Videos untebrochen: Umleitung auf fake Java Seiten

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-05-2014 01
Ran by Admin (administrator) on MBABA on 09-05-2014 18:14:57
Running from C:\Users\Roland\Downloads\aTrojaner board
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\Windows\System32\BCMWLTRY.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ABBYY) C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\AEstSrv.exe
(Seagate Technology LLC) C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\stacsv.exe
(H+H Software GmbH) C:\Program Files\virtual cd v9\System\VC9SecS.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Dell Inc.) C:\Windows\System32\WLTRAY.EXE
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(Apache Software Foundation) C:\Program Files\OpenOffice 4\program\swriter.exe
(Apache Software Foundation) C:\Program Files\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files\OpenOffice 4\program\soffice.bin


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Windows\system32\WLTRAY.exe [3444736 2007-12-08] (Dell Inc.)
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [167936 2007-10-25] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [SigmatelSysTrayApp] => C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2008-02-15] (IDT, Inc.)
HKLM\...\Run: [OEM02Mon.exe] => C:\Windows\OEM02Mon.exe [36864 2007-05-10] (Creative Technology Ltd.)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-220269263-577320097-2663645953-1002\...\MountPoints2: {ac7e27cd-1278-11e2-a0a0-00219bdefa49} - G:\LxSetup.exe
HKU\S-1-5-21-220269263-577320097-2663645953-501\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-220269263-577320097-2663645953-501\...\MountPoints2: {ab6711b7-0e16-11e2-8f80-806e6f6e6963} - E:\InstallNavi.exe
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Roland\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?ocid=EIE9HP&PC=UP50
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=EIE9HP&PC=UP50
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com/?fr=fp-mediaphor
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.yahoo.com/?fr=fp-mediaphor
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-mediaphor
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} -  No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nt5pt97f.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pages.tvunetworks.com/WebPlayer - C:\Program Files\TVUPlayer\npTVUAx.dll No File
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\aestsrv.exe [73728 2007-09-20] (Andrea Electronics Corporation)
R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2010-01-11] (Stardock Corporation)
R2 FreeAgentGoNext Service; C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe [181544 2009-05-01] (Seagate Technology LLC)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\STacSV.exe [102400 2008-02-15] (IDT, Inc.)
R2 VC9SecS; C:\Program Files\virtual cd v9\System\VC9SecS.exe [132424 2009-10-01] (H+H Software GmbH)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2506752 2007-12-08] (Dell Inc.)

==================== Drivers (Whitelisted) ====================

S3 HH9Help.sys; C:\Windows\system32\drivers\HH9Help.sys [11392 2006-09-20] (H+H Software GmbH)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-05-08] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
S3 Nokia USB Generic; C:\Windows\System32\drivers\nmwcdc.sys [8704 2006-05-29] (Nokia)
S3 Nokia USB Modem; C:\Windows\System32\drivers\nmwcdcm.sys [13312 2006-05-29] (Nokia)
S3 Nokia USB Phone Parent; C:\Windows\System32\drivers\nmwcd.sys [127488 2006-05-29] (Nokia)
S3 Nokia USB Port; C:\Windows\System32\drivers\nmwcdcj.sys [13312 2006-05-29] (Nokia)
R1 vdrv9000; C:\Windows\System32\DRIVERS\vdrv9000.sys [113688 2009-03-17] (H+H Software GmbH)
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] ()
U3 uxldypog; \??\C:\Users\Admin\AppData\Local\Temp\uxldypog.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-09 11:39 - 2014-05-09 11:39 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-05-09 11:38 - 2014-05-09 18:14 - 00000000 ____D () C:\Users\Roland\Downloads\aTrojaner board
2014-05-08 23:17 - 2014-05-08 23:17 - 00000899 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-08 23:17 - 2014-05-08 23:17 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-08 23:17 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-08 23:17 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-08 23:17 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-02 14:04 - 2014-05-02 14:08 - 00000805 _____ () C:\Users\Roland\Desktop\bitcoin-qt.exe - Verknüpfung.lnk
2014-05-02 13:54 - 2014-04-29 12:28 - 12347392 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-02 13:54 - 2014-04-29 12:07 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-02 11:17 - 2014-05-02 11:17 - 00000000 ____D () C:\Users\Gast\AppData\Local\adaware
2014-05-01 19:32 - 2014-05-01 19:32 - 00000000 ____D () C:\Program Files\Bitcoin
2014-05-01 19:25 - 2014-05-02 14:06 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\Bitcoin
2014-05-01 11:57 - 2014-05-08 23:32 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Bitcoin
2014-05-01 11:57 - 2014-05-01 11:57 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bitcoin Core
2014-05-01 11:51 - 2014-05-01 11:51 - 11217912 _____ (Bitcoin Core project) C:\Users\Roland\Downloads\bitcoin-0.9.1-win32-setup.exe
2014-05-01 06:58 - 2014-05-01 06:58 - 00000000 ____D () C:\Users\Admin\AppData\Local\Macromedia
2014-05-01 06:44 - 2014-05-09 15:33 - 00000433 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-05-01 06:37 - 2014-05-01 06:37 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Mozilla
2014-04-29 12:24 - 2014-04-29 12:24 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-29 12:24 - 2014-04-29 12:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-04-28 19:26 - 2014-04-28 19:26 - 00001327 _____ () C:\Users\Admin\Desktop\Dark Tales.lnk
2014-04-28 19:26 - 2014-04-28 19:26 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\ERS Game Studios
2014-04-28 19:21 - 2014-04-28 19:26 - 00000000 ____D () C:\Program Files\Dark Tales - Die Maske des Roten Todes von Edgar Allan Poe SA
2014-04-24 18:05 - 2014-04-24 18:05 - 00000290 _____ () C:\Users\Roland\Documents\cc_20140424_180545.reg
2014-04-24 17:25 - 2014-04-24 17:25 - 00006634 _____ () C:\Users\Roland\Documents\cc_20140424_172550.reg
2014-04-24 16:11 - 2014-04-24 16:11 - 00000324 _____ () C:\Windows\PFRO.log
2014-04-21 18:46 - 2014-04-21 19:30 - 00000000 ____D () C:\Users\Roland\AppData\Local\adaware
2014-04-21 18:40 - 2014-04-21 18:44 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Ad-Aware Antivirus
2014-04-21 16:42 - 2014-04-21 16:42 - 00000634 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-04-21 16:39 - 2014-04-21 16:39 - 00000000 ____D () C:\Windows\ERUNT
2014-04-19 21:06 - 2014-05-08 23:32 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-19 19:03 - 2014-04-21 22:21 - 00000000 ____D () C:\AdwCleaner
2014-04-19 13:56 - 2014-04-19 13:57 - 00015610 _____ () C:\Users\Roland\Documents\AboKündigung der Taz 19.April 2014.odt
2014-04-17 12:45 - 2014-04-17 16:15 - 00000000 ____D () C:\Users\Roland\Desktop\VLC-Songs
2014-04-17 00:36 - 2014-04-17 00:36 - 00000911 _____ () C:\Users\Roland\Desktop\DDMCache - Verknüpfung.lnk
2014-04-16 21:16 - 2014-04-16 21:39 - 00000000 ____D () C:\Users\Public\Trojanerbekaempfung
2014-04-16 21:05 - 2014-05-09 18:14 - 00000000 ____D () C:\FRST
2014-04-16 13:46 - 2014-04-16 13:46 - 00000859 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-04-16 13:42 - 2014-04-16 13:42 - 00000000 ____D () C:\Windows\IrfanView
2014-04-16 13:11 - 2014-04-16 13:11 - 00000000 ____D () C:\Users\Admin\AppData\Local\Secunia PSI
2014-04-16 13:11 - 2014-04-16 13:11 - 00000000 ____D () C:\Program Files\Secunia
2014-04-16 05:21 - 2014-04-16 12:56 - 00000000 ____D () C:\Program Files\ABBYY FineReader 9.0 Sprint
2014-04-16 05:21 - 2014-04-16 05:21 - 00000000 ____D () C:\Program Files\Common Files\ABBYY
2014-04-16 04:59 - 2014-04-16 04:59 - 00000000 ____D () C:\Users\Roland\AppData\Local\ABBYY
2014-04-16 03:47 - 2014-04-16 03:47 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\OpenOffice
2014-04-16 03:25 - 2014-04-16 03:25 - 00001892 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-04-16 03:24 - 2014-04-16 03:24 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-04-16 03:04 - 2014-04-16 03:04 - 00000000 ____D () C:\Windows\system32\Adobe
2014-04-16 03:02 - 2014-04-16 03:03 - 00000000 ____D () C:\Program Files\OpenOffice 4
2014-04-16 02:47 - 2014-04-16 02:47 - 00000000 ____D () C:\Users\Admin\Desktop\OpenOffice 4.0.1 (de) Installation Files
2014-04-16 02:14 - 2014-04-16 02:14 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\KC Softwares
2014-04-16 02:02 - 2014-04-16 02:02 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-04-16 02:02 - 2014-04-16 02:01 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-16 02:01 - 2014-04-16 02:01 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-16 02:01 - 2014-04-16 02:01 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-16 02:01 - 2014-04-16 02:01 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-04-15 14:05 - 2014-04-15 14:05 - 00001688 _____ () C:\Users\Roland\Desktop\CCleaner.lnk
2014-04-10 14:23 - 2014-04-10 14:23 - 01544704 _____ () C:\Windows\is-50C2L.exe
2014-04-10 14:23 - 2014-04-10 14:23 - 00025599 _____ () C:\Windows\is-50C2L.msg
2014-04-10 14:23 - 2014-04-10 14:23 - 00000293 _____ () C:\Windows\is-50C2L.lst
2014-04-09 15:11 - 2014-04-09 15:11 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-04-09 14:51 - 2014-03-08 01:20 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-09 14:51 - 2014-03-08 01:12 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-09 14:51 - 2014-03-08 01:03 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-09 14:51 - 2014-03-08 01:02 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-09 14:51 - 2014-03-08 01:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-09 14:51 - 2014-03-08 01:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-04-09 14:51 - 2014-03-08 00:59 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-09 14:51 - 2014-03-08 00:57 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-04-09 14:51 - 2014-03-08 00:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-09 14:51 - 2014-03-08 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-09 14:51 - 2014-03-08 00:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-09 14:51 - 2014-03-08 00:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-09 14:51 - 2014-03-08 00:52 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-04-09 14:51 - 2014-03-08 00:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-09 11:48 - 2014-02-06 03:56 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

==================== One Month Modified Files and Folders =======

2014-05-09 18:14 - 2014-05-09 11:38 - 00000000 ____D () C:\Users\Roland\Downloads\aTrojaner board
2014-05-09 18:14 - 2014-04-16 21:05 - 00000000 ____D () C:\FRST
2014-05-09 16:31 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-09 16:31 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-09 15:36 - 2012-11-05 12:08 - 01193101 _____ () C:\Windows\WindowsUpdate.log
2014-05-09 15:33 - 2014-05-01 06:44 - 00000433 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-05-09 11:39 - 2014-05-09 11:39 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-05-09 11:39 - 2012-10-04 15:17 - 00000000 ____D () C:\Users\Admin
2014-05-09 10:33 - 2006-11-02 12:33 - 01565124 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-08 23:32 - 2014-05-01 11:57 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Bitcoin
2014-05-08 23:32 - 2014-04-19 21:06 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-08 23:32 - 2011-05-31 01:56 - 00000000 ____D () C:\Users\Roland\Bitcoin
2014-05-08 23:17 - 2014-05-08 23:17 - 00000899 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-08 23:17 - 2014-05-08 23:17 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-05-08 19:35 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-08 13:03 - 2006-11-02 15:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-08 08:26 - 2012-10-11 00:02 - 00776670 _____ () C:\Users\Admin\AppData\Local\census.cache
2014-05-08 08:26 - 2012-10-11 00:02 - 00165980 _____ () C:\Users\Admin\AppData\Local\ars.cache
2014-05-06 23:33 - 2013-08-10 14:41 - 00000025 _____ () C:\Users\Roland\AppData\Roaming\Network Meter_Usage.ini
2014-05-05 18:50 - 2012-10-07 18:58 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\vlc
2014-05-04 11:01 - 2010-12-28 14:53 - 00000000 ____D () C:\Users\Roland\.gigaflat
2014-05-02 14:08 - 2014-05-02 14:04 - 00000805 _____ () C:\Users\Roland\Desktop\bitcoin-qt.exe - Verknüpfung.lnk
2014-05-02 14:06 - 2014-05-01 19:25 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\Bitcoin
2014-05-02 11:17 - 2014-05-02 11:17 - 00000000 ____D () C:\Users\Gast\AppData\Local\adaware
2014-05-02 11:17 - 2013-07-29 19:42 - 00061336 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-01 19:32 - 2014-05-01 19:32 - 00000000 ____D () C:\Program Files\Bitcoin
2014-05-01 11:57 - 2014-05-01 11:57 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bitcoin Core
2014-05-01 11:51 - 2014-05-01 11:51 - 11217912 _____ (Bitcoin Core project) C:\Users\Roland\Downloads\bitcoin-0.9.1-win32-setup.exe
2014-05-01 06:58 - 2014-05-01 06:58 - 00000000 ____D () C:\Users\Admin\AppData\Local\Macromedia
2014-05-01 06:37 - 2014-05-01 06:37 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Mozilla
2014-04-29 12:28 - 2014-05-02 13:54 - 12347392 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 12:24 - 2014-04-29 12:24 - 00000846 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-29 12:24 - 2014-04-29 12:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-04-29 12:07 - 2014-05-02 13:54 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-28 19:26 - 2014-04-28 19:26 - 00001327 _____ () C:\Users\Admin\Desktop\Dark Tales.lnk
2014-04-28 19:26 - 2014-04-28 19:26 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\ERS Game Studios
2014-04-28 19:26 - 2014-04-28 19:21 - 00000000 ____D () C:\Program Files\Dark Tales - Die Maske des Roten Todes von Edgar Allan Poe SA
2014-04-28 10:06 - 2013-09-11 15:47 - 00000000 ____D () C:\Users\Roland\Downloads\Xa_Spiele
2014-04-27 23:54 - 2012-10-04 18:54 - 00000000 ____D () C:\Program Files\Opera
2014-04-24 18:05 - 2014-04-24 18:05 - 00000290 _____ () C:\Users\Roland\Documents\cc_20140424_180545.reg
2014-04-24 17:25 - 2014-04-24 17:25 - 00006634 _____ () C:\Users\Roland\Documents\cc_20140424_172550.reg
2014-04-24 16:11 - 2014-04-24 16:11 - 00000324 _____ () C:\Windows\PFRO.log
2014-04-24 16:11 - 2012-10-05 14:22 - 00000000 ____D () C:\Windows\PCHEALTH
2014-04-21 22:21 - 2014-04-19 19:03 - 00000000 ____D () C:\AdwCleaner
2014-04-21 22:18 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2014-04-21 19:30 - 2014-04-21 18:46 - 00000000 ____D () C:\Users\Roland\AppData\Local\adaware
2014-04-21 18:44 - 2014-04-21 18:40 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Ad-Aware Antivirus
2014-04-21 18:43 - 2006-11-02 13:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-04-21 18:42 - 2012-10-11 19:19 - 00000000 ____D () C:\Users\Admin\AppData\Local\Downloaded Installations
2014-04-21 16:42 - 2014-04-21 16:42 - 00000634 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-04-21 16:39 - 2014-04-21 16:39 - 00000000 ____D () C:\Windows\ERUNT
2014-04-20 09:12 - 2013-07-23 00:40 - 00000000 ____D () C:\Users\Admin\Documents\CCleaner saves
2014-04-19 19:22 - 2012-12-15 17:14 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\CheckPoint
2014-04-19 19:22 - 2012-10-05 14:13 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\CheckPoint
2014-04-19 19:22 - 2012-10-05 08:50 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\CheckPoint
2014-04-19 13:57 - 2014-04-19 13:56 - 00015610 _____ () C:\Users\Roland\Documents\AboKündigung der Taz 19.April 2014.odt
2014-04-19 13:46 - 2013-11-23 02:23 - 00000000 ____D () C:\Users\Roland\AppData\Local\FRITZ!
2014-04-17 16:31 - 2012-10-05 14:39 - 00000761 _____ () C:\Users\Roland\AppData\Roaming\Network Meter_Settings.ini
2014-04-17 16:15 - 2014-04-17 12:45 - 00000000 ____D () C:\Users\Roland\Desktop\VLC-Songs
2014-04-17 00:36 - 2014-04-17 00:36 - 00000911 _____ () C:\Users\Roland\Desktop\DDMCache - Verknüpfung.lnk
2014-04-16 23:12 - 2012-11-12 21:28 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\Media Player Classic
2014-04-16 21:39 - 2014-04-16 21:16 - 00000000 ____D () C:\Users\Public\Trojanerbekaempfung
2014-04-16 21:34 - 2012-10-04 20:19 - 00006656 _____ () C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-16 21:12 - 2012-10-04 15:18 - 00061336 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-16 18:44 - 2012-12-04 03:18 - 00000000 ____D () C:\Program Files\WinRAR
2014-04-16 14:51 - 2013-02-21 15:27 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-04-16 13:46 - 2014-04-16 13:46 - 00000859 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-04-16 13:42 - 2014-04-16 13:42 - 00000000 ____D () C:\Windows\IrfanView
2014-04-16 13:11 - 2014-04-16 13:11 - 00000000 ____D () C:\Users\Admin\AppData\Local\Secunia PSI
2014-04-16 13:11 - 2014-04-16 13:11 - 00000000 ____D () C:\Program Files\Secunia
2014-04-16 12:56 - 2014-04-16 05:21 - 00000000 ____D () C:\Program Files\ABBYY FineReader 9.0 Sprint
2014-04-16 05:21 - 2014-04-16 05:21 - 00000000 ____D () C:\Program Files\Common Files\ABBYY
2014-04-16 04:59 - 2014-04-16 04:59 - 00000000 ____D () C:\Users\Roland\AppData\Local\ABBYY
2014-04-16 04:36 - 2012-10-05 09:48 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-04-16 04:36 - 2012-10-04 19:59 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-04-16 04:36 - 2012-10-04 19:59 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-04-16 03:58 - 2012-10-05 14:14 - 00061336 _____ () C:\Users\Roland\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-16 03:58 - 2006-11-02 14:47 - 00277416 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-16 03:47 - 2014-04-16 03:47 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\OpenOffice
2014-04-16 03:36 - 2009-06-23 12:45 - 00000000 ____D () C:\Programme-kleine
2014-04-16 03:25 - 2014-04-16 03:25 - 00001892 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-04-16 03:24 - 2014-04-16 03:24 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-04-16 03:24 - 2012-10-04 20:10 - 00000000 ____D () C:\Program Files\Adobe
2014-04-16 03:16 - 2012-10-08 09:03 - 00000000 ____D () C:\Users\Roland\AppData\Local\Adobe
2014-04-16 03:16 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-04-16 03:04 - 2014-04-16 03:04 - 00000000 ____D () C:\Windows\system32\Adobe
2014-04-16 03:03 - 2014-04-16 03:02 - 00000000 ____D () C:\Program Files\OpenOffice 4
2014-04-16 03:01 - 2012-10-05 10:31 - 00000000 ____D () C:\Program Files\OpenOffice.org 3
2014-04-16 02:53 - 2012-11-05 13:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\DivX
2014-04-16 02:53 - 2012-11-05 13:50 - 00000000 ____D () C:\Program Files\Common Files\DivX Shared
2014-04-16 02:53 - 2012-11-05 13:46 - 00000000 ____D () C:\Program Files\DivX
2014-04-16 02:47 - 2014-04-16 02:47 - 00000000 ____D () C:\Users\Admin\Desktop\OpenOffice 4.0.1 (de) Installation Files
2014-04-16 02:22 - 2012-10-09 11:54 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-16 02:14 - 2014-04-16 02:14 - 00000000 ____D () C:\Users\Roland\AppData\Roaming\KC Softwares
2014-04-16 02:02 - 2014-04-16 02:02 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-04-16 02:01 - 2014-04-16 02:02 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-16 02:01 - 2014-04-16 02:01 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-16 02:01 - 2014-04-16 02:01 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-16 02:01 - 2014-04-16 02:01 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-04-15 14:09 - 2012-10-07 18:52 - 00000000 ____D () C:\Windows\Minidump
2014-04-15 14:05 - 2014-04-15 14:05 - 00001688 _____ () C:\Users\Roland\Desktop\CCleaner.lnk
2014-04-11 20:21 - 2012-10-12 12:53 - 00000000 ____D () C:\Program Files\CDBurnerXP
2014-04-10 14:23 - 2014-04-10 14:23 - 01544704 _____ () C:\Windows\is-50C2L.exe
2014-04-10 14:23 - 2014-04-10 14:23 - 00025599 _____ () C:\Windows\is-50C2L.msg
2014-04-10 14:23 - 2014-04-10 14:23 - 00000293 _____ () C:\Windows\is-50C2L.lst
2014-04-09 15:30 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache
2014-04-09 15:11 - 2014-04-09 15:11 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-04-09 14:53 - 2006-11-02 12:23 - 00000240 _____ () C:\Windows\win.ini
2014-04-09 14:50 - 2013-07-12 12:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 14:47 - 2006-11-02 12:24 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

Files to move or delete:
====================
C:\Users\Gast\AppData\Roaming\Network Meter_Usage.ini
C:\Users\Roland\AppData\Roaming\Network Meter_Usage.ini
C:\Users\Roland\Network_Meter_Data.js


Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\1cc0ba34-df85-457a-8edc-2002d615e794.dll
C:\Users\Roland\AppData\Local\Temp\swt-win32-3347.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-08 19:44

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version:09-05-2014 01
Ran by Admin at 2014-05-09 18:15:20
Running from C:\Users\Roland\Downloads\aTrojaner board
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

7-Zip 9.15 beta (HKLM\...\7-Zip) (Version:  - )
ABBYY FineReader 9.0 Sprint (HKLM\...\ABBYY FineReader 9.0 Sprint) (Version: 9.00.15.58233 - ABBYY)
ABBYY FineReader 9.0 Sprint (Version: 9.00.15.58233 - ABBYY) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.)
Advanced Audio FX Engine (HKLM\...\Advanced Audio FX Engine) (Version:  - )
Advanced Video FX Engine (HKLM\...\Advanced Video FX Engine) (Version:  - )
AVM FRITZ!fax für FRITZ!Box (HKLM\...\FRITZ! 2.0) (Version:  - AVM Berlin)
Bitcoin Core (32-bit) (HKCU\...\Bitcoin Core (32-bit)) (Version: 0.9.1 - Bitcoin Core project)
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
Cisco EAP-FAST Module (HKLM\...\{BF53252E-4AB2-4C7F-A0FD-6100755745E3}) (Version: 2.0.26 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\...\{76F9CF97-FC4B-4E20-B363-D127C888448F}) (Version: 1.0.11 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\...\{4E5386F5-C0F6-4532-A54A-374865AEAB71}) (Version: 1.0.12 - Cisco Systems, Inc.)
Conexant HDA D330 MDC V.92 Modem (HKLM\...\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F) (Version:  - )
Dark Tales - Die Maske des Roten Todes von Edgar Allan Poe SA 1.00 (HKLM\...\Dark Tales - Die Maske des Roten Todes von Edgar Allan Poe SA 1.00) (Version: 1.00 - BigFish)
Dell Dock (HKLM\...\Dell Dock) (Version: 2.0 - Stardock Corporation)
Dell Dock (Version: 2.0 - Stardock Corporation) Hidden
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1.103.4 - Alps Electric)
Dell Wireless WLAN Karte (HKLM\...\Broadcom 802.11b Network Adapter) (Version: 4.170.25.12 - Dell Inc.)
DivX-Setup (HKLM\...\DivX Setup) (Version: 2.6.1.100 - DivX, LLC)
DVAG Online-System (HKLM\...\DVAG Online System) (Version: 1.3 - Deutsche Vermögensberatung AG)
Epson Event Manager (HKLM\...\{8ED43F7E-A8F6-4898-AF11-B6158F2EDF94}) (Version: 2.50.0000 - SEIKO EPSON CORPORATION)
EPSON SX230 Series Printer Uninstall (HKLM\...\EPSON SX230 Series) (Version:  - SEIKO EPSON Corporation)
ffdshow v1.2.4499 [2013-01-04] (HKLM\...\ffdshow_is1) (Version: 1.2.4499.0 - )
Free Audio Converter version 5.0.21.1212 (HKLM\...\Free Audio Converter_is1) (Version: 5.0.21.1212 - DVDVideoSoft Ltd.)
Gigaflat (HKLM\...\{C9E91711-8600-4919-AEF0-D4821F886797}_is1) (Version:  - Bitrockers Inc.)
GIMP 2.8.2 (HKLM\...\GIMP-2_is1) (Version: 2.8.2 - The GIMP Team)
Haali Media Splitter (HKLM\...\HaaliMkx) (Version:  - )
HP Officejet 6700 - Grundlegende Software für das Gerät (HKLM\...\{87B2E9C6-8AC1-43EF-9072-DB2EF0A49680}) (Version: 25.0.619.0 - Hewlett-Packard Co.)
HP Officejet 6700 Hilfe (HKLM\...\{50DA41E2-0701-43E2-A8BB-FAA0CB64B28B}) (Version: 140.0.2.2 - Hewlett Packard)
I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - )
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Laptop Integrated Webcam Driver (1.04.01.1011)   (HKLM\...\Creative OEM002) (Version:  - )
Lexware buchhalter 2013 (HKLM\...\{6AB4E5CD-0062-48E8-96A3-E5B4486DFCB3}) (Version: 18.00.00.0090 - Haufe-Lexware GmbH & Co.KG)
Lexware Elster (HKLM\...\{9F6BFB0F-6B1F-4D1A-A9DA-42F6794C9188}) (Version: 13.00.00.0027 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (HKLM\...\{85BF9FDB-BD5B-407C-9CAE-3542E5164783}) (Version: 4.00.00.0075 - Haufe-Lexware GmbH & Co.KG)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Marvell Miniport Driver (HKLM\...\{C950420B-4182-49EA-850A-A6A2ABF06C6B}) (Version: 10.22.6.3 - Marvell)
MFC RunTime files (Version: 1.0.0 - Extensoft) Hidden
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Modem-Diagnose-Tool (HKLM\...\{F63A3748-B93D-4360-9AD4-B064481A5C7B}) (Version: 1.0.20.0 - Dell)
Mozilla Firefox 29.0 (x86 de) (HKLM\...\Mozilla Firefox 29.0 (x86 de)) (Version: 29.0 - Mozilla)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nitro PDF Professional (HKLM\...\{853F9C53-2518-4AD0-ABA2-A72EDF4441A4}) (Version: 5.5.2.0 - Nitro PDF Software )
Nokia Connectivity Cable Driver (HKLM\...\{6882DD11-33B8-4DEA-8305-7E765BF74BD3}) (Version: 6.81.1.2 - Nokia)
Nokia Map Loader (HKLM\...\{45D4F727-43B5-49CD-B474-B9866A8F4FB8}) (Version: 3.0.22 - Nokia)
Nokia MTP driver (HKLM\...\{0E94871C-623C-464F-A117-B8474BFF84E1}) (Version: 1.0.6 - Nokia)
Nokia PC Suite (HKLM\...\{531317A5-586A-4E36-87C1-CA823447B375}) (Version: 6.81.13.0 - Nokia)
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Opera 12.02 (HKLM\...\Opera 12.02.1578) (Version: 12.02.1578 - Opera Software ASA)
Opera 12.17 (HKLM\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA)
PC Connectivity Solution (HKLM\...\{B7CB0BF3-791E-44D3-9F04-786E36D51C9D}) (Version: 9.13.1.0 - Nokia)
QuickSet (HKLM\...\{4B6AD248-D3BF-426A-8D64-847288154F13}) (Version: 8.2.20 - Dell Inc.)
QuickSteuer Deluxe 2013 (HKLM\...\{A733DC44-DC71-447D-AD6C-33B9AB537828}) (Version: 19.00.00.0034 - Haufe-Lexware GmbH & Co.KG)
QuickSteuer Deluxe 2014 (HKLM\...\{F0DDB61B-25D1-4159-8F10-7A5B83B86339}) (Version: 20.01.00.0005 - Haufe-Lexware GmbH & Co.KG)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.51.01 - )
Seagate Manager Installer (HKLM\...\InstallShield_{E6F019F1-DFB6-4853-A87D-6E31624755A9}) (Version: 2.02.0109 - Seagate)
Seagate Manager Installer (Version: 2.02.0109 - Seagate) Hidden
SigmaTel Audio (HKLM\...\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}) (Version: 5.10.5210.0 - SigmaTel)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TreeSize Free V2.4 (HKLM\...\TreeSize Free_is1) (Version: 2.4 - JAM Software)
Unlocker 1.9.1 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
VC 9.0 Runtime (Version: 1.0.0 - Check Point Software Technologies Ltd) Hidden
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
Virtual CD v9 (HKLM\...\{98A64C75-BFD6-4212-8746-8BADC7ABA79E}) (Version: 9.30.2 - H+H Software GmbH)
VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinRAR 5.10 beta 2 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.2 - win.rar GmbH)

==================== Restore Points  =========================

22-04-2014 15:35:06 Geplanter Prüfpunkt
23-04-2014 07:06:37 Geplanter Prüfpunkt
23-04-2014 15:12:56 Windows Update
24-04-2014 14:49:28 Geplanter Prüfpunkt
26-04-2014 23:41:56 Windows Update
27-04-2014 18:29:13 Geplanter Prüfpunkt
29-04-2014 09:20:16 Geplanter Prüfpunkt
30-04-2014 01:49:46 Geplanter Prüfpunkt
30-04-2014 20:51:23 Geplanter Prüfpunkt
01-05-2014 15:53:24 Windows Update
02-05-2014 11:54:06 Windows Update
03-05-2014 12:12:00 Geplanter Prüfpunkt
05-05-2014 19:44:42 Geplanter Prüfpunkt
06-05-2014 18:20:35 Windows Update
07-05-2014 16:26:08 Microsoft Antimalware Checkpoint
08-05-2014 06:05:07 Geplanter Prüfpunkt
08-05-2014 20:10:55 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2013-03-23 11:40 - 2013-03-23 11:43 - 00000775 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       www.akademische.de
127.0.0.1       akademische.de


==================== Scheduled Tasks (whitelisted) =============

Task: {08C477A9-C437-4196-B166-6286709D6348} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1E9C3DFA-B67A-406D-B823-F8D21D39BE24} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {4BB88860-BFB8-438F-9C08-F4324D00A93F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()

==================== Loaded Modules (whitelisted) =============

2012-10-04 15:22 - 2007-12-08 14:34 - 00024064 _____ () C:\Windows\System32\WLTRYSVC.EXE
2012-10-04 15:22 - 2007-12-08 14:34 - 00054784 _____ () C:\Windows\System32\bcmwlrmt.dll
2010-07-04 23:32 - 2010-07-04 23:32 - 00010752 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2014-04-16 03:15 - 2014-04-16 03:15 - 00284160 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\VistaBridgeLibrary\384c592b9d66064620ae8b02b8b0d538\VistaBridgeLibrary.ni.dll
2014-04-29 12:24 - 2014-04-22 11:25 - 03845232 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00835584 _____ () C:\Program Files\Opera\gstreamer\gstreamer.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00093696 _____ () C:\Program Files\Opera\gstreamer\plugins\gstaudioconvert.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00094208 _____ () C:\Program Files\Opera\gstreamer\plugins\gstaudioresample.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00057344 _____ () C:\Program Files\Opera\gstreamer\plugins\gstautodetect.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00096256 _____ () C:\Program Files\Opera\gstreamer\plugins\gstcoreplugins.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00062976 _____ () C:\Program Files\Opera\gstreamer\plugins\gstdecodebin2.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00067072 _____ () C:\Program Files\Opera\gstreamer\plugins\gstdirectsound.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00158208 _____ () C:\Program Files\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00312832 _____ () C:\Program Files\Opera\gstreamer\plugins\gstoggdec.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00038912 _____ () C:\Program Files\Opera\gstreamer\plugins\gstwaveform.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00073728 _____ () C:\Program Files\Opera\gstreamer\plugins\gstwavparse.dll
2012-10-08 09:24 - 2014-04-27 23:54 - 00101888 _____ () C:\Program Files\Opera\gstreamer\plugins\gstwebmdec.dll
2013-09-20 13:50 - 2013-09-20 13:50 - 00988160 _____ () C:\Program Files\OpenOffice 4\program\libxml2.dll
2013-09-17 04:54 - 2013-09-17 04:54 - 00170496 _____ () C:\Program Files\OpenOffice 4\program\libxslt.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk => C:\Windows\pss\QuickSet.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: DELL Webcam Manager => "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
MSCONFIG\startupreg: dellsupportcenter => "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
MSCONFIG\startupreg: DivXMediaServer => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: EEventManager => "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
MSCONFIG\startupreg: EPSON SX230 Series => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHKE.EXE /FU "C:\Users\Admin\AppData\Local\Temp\E_SDC98.tmp" /EF "HKCU"
MSCONFIG\startupreg: HP Officejet 6700 (NET) => "C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe" -deviceID "CN24B2H0KC05RQ:NW" -scfn "HP Officejet 6700 (NET)" -AutoStart 1
MSCONFIG\startupreg: LexwareInfoService => C:\Program Files\Lexware\Update Manager\LxUpdateManager.exe /autostart
MSCONFIG\startupreg: MaxMenuMgr => "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
MSCONFIG\startupreg: Nitro PDF Printer Monitor => "C:\Program Files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe"
MSCONFIG\startupreg: NSLauncher => C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
MSCONFIG\startupreg: OEM02Mon.exe => C:\Windows\OEM02Mon.exe
MSCONFIG\startupreg: SigmatelSysTrayApp => %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: VC9Player => C:\Program Files\Virtual CD v9\System\VC9Play.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/08/2014 08:14:06 PM) (Source: Perflib) (User: ) (EventID: 1008)
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (05/08/2014 08:14:05 PM) (Source: Perflib) (User: ) (EventID: 1010)
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (05/08/2014 07:37:02 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 08:12:34 PM) (Source: Perflib) (User: ) (EventID: 1008)
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (05/07/2014 08:12:34 PM) (Source: Perflib) (User: ) (EventID: 1010)
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (05/07/2014 06:26:03 PM) (Source: VSS) (User: ) (EventID: 8194)
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {9bfc93c9-3de7-4f1d-b8af-00a7b5d7e72b}

Error: (05/07/2014 06:15:01 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 04:32:35 AM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 04:22:23 AM) (Source: Perflib) (User: ) (EventID: 1008)
Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4

Error: (05/07/2014 04:22:22 AM) (Source: Perflib) (User: ) (EventID: 1008)
Description: MSDTCC:\Windows\system32\msdtcuiu.DLL4


System errors:
=============
Error: (05/09/2014 03:33:16 PM) (Source: ipnathlp) (User: ) (EventID: 30013)
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.38 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.

Error: (05/09/2014 11:48:23 AM) (Source: ipnathlp) (User: ) (EventID: 30013)
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.38 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.

Error: (05/09/2014 10:31:56 AM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: BCM42RLY%%2

Error: (05/09/2014 10:31:55 AM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: BCM42RLY%%2

Error: (05/09/2014 10:31:54 AM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: BCM42RLY%%2

Error: (05/09/2014 10:31:53 AM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: BCM42RLY%%2

Error: (05/09/2014 10:31:53 AM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: BCM42RLY%%2

Error: (05/09/2014 10:31:53 AM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: BCM42RLY%%2

Error: (05/09/2014 10:31:52 AM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: BCM42RLY%%2

Error: (05/09/2014 10:31:50 AM) (Source: Service Control Manager) (User: ) (EventID: 7000)
Description: BCM42RLY%%2


Microsoft Office Sessions:
=========================
Error: (05/08/2014 08:14:06 PM) (Source: Perflib) (User: ) (EventID: 1008)
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (05/08/2014 08:14:05 PM) (Source: Perflib) (User: ) (EventID: 1010)
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (05/08/2014 07:37:02 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 08:12:34 PM) (Source: Perflib) (User: ) (EventID: 1008)
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (05/07/2014 08:12:34 PM) (Source: Perflib) (User: ) (EventID: 1010)
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (05/07/2014 06:26:03 PM) (Source: VSS) (User: ) (EventID: 8194)
Description: 0x80070005

Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {9bfc93c9-3de7-4f1d-b8af-00a7b5d7e72b}

Error: (05/07/2014 06:15:01 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 04:32:35 AM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 04:22:23 AM) (Source: Perflib) (User: ) (EventID: 1008)
Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4

Error: (05/07/2014 04:22:22 AM) (Source: Perflib) (User: ) (EventID: 1008)
Description: MSDTCC:\Windows\system32\msdtcuiu.DLL4


CodeIntegrity Errors:
===================================
  Date: 2014-05-09 18:15:14.550
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-09 18:15:14.406
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-09 18:15:14.261
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-09 18:15:14.117
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-09 18:15:13.838
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-09 18:15:13.692
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-09 18:15:13.535
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-09 18:15:13.391
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-09 18:14:25.327
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-09 18:14:25.185
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 57%
Total physical RAM: 3573.12 MB
Available physical RAM: 1507.82 MB
Total Pagefile: 7363.98 MB
Available Pagefile: 5280.32 MB
Total Virtual: 2047.88 MB
Available Virtual: 1927.15 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:266.01 GB) (Free:8.52 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:30.03 GB) (Free:17.27 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 00000080)
Partition 1: (Not Active) - (Size=47 MB) - (Type=DE)
Partition 2: (Active) - (Size=266 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=32 GB) - (Type=OF Extended)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-09 15:30:00
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 WDC_WD3200BEVT-75ZCT2 rev.11.01A11 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Admin\AppData\Local\Temp\uxldypog.sys


---- Kernel code sections - GMER 2.1 ----

?               C:\Windows\system32\Drivers\PROCEXP152.SYS                                                                                                               Das System kann die angegebene Datei nicht finden. !

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Mozilla Firefox\firefox.exe[2808] ntdll.dll!LdrLoadDll                                                                                  77299378 5 Bytes  JMP 6DF71EB1 C:\Program Files\Mozilla Firefox\mozglue.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2808] kernel32.dll!HeapSetInformation + 26                                                                  76FFA9B8 7 Bytes  JMP 566576E2 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2808] kernel32.dll!LockResource + C                                                                         77016BD3 7 Bytes  JMP 56FDB58D C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2808] kernel32.dll!VirtualAllocEx + 54                                                                      7701B030 7 Bytes  JMP 56FDB5B0 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2808] GDI32.dll!SetStretchBltMode + 256                                                                     75B3745C 7 Bytes  JMP 56FDB50E C:\Program Files\Mozilla Firefox\xul.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                                 fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C8B3CB23B8A69885CB051C52AF9D6B6F@E7F34DE86F8A8984FA116B51F8E2FD49  C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\local\0413\Eppijres.dll
Reg             HKLM\SOFTWARE\Classes\Interface\{30510519-98B5-11CF-BB82-00AA00BDCE0B}\Prox"                                                                             
Reg             HKLM\SOFTWARE\Classes\Interface\{30510519-98B5-11CF-BB82-00AA00BDCE0B}\Prox"@                                                                            {00020424-0000-0000-C000-000000000046}

---- EOF - GMER 2.1 ----