmonitor.job => C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
Task: C:\Windows\Tasks\RegistryBooster.job => C:\Program Files\Uniblue\RegistryBooster\registrybooster.exe

==================== Loaded Modules (whitelisted) =============

2010-07-01 21:14 - 2009-05-20 14:02 - 00072200 _____ () C:\Program Files\Launch Manager\CdDirIo.dll
2010-04-06 15:55 - 2010-04-06 15:55 - 00410624 _____ () C:\Program Files\Acer\Android Manager\DEU.dll
2014-01-22 14:21 - 2014-01-22 14:21 - 03559024 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-02-01 12:56 - 2014-02-01 12:56 - 16287624 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:4D066AD2
AlternateDataStreams: C:\ProgramData\TEMP:5D7E5A8F
AlternateDataStreams: C:\ProgramData\TEMP:CDFF58FE
AlternateDataStreams: C:\ProgramData\TEMP:E36F5B57

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/01/2014 01:00:49 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {1c972df1-9fa6-4c3b-8cfc-ef542fbb9603}

Error: (01/28/2014 09:21:09 PM) (Source: Application Hang) (User: )
Description: Programm avcenter.exe, Version 14.0.2.220 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1a14

Startzeit: 01cf1c2b4433e0de

Endzeit: 60000

Anwendungspfad: C:\program files\avira\antivir desktop\avcenter.exe

Berichts-ID: df602a8e-881e-11e3-b313-88ae1d6ca442

Error: (01/27/2014 00:15:04 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ACDSee14.exe, Version: 14.1.137.0, Zeitstempel: 0x4ed5f749
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x02010153
ID des fehlerhaften Prozesses: 0x1fb4
Startzeit der fehlerhaften Anwendung: 0xACDSee14.exe0
Pfad der fehlerhaften Anwendung: ACDSee14.exe1
Pfad des fehlerhaften Moduls: ACDSee14.exe2
Berichtskennung: ACDSee14.exe3

Error: (01/24/2014 10:42:21 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (01/23/2014 10:57:29 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ACDSee14.exe, Version: 14.1.137.0, Zeitstempel: 0x4ed5f749
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000001a
ID des fehlerhaften Prozesses: 0x1bbc
Startzeit der fehlerhaften Anwendung: 0xACDSee14.exe0
Pfad der fehlerhaften Anwendung: ACDSee14.exe1
Pfad des fehlerhaften Moduls: ACDSee14.exe2
Berichtskennung: ACDSee14.exe3

Error: (10/12/2013 07:28:29 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (10/12/2013 04:59:35 AM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16464 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 10f0

Startzeit: 01cec6c40e9e18fe

Endzeit: 20

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID:

Error: (10/10/2013 01:51:06 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Die Daten sind unzulässig.
.

Error: (10/10/2013 01:51:05 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Die Daten sind unzulässig.
.

Error: (10/06/2013 00:37:16 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.


System errors:
=============
Error: (02/01/2014 01:19:14 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (01/31/2014 09:06:48 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AntiVirSchedulerService erreicht.

Error: (01/31/2014 00:46:48 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (01/31/2014 00:45:19 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\athExt.dll
Fehlercode: 126

Error: (01/31/2014 01:08:27 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (01/31/2014 01:02:56 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\athExt.dll
Fehlercode: 126

Error: (01/31/2014 01:02:43 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎31.‎01.‎2014 um 01:00:15 unerwartet heruntergefahren.

Error: (01/30/2014 08:45:01 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.

Error: (01/30/2014 11:17:49 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (01/30/2014 10:15:27 AM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 83%
Total physical RAM: 1013.1 MB
Available physical RAM: 169.21 MB
Total Pagefile: 2065.11 MB
Available Pagefile: 767.47 MB
Total Virtual: 2047.88 MB
Available Virtual: 1896.91 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:215.79 GB) (Free:179.81 GB) NTFS
Drive d: (PARTITION) (Fixed) (Total:4 GB) (Free:2.66 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 73B6627A)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Not Active) - (Size=4 GB) - (Type=0C)
Partition 3: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=216 GB) - (Type=OF Extended)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-01 13:49:36
Windows 6.1.7600  \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Hitachi_ rev.PB2O 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\Steffi\AppData\Local\Temp\ugdiqpob.sys


---- System - GMER 2.1 ----

SSDT            8A32483E                                                                                           ZwCreateSection
SSDT            8A324816                                                                                           ZwCreateSymbolicLinkObject
SSDT            8A32481B                                                                                           ZwLoadDriver
SSDT            8A324811                                                                                           ZwOpenSection
SSDT            8A324848                                                                                           ZwRequestWaitReplyPort
SSDT            8A324843                                                                                           ZwSetContextThread
SSDT            8A32484D                                                                                           ZwSetSecurityObject
SSDT            8A324820                                                                                           ZwSetSystemInformation
SSDT            8A324852                                                                                           ZwSystemDebugControl
SSDT            8A3247DF                                                                                           ZwTerminateProcess
SSDT            8A3247DA                                                                                           ZwWriteVirtualMemory

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackTransaction + 13E9                                                          81E858D9 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                             81EAA312 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!RtlSidHashLookup + 370                                                                81EB1C30 4 Bytes  [3E, 48, 32, 8A]
.text           ntkrnlpa.exe!RtlSidHashLookup + 378                                                                81EB1C38 4 Bytes  [16, 48, 32, 8A]
.text           ntkrnlpa.exe!RtlSidHashLookup + 48C                                                                81EB1D4C 4 Bytes  [1B, 48, 32, 8A]
.text           ntkrnlpa.exe!RtlSidHashLookup + 528                                                                81EB1DE8 4 Bytes  [11, 48, 32, 8A]
.text           ntkrnlpa.exe!RtlSidHashLookup + 6CC                                                                81EB1F8C 4 Bytes  [48, 48, 32, 8A]
.text           ...                                                                                                

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Mozilla Firefox\firefox.exe[3860] ntdll.dll!wcsncmp + 33B                         774BF420 7 Bytes  JMP 653BB780 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3860] kernel32.dll!K32GetDeviceDriverBaseNameW + 16F  773CC0A7 7 Bytes  JMP 65BF6EDA C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3860] kernel32.dll!CloseHandle + 38                   773D05CF 7 Bytes  JMP 65BF6EFD C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3860] kernel32.dll!GetExitCodeProcess + 2C            773D311D 7 Bytes  JMP 653C0836 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3860] USER32.dll!GetWindowInfo                        775D6A82 5 Bytes  JMP 65A9B28C C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3860] GDI32.dll!GetViewportOrgEx + 21C                76E785EB 7 Bytes  JMP 65BF6E5B C:\Program Files\Mozilla Firefox\xul.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                            Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                            Wdf01000.sys
AttachedDevice  \FileSystem\fastfat \Fat                                                                           fltmgr.sys

---- EOF - GMER 2.1 ----