Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:45 on 13/04/2014 (*****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read sptd.sys
Unable to read sptd.sys
SPTD -> DisabledSPTD ->  (Service running -> reboot required)
Already disabled (Service running -> reboot required)


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-04-2014 01
Ran by ***** (administrator) on *****S-LAPTOP on 13-04-2014 14:01:01
Running from C:\Users\*****\Desktop\Kampf gegen den Virus
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
(AnchorFree Inc.) C:\Program Files\Hotspot Shield\bin\cmw_srv.exe
() C:\Program Files\Hotspot Shield\bin\hsswd.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(COMPANYVERS_NAME) C:\Program Files\RadioRage_4j\bar\1.bin\4jbarsvc.exe
() C:\Program Files\SMINST\BLService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
(Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe
() C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(SecureW2 B.V.) C:\Program Files\SecureW2\sw2_tray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
( ) C:\Program Files\RadioRage_4j\bar\1.bin\APPINTEGRATOR.EXE
(Mindspark) C:\Program Files\RadioRage_4j\bar\1.bin\4jSrchMn.exe
(Spotify Ltd) C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
() C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\sdclt.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [WirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [432432 2008-12-08] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [450652 2009-06-03] (IDT, Inc.)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [SecureW2 Tray] - C:\Program Files\SecureW2\sw2_tray.exe [186792 2012-08-17] (SecureW2 B.V.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-07-04] (Advanced Micro Devices, Inc.)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\Run: [Spotify Web Helper] - C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-11] (Spotify Ltd)
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\Run: [BBuJUuKs] - wscript.exe //B "C:\Users\*****~1\AppData\Local\Temp\BBuJUuKs.vbs" <===== ATTENTION
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {073a23ce-6bc5-11df-8492-a56831e8e4b1} - "F:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {0c85e89a-6dba-11e1-bbf7-b9b8e2458846} - G:\ZTE_Handset_USB_Driver.exe
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {12e9ead7-cd2b-11de-a895-00269e0cf51f} - WD_Windows_Tools\Setup.exe
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {57d292f9-ffe6-11e1-8a06-8b3079f4bd5b} - F:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {72abdfc7-11d0-11e2-940c-bef78f8eb721} - F:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {b25d0878-18ae-11e0-bbaa-c8a8ad3ade5b} - F:\AutoRun.exe
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {b25d0888-18ae-11e0-bbaa-9fd27449ea5b} - F:\AutoRun.exe
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {b25d0893-18ae-11e0-bbaa-f058a7cd0102} - F:\AutoRun.exe
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBuJUuKs.vbs ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM - DefaultScope {09EECF31-D086-4C6A-88ED-D417D57B6D2F} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM - {09EECF31-D086-4C6A-88ED-D417D57B6D2F} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM - {22CD1C1C-62E4-4A08-937E-DF510DD637A1} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM - {E89AE38C-AB97-41DF-84E8-78E332833273} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - DefaultScope {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=cd88b661-3383-42e6-b12e-81b159a50c7a&apn_sauid=FC2E8AEE-DEC4-4142-A085-54D38A270E0A
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=cd88b661-3383-42e6-b12e-81b159a50c7a&apn_sauid=FC2E8AEE-DEC4-4142-A085-54D38A270E0A
SearchScopes: HKCU - {E89AE38C-AB97-41DF-84E8-78E332833273} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: Download Accelerator Plus Integration - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\DAP\dapieloader.dll (SpeedBit Ltd.)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} -  No File
Toolbar: HKCU - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\cherrytomato\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default
FF user.js: detected! => C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\user.js
FF SearchEngineOrder.1: Ask.com
FF Keyword.URL: hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10395&locale=de_DE&apn_uid=cd88b661-3383-42e6-b12e-81b159a50c7a&apn_ptnrs=%5EABT&apn_sauid=FC2E8AEE-DEC4-4142-A085-54D38A270E0A&apn_dtid=%5EYYYYYY%5EYY%5EDE&&q=
FF NetworkProxy: "http", "127.0.0.1"
FF NetworkProxy: "http_port", 8555
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\npPDFXCviewNPPlugin.dll No File
FF Plugin: @java.com/DTPlugin,version=1.6.0_38 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @RadioRage_4j.com/Plugin - C:\Program Files\RadioRage_4j\bar\1.bin\NP4jStub.dll (Mindspark)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin: yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 - C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32neur.dll (SumTotal Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\*****\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\duden-online.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\urban-dictionary.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\youtube-videosuche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: RadioRage - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\4jffxtbr@RadioRage_4j.com [2014-04-11]
FF Extension: DoNotTrackMe - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\donottrackplus@abine.com [2013-08-19]
FF Extension: Pocket - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\isreaditlater@ideashower.com [2013-06-28]
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\toolbar@ask.com [2012-08-22]
FF Extension: TV-Fox - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4} [2013-03-30]
FF Extension: WOT - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: HP Detect - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2} [2012-08-26]
FF Extension: DownloadHelper - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-25]
FF Extension: Evernote Web Clipper - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800} [2013-12-18]
FF Extension: feedly - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\feedly@devhd.xpi [2011-07-07]
FF Extension: Cruxlight - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\jid1-45thW542wORoTw@jetpack.xpi [2013-03-12]
FF Extension: storeTab - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\nicktco@gmail.com.xpi [2014-02-02]
FF Extension: LeechBlock - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}.xpi [2011-10-18]
FF Extension: StumbleUpon - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi [2011-05-26]
FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-14]
FF Extension: FoxTab - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi [2011-06-29]
FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com [2014-03-18]
FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-03-18]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-03-18]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-03-18]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} [2014-03-18]
FF Extension: Hotspot Shield Extension - C:\Program Files\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2014-04-12]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011-03-13]
FF HKLM\...\Thunderbird\Extensions: [{857610fe-b36c-47f2-b4fa-6b7affe0cf5a}] - C:\Program Files\Mobile Master\ext\1\
FF Extension: Mobile Master Add-In - C:\Program Files\Mobile Master\ext\1\ []
FF HKCU\...\Firefox\Extensions: [{F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}] - C:\Program Files\DAP\DAPFireFox
FF Extension: Download Accelerator Plus (DAP) extension - C:\Program Files\DAP\DAPFireFox [2009-12-04]

Chrome: 
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (NEURON) - C:\Program Files\Mozilla Firefox\plugins\np32neur.dll (SumTotal Systems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Yahoo! activeX Plug-in Bridge) - C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)
CHR Plugin: (ActiveTouch General Plugin Container) - C:\Users\*****\AppData\Roaming\Mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
CHR Plugin: (AmazonMP3DownloaderPlugin) - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U38) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.380.5) - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Google Docs) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-02-28]
CHR Extension: (Google Drive) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-02-28]
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-28]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-28]
CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-28]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528608 2008-04-17] (Cisco Systems, Inc.)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-10-09] (Hewlett-Packard)
R2 hshld; C:\Program Files\Hotspot Shield\bin\cmw_srv.exe [944424 2014-01-15] (AnchorFree Inc.)
S3 HssTrayService; C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE [78512 2014-01-15] ()
R2 HssWd; C:\Program Files\Hotspot Shield\bin\hsswd.exe [555304 2014-01-15] ()
R2 RadioRage_4jService; C:\Program Files\RadioRage_4j\bar\1.bin\4jbarsvc.exe [88648 2014-04-11] (COMPANYVERS_NAME)
R2 Recovery Service for Windows; C:\Program Files\SMINST\BLService.exe [365952 2008-12-17] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [241734 2008-09-15] ()
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe [217170 2009-06-03] (IDT, Inc.)
R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [199600 2010-08-02] (Telefónica I+D)
R2 TVCapSvc; C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [296320 2008-11-26] ()
S3 TVSched; C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [116096 2008-11-26] ()
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [557968 2013-06-19] (Cisco Systems, Inc.)

==================== Drivers (Whitelisted) ====================

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-21] (Microsoft Corporation)
S3 acsint; C:\Windows\System32\DRIVERS\acsint.sys [39888 2013-06-19] (Cisco Systems, Inc.)
S3 acsmux; C:\Windows\System32\DRIVERS\acsmux.sys [58320 2013-06-19] (Cisco Systems, Inc.)
R3 Afc; C:\Windows\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306299 2008-04-17] (Cisco Systems, Inc.)
S3 DCamUSBEMPIA; C:\Windows\System32\DRIVERS\emDevice.sys [171136 2007-06-21] (eMPIA Technology, Inc.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [125328 2008-03-29] (Deterministic Networks, Inc.)
S3 emAudio; C:\Windows\System32\drivers\emAudio.sys [24448 2007-10-26] (eMPIA Technology, Inc.)
S3 FiltUSBEMPIA; C:\Windows\System32\DRIVERS\emFilter.sys [5248 2007-06-21] (eMPIA Technology, Inc.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [39624 2014-01-15] (AnchorFree Inc.)
S3 KORGUMDS; C:\Windows\System32\Drivers\KORGUMDS.SYS [24056 2011-03-30] (KORG INC.)
S3 NUMARK_OMNICONTROL; C:\Windows\System32\Drivers\nkc2_usb.sys [367104 2008-07-17] (Ploytec GmbH)
S3 NUMARK_OMNICONTROL_MIDI; C:\Windows\System32\drivers\nkc2midi.sys [28160 2008-07-17] (Numark)
S3 NUMARK_OMNICONTROL_WDM; C:\Windows\System32\drivers\nkc2_wdm.sys [33792 2008-07-17] (Numark)
S3 NvnUsbAudio; C:\Windows\System32\DRIVERS\nvnusbaudio.sys [41944 2011-10-05] (Novation DMS Ltd.)
R3 pfc; C:\Windows\System32\drivers\pfc.sys [10368 2004-04-01] (Padus, Inc.)
S3 PPJoyBus; C:\Windows\System32\DRIVERS\PPJoyBus.sys [15936 2009-11-04] (Deon van der Westhuysen)
S3 PPortJoystick; C:\Windows\System32\DRIVERS\PPortJoy.sys [31808 2009-11-04] (Deon van der Westhuysen)
S3 ScanUSBEMPIA; C:\Windows\System32\DRIVERS\emScan.sys [5120 2007-06-21] (eMPIA Technology, Inc.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-06-27] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [37064 2014-01-15] (Anchorfree Inc.)
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl [87536 2008-11-28] (CyberLink Corp.)
S2 adfs; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 jswmidin; \??\C:\Users\*****~1\AppData\Local\Temp\jswmidin.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 taphss; system32\DRIVERS\taphss.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-13 14:00 - 2014-04-13 14:01 - 00000000 ____D () C:\FRST
2014-04-13 13:51 - 2014-04-13 14:01 - 00000000 ____D () C:\Users\*****\Desktop\Kampf gegen den Virus
2014-04-13 13:45 - 2014-04-13 13:45 - 00000020 _____ () C:\Users\*****\defogger_reenable
2014-04-13 12:54 - 2014-04-13 12:54 - 00143312 _____ () C:\Windows\Minidump\Mini041314-01.dmp
2014-04-12 23:06 - 2013-12-27 13:05 - 103422302 _____ () C:\Users\*****\Desktop\*****_*****_001.psd
2014-04-12 14:33 - 2014-04-12 14:35 - 00000000 ____D () C:\ProgramData\Hotspot Shield
2014-04-12 14:31 - 2014-04-12 14:35 - 00000000 ____D () C:\Program Files\Hotspot Shield
2014-04-12 14:31 - 2014-01-15 00:45 - 00039624 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2014-04-12 02:06 - 2014-04-12 02:07 - 100054996 _____ () C:\Users\*****\Desktop\Snakeman Show.wav
2014-04-12 01:49 - 2014-04-12 02:08 - 00000000 ____D () C:\Users\*****\Desktop\Tokio Recordings
2014-04-11 20:10 - 2014-04-11 20:10 - 00000000 ____D () C:\Program Files\RadioRage_4j
2014-04-11 20:07 - 2014-04-11 20:07 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Hotspot Shield
2014-04-07 10:40 - 2014-04-07 10:41 - 42767668 _____ () C:\Users\*****\Downloads\High On You Mama (Ole Smokey Edit).wav
2014-03-27 10:47 - 2014-03-27 10:48 - 00000000 ____D () C:\Users\*****\Desktop\4. Stock
2014-03-23 11:31 - 2014-03-23 15:44 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-03-22 23:43 - 2014-04-12 20:34 - 00000000 ____D () C:\Users\*****\Desktop\im bett mit
2014-03-22 23:31 - 2014-03-22 23:31 - 00000000 ____D () C:\Users\*****\Downloads\creampuff
2014-03-22 23:26 - 2014-03-22 23:26 - 00031775 _____ () C:\Users\*****\Downloads\creampuff.zip
2014-03-18 22:05 - 2014-03-18 22:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-04-13 14:01 - 2014-04-13 14:00 - 00000000 ____D () C:\FRST
2014-04-13 14:01 - 2014-04-13 13:51 - 00000000 ____D () C:\Users\*****\Desktop\Kampf gegen den Virus
2014-04-13 13:55 - 2006-11-02 12:33 - 01445546 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-13 13:53 - 2009-07-20 02:24 - 02046305 _____ () C:\Windows\WindowsUpdate.log
2014-04-13 13:49 - 2009-11-30 11:51 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-13 13:48 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-13 13:48 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-13 13:48 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-13 13:46 - 2006-11-02 15:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-13 13:45 - 2014-04-13 13:45 - 00000020 _____ () C:\Users\*****\defogger_reenable
2014-04-13 13:45 - 2009-09-18 14:10 - 00000000 ____D () C:\Users\*****
2014-04-13 13:32 - 2012-04-11 11:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-13 12:54 - 2014-04-13 12:54 - 00143312 _____ () C:\Windows\Minidump\Mini041314-01.dmp
2014-04-13 12:54 - 2009-11-19 15:51 - 322871239 _____ () C:\Windows\MEMORY.DMP
2014-04-13 12:54 - 2009-11-19 15:51 - 00000000 ____D () C:\Windows\Minidump
2014-04-13 12:48 - 2009-11-30 11:51 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-12 23:00 - 2006-11-02 14:52 - 00364678 _____ () C:\Windows\setupact.log
2014-04-12 20:34 - 2014-03-22 23:43 - 00000000 ____D () C:\Users\*****\Desktop\im bett mit
2014-04-12 19:17 - 2010-03-07 02:45 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Mp3tag
2014-04-12 15:19 - 2010-01-16 09:34 - 00054110 _____ () C:\Users\*****\Desktop\songs.txt
2014-04-12 14:35 - 2014-04-12 14:33 - 00000000 ____D () C:\ProgramData\Hotspot Shield
2014-04-12 14:35 - 2014-04-12 14:31 - 00000000 ____D () C:\Program Files\Hotspot Shield
2014-04-12 14:31 - 2012-07-20 20:45 - 00012591 _____ () C:\Windows\certutil.log
2014-04-12 14:27 - 2010-06-25 15:43 - 00000000 ___RD () C:\Users\*****\Documents\My Dropbox
2014-04-12 13:24 - 2009-09-20 15:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc
2014-04-12 12:25 - 2010-06-25 15:42 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-04-12 11:36 - 2009-09-20 11:05 - 00155136 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-12 11:33 - 2010-06-25 15:42 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-12 10:43 - 2009-09-23 00:47 - 00000000 ____D () C:\Users\*****\Downloads\mp3
2014-04-12 03:17 - 2012-06-13 22:09 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Spotify
2014-04-12 02:23 - 2012-06-13 22:10 - 00000000 ____D () C:\Users\*****\AppData\Local\Spotify
2014-04-12 02:08 - 2014-04-12 01:49 - 00000000 ____D () C:\Users\*****\Desktop\Tokio Recordings
2014-04-12 02:07 - 2014-04-12 02:06 - 100054996 _____ () C:\Users\*****\Desktop\Snakeman Show.wav
2014-04-11 20:13 - 2008-01-21 04:47 - 00464626 _____ () C:\Windows\PFRO.log
2014-04-11 20:10 - 2014-04-11 20:10 - 00000000 ____D () C:\Program Files\RadioRage_4j
2014-04-11 20:10 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Resources
2014-04-11 20:07 - 2014-04-11 20:07 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Hotspot Shield
2014-04-07 10:41 - 2014-04-07 10:40 - 42767668 _____ () C:\Users\*****\Downloads\High On You Mama (Ole Smokey Edit).wav
2014-03-31 09:35 - 2009-11-19 10:12 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-27 10:48 - 2014-03-27 10:47 - 00000000 ____D () C:\Users\*****\Desktop\4. Stock
2014-03-25 01:39 - 2009-10-08 15:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2014-03-25 01:07 - 2009-10-08 15:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\skypePM
2014-03-23 21:38 - 2012-04-26 19:06 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-03-23 15:44 - 2014-03-23 11:31 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-03-23 10:55 - 2009-09-18 14:17 - 00086504 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-23 10:53 - 2006-11-02 14:47 - 02270584 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-22 23:31 - 2014-03-22 23:31 - 00000000 ____D () C:\Users\*****\Downloads\creampuff
2014-03-22 23:26 - 2014-03-22 23:26 - 00031775 _____ () C:\Users\*****\Downloads\creampuff.zip
2014-03-22 22:02 - 2014-02-08 13:40 - 00000000 ____D () C:\Users\*****\Desktop\Filme
2014-03-18 22:05 - 2014-03-18 22:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox

Files to move or delete:
====================
C:\Users\*****\AppData\Roaming\desktop.ini
C:\Users\Public\Mobile_Connection_Manager_RC4.5.exe


Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-13 13:55

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-04-2014 01
Ran by ***** at 2014-04-13 14:01:51
Running from C:\Users\*****\Desktop\Kampf gegen den Virus
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Ableton Live 9 Trial (HKLM\...\{D78A9F97-5168-4EB2-B82F-0ACEBDE13583}) (Version: 9.0.0.0 - Ableton)
Adobe Audition 3.0 (HKLM\...\Adobe Audition 3.0) (Version: 3.0 - Adobe Systems Incorporated)
Adobe Audition 3.0 (Version: 3.0 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader X (10.1.6) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.6 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.)
Ask Toolbar (HKLM\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.26.0 - Ask.com) <==== ATTENTION
Avira SearchFree Toolbar plus Web Protection Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.3.0.23930 - Ask.com) <==== ATTENTION
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Canon MG5100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series) (Version:  - )
Cisco AnyConnect Secure Mobility Client  (HKLM\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.04059 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (Version: 3.1.04059 - Cisco Systems, Inc.) Hidden
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Defraggler (HKLM\...\Defraggler) (Version: 2.13 - Piriform)
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
EVEREST Home Edition v2.20 (HKLM\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Evernote v. 4.6.6 (HKLM\...\{6146B9DC-C33D-11E2-BDE1-984BE15F174E}) (Version: 4.6.6.8360 - Evernote Corp.)
FormatFactory 3.0.1 (HKLM\...\FormatFactory) (Version: 3.0.1 - Free Time)
Google Chrome (HKLM\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Update Helper (Version: 1.3.23.9 - Google Inc.) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
Hotline Miami (HKLM\...\GOGPACKHOTLINEMIAMI_is1) (Version: 2.0.0.4 - GOG.com)
Hotspot Shield 3.32 (HKLM\...\HotspotShield) (Version: 3.32 - AnchorFree Inc.)
iTunes (HKLM\...\{C197BC08-3D82-4651-8886-E68C21578A38}) (Version: 11.1.3.8 - Apple Inc.)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 24.4.0 - Mozilla)
Mozilla Thunderbird 24.4.0 (x86 de) (HKLM\...\Mozilla Thunderbird 24.4.0 (x86 de)) (Version: 24.4.0 - Mozilla)
Mp3tag v2.58 (HKLM\...\Mp3tag) (Version: v2.58 - Florian Heidenreich)
PDF24 Creator 5.6.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Revo Uninstaller 1.94 (HKLM\...\Revo Uninstaller) (Version: 1.94 - VS Revo Group)
Skype™ 4.2 (HKLM\...\{D103C4BA-F905-437A-8049-DB24763BBE36}) (Version:  - )
Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2836939v3) (Version: 3 - Microsoft Corporation)
WebEx (HKCU\...\ActiveTouchMeetingClient) (Version:  - Cisco WebEx LLC)
Winamp Detector Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
XMedia Recode Version 3.1.7.7 (HKLM\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.7.7 - XMedia Recode)

==================== Restore Points  =========================

09-03-2014 11:59:54 Geplanter Prüfpunkt
10-03-2014 08:18:44 Geplanter Prüfpunkt
11-03-2014 18:20:45 Geplanter Prüfpunkt
12-03-2014 08:05:06 Geplanter Prüfpunkt
13-03-2014 22:44:05 Geplanter Prüfpunkt
15-03-2014 15:04:26 Geplanter Prüfpunkt
16-03-2014 00:35:39 Windows Update
16-03-2014 13:08:51 Geplanter Prüfpunkt
18-03-2014 21:35:46 Geplanter Prüfpunkt
21-03-2014 18:26:37 Windows Update
22-03-2014 12:12:14 Geplanter Prüfpunkt
24-03-2014 07:56:28 Geplanter Prüfpunkt
26-03-2014 07:31:27 Geplanter Prüfpunkt
26-03-2014 20:02:15 Geplanter Prüfpunkt
27-03-2014 08:41:50 Windows Update
07-04-2014 07:53:07 Windows Update
10-04-2014 19:15:50 Geplanter Prüfpunkt
11-04-2014 18:03:59 Gerätetreiber-Paketinstallation: Anchorfree HSS VPN Adapter Netzwerkadapter
12-04-2014 00:27:47 Windows Update
12-04-2014 12:31:41 Gerätetreiber-Paketinstallation: Anchorfree Inc Netzwerkdienst
12-04-2014 12:33:47 Gerätetreiber-Paketinstallation: Anchorfree HSS VPN Adapter Netzwerkadapter
13-04-2014 11:37:29 Removed Ableton Live 9 Trial

==================== Hosts content: ==========================

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {26F767FD-1CBA-40D1-ACF5-35D8969607A9} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {33D134EF-E187-411A-87A2-B36075EFE0A9} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - ***** => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {658BB1C4-E1F5-4E24-B50A-8AEBCA65D12C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-11-30] (Google Inc.)
Task: {7DE65F70-88B4-43D8-94EB-CD275FC32E83} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2013-04-30] () <==== ATTENTION
Task: {B0E740B9-7CD6-485D-A6CE-8284BCED0C07} - System32\Tasks\{2B87BFFC-1509-4587-9F68-DE0B8A4D7536} => C:\Program Files\Skype\Phone\Skype.exe [2010-05-13] (Skype Technologies S.A.)
Task: {C676113B-D817-4AEE-9511-7EA8FE7EBE7F} - System32\Tasks\SecureW2 Task => C:\Program Files\SecureW2\sw2_tray.exe [2012-08-17] (SecureW2 B.V.)
Task: {CCFE9C73-CAB3-435A-B958-52AD5C05CC5E} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-10-09] (Hewlett-Packard)
Task: {D297BFE1-A17A-4E05-B98D-89C563152B2C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {E42A5F45-1874-4403-8A75-EA229F715AE2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-11-30] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {ED7BB00E-D568-41F3-96F4-53CD93AC7229} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-11] (Adobe Systems Incorporated)
Task: {F56426E3-2573-4E93-8442-D1BC09BB47D4} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-06-19 17:00 - 2013-06-19 17:00 - 00063376 _____ () C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2012-10-18 00:28 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2011-09-27 09:23 - 2011-09-27 09:23 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-09-27 09:22 - 2011-09-27 09:22 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2008-04-17 09:08 - 2008-04-17 09:08 - 00197408 _____ () C:\Windows\system32\vpnapi.dll
2014-01-15 01:23 - 2014-01-15 01:23 - 00937768 _____ () C:\Program Files\Hotspot Shield\bin\af_proxy.dll
2014-01-15 01:30 - 2014-01-15 01:30 - 00514344 _____ () C:\Program Files\Hotspot Shield\bin\HssRep.dll
2014-01-15 01:29 - 2014-01-15 01:29 - 00555304 _____ () C:\Program Files\Hotspot Shield\bin\hsswd.exe
2009-01-23 06:01 - 2008-12-17 17:11 - 00365952 _____ () C:\Program Files\SMINST\BLService.exe
2009-01-23 06:01 - 2008-12-17 17:11 - 00132480 _____ () C:\Program Files\SMINST\STWmiM.dll
2009-01-23 05:53 - 2008-09-15 16:13 - 00241734 _____ () C:\Program Files\CyberLink\Shared files\RichVideo.exe
2008-11-26 17:13 - 2008-11-26 17:13 - 00296320 ____N () C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
2008-11-26 17:13 - 2008-11-26 17:13 - 00263560 ____N () C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\CLCapEngine.dll
2012-07-04 07:09 - 2012-07-04 07:09 - 00037376 _____ () C:\Windows\system32\atitmpxx.dll
2009-10-31 18:13 - 2009-08-16 18:06 - 00141312 _____ () C:\Program Files\WinRAR\rarext.dll
2012-12-30 00:08 - 2012-12-30 00:08 - 00043520 _____ () C:\Windows\system32\CmdLineExt03.dll
2012-07-04 01:16 - 2012-07-04 01:16 - 00369152 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2008-10-22 11:32 - 2008-10-22 11:32 - 00628016 _____ () C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
2010-10-27 21:40 - 2010-10-27 21:40 - 00028672 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-03-18 22:05 - 2014-03-18 22:05 - 03642480 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:2B11E0DF
AlternateDataStreams: C:\ProgramData\Temp:553CA6CA
AlternateDataStreams: C:\ProgramData\Temp:D74B6CF5
AlternateDataStreams: C:\Users\Public\.apdisk:com.apple.quarantine
AlternateDataStreams: C:\Users\Public\.DS_Store:AFP_AfpInfo
AlternateDataStreams: C:\Users\Public\.TemporaryItems:AFP_AfpInfo
AlternateDataStreams: C:\Users\Public\.TemporaryItems:com.apple.quarantine
AlternateDataStreams: C:\Users\Public\Documents\.DS_Store:AFP_AfpInfo

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk => C:\Windows\pss\VPN Client.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^cherrytomato.lnk => C:\Windows\pss\cherrytomato.lnk.Startup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk => C:\Windows\pss\EvernoteClipper.lnk.Startup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk => C:\Windows\pss\OpenOffice.org 3.1.lnk.Startup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^wkcalrem.LNK => C:\Windows\pss\wkcalrem.LNK.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AdobeCS4ServiceManager => "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: ApnUpdater => "C:\Program Files\Ask.com\Updater\Updater.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BBuJUuKs => wscript.exe //B "C:\Users\*****~1\AppData\Local\Temp\BBuJUuKs.vbs"
MSCONFIG\startupreg: Cisco AnyConnect Secure Mobility Agent for Windows => "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
MSCONFIG\startupreg: CLMLServer for HP TouchSmart => "C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: DownloadAccelerator => "C:\Program Files\DAP\DAP.EXE" /STARTUP
MSCONFIG\startupreg: DVDAgent => "C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe"
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: HPAdvisor => C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN
MSCONFIG\startupreg: HPUsageTracking => "C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT\"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KORG USB-MIDI Driver => C:\Program Files\KORG\KORG USB-MIDI Driver\EsHelper2.exe /s
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: MMAgent => C:\Program Files\Mobile Master\MMAgent.exe
MSCONFIG\startupreg: MobileConnect => %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
MSCONFIG\startupreg: PDFPrint => C:\Program Files\PDF24\pdf24.exe
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RadioRage EPM Support => "C:\PROGRA~1\RADIOR~1\bar\1.bin\4jmedint.exe" T8EPMSUP.DLL,S
MSCONFIG\startupreg: RadioRage Home Page Guard 32 bit => "C:\PROGRA~1\RADIOR~1\bar\1.bin\AppIntegrator.exe"
MSCONFIG\startupreg: RadioRage Search Scope Monitor => "C:\PROGRA~1\RADIOR~1\bar\1.bin\4jsrchmn.exe" /m=2 /w /h
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
MSCONFIG\startupreg: SmartMenu => %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
MSCONFIG\startupreg: Spotify => "C:\Users\*****\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: Steam => "C:\Program Files\Steam\Steam.exe" -silent
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: TSMAgent => "C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe"
MSCONFIG\startupreg: TVAgent => "C:\Program Files\Hewlett-Packard\Media\TV\TVAgent.exe"
MSCONFIG\startupreg: UCam_Menu => "C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Hewlett-Packard\Media\Webcam" update "Software\Hewlett-Packard\Media\Webcam"
MSCONFIG\startupreg: UpdateLBPShortCut => "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
MSCONFIG\startupreg: UpdateP2GoShortCut => "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
MSCONFIG\startupreg: UpdatePDIRShortCut => "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"
MSCONFIG\startupreg: UpdatePSTShortCut => "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
MSCONFIG\startupreg: WinampAgent => "C:\Program Files\Winamp\winampa.exe"
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe

==================== Faulty Device Manager Devices =============

Name: Microsoft-6zu4-Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft-6zu4-Adapter #2
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft-6zu4-Adapter #3
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft-6zu4-Adapter #5
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft-6zu4-Adapter #6
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft-6zu4-Adapter #7
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft-6zu4-Adapter #8
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft-6zu4-Adapter #9
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft-6zu4-Adapter #12
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft-6zu4-Adapter #13
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft-6zu4-Adapter #14
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Cisco Systems VPN Adapter
Description: Cisco Systems VPN Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/13/2014 01:49:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/13/2014 01:37:30 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: 
Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.

System Error:
Zugriff verweigert

Error: (04/13/2014 01:37:06 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: 
Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.

System Error:
Zugriff verweigert

Error: (04/13/2014 01:35:03 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\A\F2> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/13/2014 01:35:03 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\A\F2> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/13/2014 01:35:02 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\A\D4> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/13/2014 01:35:02 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\A\D4> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/13/2014 01:34:41 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\F\C5> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/13/2014 01:34:41 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\F\C5> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)

Error: (04/13/2014 01:34:40 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\F\B8> in der Hash-Zuordnung kann nicht aktualisiert werden.

Kontext:  Anwendung, SystemIndex Katalog


Details:
	Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)


System errors:
=============
Error: (04/13/2014 02:07:08 PM) (Source: DCOM) (User: )
Description: localiziziziziz

Error: (04/13/2014 02:07:02 PM) (Source: DCOM) (User: )
Description: localiziziziziz

Error: (04/13/2014 02:06:56 PM) (Source: DCOM) (User: )
Description: localiziziziziz

Error: (04/13/2014 02:06:50 PM) (Source: DCOM) (User: )
Description: localiziziziziz

Error: (04/13/2014 02:06:44 PM) (Source: DCOM) (User: )
Description: localiziziziziz

Error: (04/13/2014 02:06:39 PM) (Source: DCOM) (User: )
Description: localiziziziziz

Error: (04/13/2014 02:05:38 PM) (Source: DCOM) (User: )
Description: localiziziziziz

Error: (04/13/2014 02:05:32 PM) (Source: DCOM) (User: )
Description: localiziziziziz

Error: (04/13/2014 02:05:26 PM) (Source: DCOM) (User: )
Description: localiziziziziz

Error: (04/13/2014 02:05:20 PM) (Source: DCOM) (User: )
Description: localiziziziziz


Microsoft Office Sessions:
=========================
Error: (06/24/2011 03:59:20 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5543 seconds with 300 seconds of active time.  This session ended with a crash.

Error: (06/29/2010 10:47:11 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 23 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (06/10/2010 10:23:01 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 40 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2013-08-19 00:23:12.596
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\verifier.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 50%
Total physical RAM: 3038.24 MB
Available physical RAM: 1491.98 MB
Total Pagefile: 6286.7 MB
Available Pagefile: 4507.89 MB
Total Virtual: 2047.88 MB
Available Virtual: 1900.34 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:454.69 GB) (Free:32.53 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:11.07 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 87C06E9E)
Partition 1: (Active) - (Size=455 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=11 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-13 15:08:09
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD5000BEVT-60ZAT1 rev.02.01A02 465,76GB
Running: 52xrke6g.exe; Driver: C:\Users\*****~1\AppData\Local\Temp\axtiqkog.sys


---- System - GMER 2.1 ----

SSDT            803950CE                                                                                                            ZwCreateSection
SSDT            803950D8                                                                                                            ZwRequestWaitReplyPort
SSDT            803950D3                                                                                                            ZwSetContextThread
SSDT            803950DD                                                                                                            ZwSetSecurityObject
SSDT            803950E2                                                                                                            ZwSystemDebugControl
SSDT            8039506F                                                                                                            ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!KeSetEvent + 215                                                                                       836F1860 4 Bytes  [CE, 50, 39, 80]
.text           ntkrnlpa.exe!KeSetEvent + 539                                                                                       836F1B84 4 Bytes  [D8, 50, 39, 80]
.text           ntkrnlpa.exe!KeSetEvent + 56D                                                                                       836F1BB8 4 Bytes  [D3, 50, 39, 80]
.text           ntkrnlpa.exe!KeSetEvent + 5D1                                                                                       836F1C1C 1 Byte  [DD]
.text           ntkrnlpa.exe!KeSetEvent + 5D1                                                                                       836F1C1C 4 Bytes  [DD, 50, 39, 80]
.text           ...                                                                                                                 
.text           C:\Windows\system32\DRIVERS\atikmdag.sys                                                                            section is writeable [0x90A0A000, 0x2BFBF0, 0xE8000020]
.text           C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl                                                                  section is writeable [0xA50F8000, 0x2892, 0xE8000020]
.vmp2           C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl                                                                  entry point in ".vmp2" section [0xA511B050]

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                             Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                             Wdf01000.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Program Files\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x9F 0x75 0x2A 0x78 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x65 0x60 0x63 0x75 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x6A 0xF8 0x97 0x02 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Program Files\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x9F 0x75 0x2A 0x78 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x65 0x60 0x63 0x75 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x6A 0xF8 0x97 0x02 ...

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                                                                               unknown MBR code

---- EOF - GMER 2.1 ----