Interpol Virus eingefangen

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-09-2013
Ran by SYSTEM on MININT-PMU968A on 01-09-2013 14:39:40
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [613024 2010-09-27] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2010-09-27] (Atheros Commnucations)
HKLM\...\Run: [MouseDriver] - C:\Windows\system32\TiltWheelMouse.exe [241152 2012-12-19] (Pixart Imaging Inc)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2439072 2010-05-24] (VIA)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-11] (Avira Operations GmbH & Co. KG)
HKU\User\...\Run: [Spotify Web Helper] - C:\Users\User\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-06] (Spotify Ltd)
HKU\User\...\Run: [Uxsiryedi] - C:\Users\User\AppData\Roaming\Fiuhe\eteps.exe [x]
HKU\User\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKU\User\...\Run: [Spotify] - C:\Users\User\AppData\Roaming\Spotify\Spotify.exe [4640768 2013-07-06] (Spotify Ltd)
HKU\User\...\Run: [LOLReplay Recorder] - "C:\Program Files (x86)\LOLReplay\LOLRecorder.exe" -minimize [x]
HKU\User\...\Run: [SSync] - C:\Users\User\AppData\Roaming\SSync\SSync.exe [36864 2013-04-09] ()
HKU\User\...\Run: [DataMgr] - C:\Users\User\AppData\Roaming\DataMgr\DataMgr.exe [168848 2013-06-26] (HTTO Group, Ltd.)
HKU\User\...\Run: [SCheck] - C:\Users\User\AppData\Roaming\SCheck\SCheck.exe [36864 2013-04-09] ()
HKU\User\...\Run: [Snoozer] - C:\Users\User\AppData\Roaming\Snz\Snz.exe [1137764 2013-08-28] ()
HKU\User\...\Run: [Intermediate] - C:\Users\User\AppData\Roaming\Intermediate\Intermediate.exe [36864 2013-04-09] ()
HKU\User\...\Run: [OMESupervisor] - C:\Users\User\AppData\Local\omesuperv.exe [2218359 2013-08-28] ()
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\evtmnxpgawjigepepiq.lnk
ShortcutTarget: evtmnxpgawjigepepiq.lnk -> C:\Users\User\AppData\Local\Temp\qipepegijwagpxnmtve.bfg ()

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-11] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-11] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-11] (Avira Operations GmbH & Co. KG)
S2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [5126616 2013-03-31] (INCA Internet Co., Ltd.)
S2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()

==================== Drivers (Whitelisted) ====================

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-08-11] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-08-11] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-11] (Avira Operations GmbH & Co. KG)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S1 prodrv06; C:\Windows\SysWow64\drivers\prodrv06.sys [52224 2004-01-26] (Protection Technology)
S0 prohlp02; C:\Windows\SysWow64\drivers\prohlp02.sys [95552 2004-01-26] (Protection Technology)
S0 prosync1; C:\Windows\SysWow64\drivers\prosync1.sys [6944 2003-09-06] (Protection Technology)
S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)
S0 sfhlp01; C:\Windows\SysWow64\drivers\sfhlp01.sys [4832 2003-12-01] (Protection Technology)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [868848 2013-02-05] (Duplex Secure Ltd.)
S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S3 t_mouse.sys; C:\Windows\System32\DRIVERS\t_mouse.sys [6144 2012-12-19] ()
S3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
S3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S1 prodrv06; \SystemRoot\System32\drivers\prodrv06.sys [x]
S0 prohlp02; System32\drivers\prohlp02.sys [x]
S0 prosync1; System32\drivers\prosync1.sys [x]
S0 sfhlp01; System32\drivers\sfhlp01.sys [x]
S3 sxuptp; system32\DRIVERS\sxuptp.sys [x]
S3 usbbus; system32\DRIVERS\lgx64bus.sys [x]
S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [x]
S3 USBModem; system32\DRIVERS\lgx64modem.sys [x]
S3 X6va008; \??\C:\Users\User\AppData\Local\Temp\00820AA.tmp [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-01 13:12 - 2013-09-01 13:12 - 00000165 _____ C:\ProgramData\evtmnxpgawjigepepiq.reg
2013-09-01 13:12 - 2013-09-01 13:12 - 00000070 _____ C:\ProgramData\evtmnxpgawjigepepiq.bat
2013-08-29 16:27 - 2013-08-29 16:27 - 00001087 _____ C:\Users\Public\Desktop\D-Fend Reloaded.lnk
2013-08-29 16:27 - 2013-08-29 16:27 - 00000000 ____D C:\Program Files (x86)\D-Fend Reloaded
2013-08-29 16:27 - 2005-08-26 22:36 - 00000000 ____D C:\Users\User\Desktop\Teenage Mutant Ninja Turtles 2
2013-08-28 19:46 - 2013-08-28 19:46 - 02218359 _____ C:\Users\User\AppData\Local\omesuperv.exe
2013-08-20 14:30 - 2013-08-20 14:30 - 02095104 _____ C:\Users\User\Downloads\QuakeLiveNP_520.msi
2013-08-19 12:22 - 2013-08-19 12:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-18 22:50 - 2013-08-18 22:50 - 00000000 ____D C:\Windows\{113016FE-E013-4FAF-85FB-8649DEED76B2}
2013-08-17 21:00 - 2013-08-19 11:01 - 00000000 ____D C:\Users\User\tipp10
2013-08-17 21:00 - 2013-08-17 21:00 - 00000991 _____ C:\Users\User\Desktop\TIPP10.lnk
2013-08-17 21:00 - 2013-08-17 21:00 - 00000991 _____ C:\Users\UpdatusUser\Desktop\TIPP10.lnk
2013-08-17 21:00 - 2013-08-17 21:00 - 00000000 ____D C:\Program Files (x86)\Tipp10
2013-08-16 21:07 - 2013-08-16 21:07 - 219482878 _____ C:\Windows\MEMORY.DMP
2013-08-16 16:35 - 2013-07-26 06:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-16 16:35 - 2013-07-26 06:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-16 16:35 - 2013-07-26 06:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-16 16:35 - 2013-07-26 06:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-16 16:35 - 2013-07-26 06:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-16 16:35 - 2013-07-26 06:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-16 16:35 - 2013-07-26 06:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-16 16:35 - 2013-07-26 06:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-16 16:35 - 2013-07-26 06:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-16 16:35 - 2013-07-26 06:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-16 16:35 - 2013-07-26 06:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-16 16:35 - 2013-07-26 06:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-16 16:35 - 2013-07-26 06:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-16 16:35 - 2013-07-26 06:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-16 16:35 - 2013-07-26 04:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-16 16:35 - 2013-07-26 04:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-16 16:35 - 2013-07-26 04:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-16 16:35 - 2013-07-26 04:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-16 16:35 - 2013-07-26 04:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-16 16:35 - 2013-07-26 04:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-16 16:35 - 2013-07-26 04:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-16 16:35 - 2013-07-26 04:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-16 16:35 - 2013-07-26 04:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-16 16:35 - 2013-07-26 04:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-16 16:35 - 2013-07-26 04:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-16 16:35 - 2013-07-26 04:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-16 16:35 - 2013-07-26 04:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-16 16:35 - 2013-07-26 04:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-16 16:35 - 2013-07-26 03:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-16 16:35 - 2013-07-26 03:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-16 16:35 - 2013-07-26 02:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-15 16:32 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-15 16:32 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-15 16:32 - 2013-07-19 02:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-15 16:32 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-15 16:32 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-15 16:32 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-15 16:32 - 2013-07-09 06:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-15 16:32 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-15 16:32 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-15 16:32 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-15 16:32 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-15 16:32 - 2013-07-09 05:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-15 16:32 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-15 16:32 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-15 16:31 - 2013-07-09 07:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-08-15 16:31 - 2013-07-09 06:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-08-15 16:31 - 2013-07-09 06:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2013-08-15 16:31 - 2013-07-09 06:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-15 16:31 - 2013-07-09 06:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-15 16:31 - 2013-07-09 05:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-15 16:31 - 2013-07-09 05:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-15 16:31 - 2013-07-09 03:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-15 16:31 - 2013-07-09 03:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-15 16:31 - 2013-07-09 03:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-15 16:31 - 2013-07-09 03:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-15 16:31 - 2013-07-06 07:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-15 16:31 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-13 18:46 - 2013-08-21 15:06 - 00001891 _____ C:\Users\User\Desktop\Neues Textdokument (3).txt
2013-08-11 17:03 - 2013-08-11 17:03 - 00000000 ____D C:\Users\User\AppData\Roaming\Avira
2013-08-11 16:58 - 2013-08-11 16:58 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2013-08-11 16:57 - 2013-08-11 16:57 - 00002002 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-11 16:57 - 2013-08-11 16:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-11 16:57 - 2013-08-11 16:45 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-08-11 16:57 - 2013-08-11 16:45 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-08-11 16:57 - 2013-08-11 16:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-08-10 19:48 - 2013-08-11 12:01 - 00000000 ____D C:\Program Files (x86)\Audition Online
2013-08-10 19:47 - 2013-08-10 19:50 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-08-10 19:47 - 2013-08-10 19:47 - 04953944 _____ (FLVMPlayer                                                  ) C:\Users\User\Downloads\FLVMPlayer.exe
2013-08-10 19:45 - 2013-08-10 19:45 - 00288704 _____ C:\Users\User\Downloads\Setup.exe
2013-08-10 17:48 - 2013-08-10 19:58 - 00000000 ____D C:\ProgramData\Solid State Networks
2013-08-10 17:48 - 2013-08-10 17:48 - 01230336 _____ (ProSiebenSat.1 Games) C:\Users\User\Downloads\audition-dlm.exe

==================== One Month Modified Files and Folders =======

2013-09-01 13:21 - 2011-05-07 00:46 - 01675214 _____ C:\Windows\WindowsUpdate.log
2013-09-01 13:21 - 2009-07-14 05:45 - 00024496 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-01 13:21 - 2009-07-14 05:45 - 00024496 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-01 13:19 - 2013-07-11 18:08 - 00000000 ____D C:\Users\User\AppData\Roaming\Intermediate
2013-09-01 13:19 - 2012-09-07 19:34 - 00000000 ____D C:\Users\User\AppData\Roaming\Spotify
2013-09-01 13:17 - 2012-07-11 14:45 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2013-09-01 13:16 - 2013-07-11 18:07 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-01 13:16 - 2011-06-25 21:53 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini
2013-09-01 13:15 - 2011-05-16 00:38 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-01 13:15 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-01 13:15 - 2009-07-14 05:51 - 00120177 _____ C:\Windows\setupact.log
2013-09-01 13:12 - 2013-09-01 13:12 - 00000165 _____ C:\ProgramData\evtmnxpgawjigepepiq.reg
2013-09-01 13:12 - 2013-09-01 13:12 - 00000070 _____ C:\ProgramData\evtmnxpgawjigepepiq.bat
2013-09-01 12:29 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-01 12:28 - 2010-11-21 04:47 - 00125622 _____ C:\Windows\PFRO.log
2013-08-29 23:57 - 2012-09-11 17:38 - 00000000 ____D C:\Users\User\AppData\Roaming\TS3Client
2013-08-29 23:24 - 2013-07-11 18:08 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-29 21:57 - 2012-07-08 13:19 - 00000000 ____D C:\Users\User\AppData\Local\PMB Files
2013-08-29 21:57 - 2012-07-08 13:19 - 00000000 ____D C:\ProgramData\PMB Files
2013-08-29 16:27 - 2013-08-29 16:27 - 00001087 _____ C:\Users\Public\Desktop\D-Fend Reloaded.lnk
2013-08-29 16:27 - 2013-08-29 16:27 - 00000000 ____D C:\Program Files (x86)\D-Fend Reloaded
2013-08-29 15:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\NDF
2013-08-28 19:46 - 2013-08-28 19:46 - 02218359 _____ C:\Users\User\AppData\Local\omesuperv.exe
2013-08-28 13:26 - 2012-09-02 23:04 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2013-08-27 22:08 - 2012-07-09 15:37 - 00000000 ____D C:\Users\User\AppData\Local\Microsoft Games
2013-08-26 23:35 - 2012-07-08 12:33 - 00000000 ____D C:\Users\User\AppData\Local\CrashDumps
2013-08-26 16:47 - 2012-09-07 19:34 - 00000000 ____D C:\Users\User\AppData\Local\Spotify
2013-08-22 14:37 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-08-21 15:06 - 2013-08-13 18:46 - 00001891 _____ C:\Users\User\Desktop\Neues Textdokument (3).txt
2013-08-20 19:33 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-08-20 14:30 - 2013-08-20 14:30 - 02095104 _____ C:\Users\User\Downloads\QuakeLiveNP_520.msi
2013-08-20 12:29 - 2012-07-08 13:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-19 12:22 - 2013-08-19 12:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-19 11:01 - 2013-08-17 21:00 - 00000000 ____D C:\Users\User\tipp10
2013-08-18 22:59 - 2010-11-21 07:50 - 00707994 _____ C:\Windows\System32\perfh007.dat
2013-08-18 22:59 - 2010-11-21 07:50 - 00153296 _____ C:\Windows\System32\perfc007.dat
2013-08-18 22:59 - 2009-07-14 06:13 - 01643660 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-18 22:50 - 2013-08-18 22:50 - 00000000 ____D C:\Windows\{113016FE-E013-4FAF-85FB-8649DEED76B2}
2013-08-18 22:50 - 2012-11-19 20:20 - 00000000 ____D C:\Program Files (x86)\Belkin
2013-08-18 22:50 - 2011-05-07 01:06 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-18 12:31 - 2012-07-11 11:55 - 00000528 _____ C:\Windows\RtlWlanInstall.log
2013-08-18 12:30 - 2012-07-11 11:56 - 00000000 ____D C:\Program Files (x86)\REALTEK PCIE Wireless LAN Driver
2013-08-18 12:29 - 2012-07-09 15:22 - 00045584 _____ C:\Windows\DPINST.LOG
2013-08-17 21:00 - 2013-08-17 21:00 - 00000991 _____ C:\Users\User\Desktop\TIPP10.lnk
2013-08-17 21:00 - 2013-08-17 21:00 - 00000991 _____ C:\Users\UpdatusUser\Desktop\TIPP10.lnk
2013-08-17 21:00 - 2013-08-17 21:00 - 00000000 ____D C:\Program Files (x86)\Tipp10
2013-08-16 21:07 - 2013-08-16 21:07 - 219482878 _____ C:\Windows\MEMORY.DMP
2013-08-16 16:29 - 2013-07-15 23:18 - 00000000 ____D C:\Windows\System32\MRT
2013-08-16 16:27 - 2012-07-08 11:02 - 78161360 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-08-15 16:15 - 2011-05-07 01:06 - 00000000 ____D C:\Program Files\CDBurnerXP
2013-08-14 18:42 - 2012-09-11 17:38 - 00000000 ____D C:\Users\User\AppData\Local\TeamSpeak 3 Client
2013-08-14 11:22 - 2011-05-07 01:06 - 00001750 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2013-08-11 17:03 - 2013-08-11 17:03 - 00000000 ____D C:\Users\User\AppData\Roaming\Avira
2013-08-11 16:58 - 2013-08-11 16:58 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2013-08-11 16:57 - 2013-08-11 16:57 - 00002002 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-11 16:57 - 2013-08-11 16:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-11 16:57 - 2012-07-08 10:53 - 00000000 ____D C:\ProgramData\Avira
2013-08-11 16:45 - 2013-08-11 16:57 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-08-11 16:45 - 2013-08-11 16:57 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-08-11 16:45 - 2013-08-11 16:57 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-08-11 12:01 - 2013-08-10 19:48 - 00000000 ____D C:\Program Files (x86)\Audition Online
2013-08-11 11:45 - 2013-07-06 20:18 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-11 11:45 - 2013-07-06 20:18 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-11 11:44 - 2012-10-21 16:14 - 00000000 ____D C:\Users\User\AppData\Local\Adobe
2013-08-10 19:58 - 2013-08-10 17:48 - 00000000 ____D C:\ProgramData\Solid State Networks
2013-08-10 19:50 - 2013-08-10 19:47 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-08-10 19:47 - 2013-08-10 19:47 - 04953944 _____ (FLVMPlayer                                                  ) C:\Users\User\Downloads\FLVMPlayer.exe
2013-08-10 19:45 - 2013-08-10 19:45 - 00288704 _____ C:\Users\User\Downloads\Setup.exe
2013-08-10 17:48 - 2013-08-10 17:48 - 01230336 _____ (ProSiebenSat.1 Games) C:\Users\User\Downloads\audition-dlm.exe
2013-08-10 14:15 - 2013-02-13 16:06 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-10 14:15 - 2012-07-11 14:45 - 00000000 ____D C:\ProgramData\Skype

Files to move or delete:
====================
C:\Users\User\AppData\Local\omesuperv.exe
C:\ProgramData\evtmnxpgawjigepepiq.bat
C:\ProgramData\evtmnxpgawjigepepiq.reg
C:\Users\hedev\AppData\Local\Temp\InstallSWTOR\Setup.exe
C:\Users\hedev\AppData\Local\Temp\InstallSWTOR\software\VisualCRT\vc2008redist_x86.exe
C:\Users\hedev\AppData\Local\Temp\InstallSWTOR\software\DirectX\DSETUP.dll
C:\Users\hedev\AppData\Local\Temp\InstallSWTOR\software\DirectX\dsetup32.dll
C:\Users\hedev\AppData\Local\Temp\InstallSWTOR\software\DirectX\DXSETUP.exe
C:\Users\hedev\AppData\Local\Temp\InstallSWTOR\data\Star Wars - The Old Republic Uninstaller.exe
C:\Users\User\AppData\Local\Temp\actual_remove.exe
C:\Users\User\AppData\Local\Temp\AskSLib.dll
C:\Users\User\AppData\Local\Temp\bundlesweetimsetup.exe
C:\Users\User\AppData\Local\Temp\DeltaTB.exe
C:\Users\User\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\User\AppData\Local\Temp\dxwebsetup.exe
C:\Users\User\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\User\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\User\AppData\Local\Temp\FreeMahjong.exe
C:\Users\User\AppData\Local\Temp\fx-runtime.exe
C:\Users\User\AppData\Local\Temp\GenericUninstall.exe
C:\Users\User\AppData\Local\Temp\i4jdel0.exe
C:\Users\User\AppData\Local\Temp\i4jdel1.exe
C:\Users\User\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih.exe
C:\Users\User\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih_1.exe
C:\Users\User\AppData\Local\Temp\iv_uninstall.exe
C:\Users\User\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\User\AppData\Local\Temp\mgsqlite3.dll
C:\Users\User\AppData\Local\Temp\qipepegijwagpxnmtve.bfg
C:\Users\User\AppData\Local\Temp\setup_fsu_cid.exe
C:\Users\User\AppData\Local\Temp\SIntf16.dll
C:\Users\User\AppData\Local\Temp\SIntf32.dll
C:\Users\User\AppData\Local\Temp\SIntfNT.dll
C:\Users\User\AppData\Local\Temp\SkypeSetup.exe
C:\Users\User\AppData\Local\Temp\SpotifyUpgrader.exe
C:\Users\User\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\User\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\User\AppData\Local\Temp\uninst1.exe
C:\Users\User\AppData\Local\Temp\Uninstall.exe
C:\Users\User\AppData\Local\Temp\uninstaller.exe
C:\Users\User\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\User\AppData\Local\Temp\WSSetup.exe
C:\Users\User\AppData\Local\Temp\zwsdj2fp.dll
C:\Users\User\AppData\Local\Temp\_is59F8.exe
C:\Users\User\AppData\Local\Temp\_isA843.exe
C:\Users\User\AppData\Local\Temp\_isE179.exe
C:\Users\User\AppData\Local\Temp\_isFAE3.exe
C:\Users\User\AppData\Local\Temp\~nsu.tmp\GameuxInstallHelper.dll
C:\Users\User\AppData\Local\Temp\{FF29CEBE-F0A9-4AA3-B8F2-65ACAA317CEA}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\InstallHelper.dll
C:\Users\User\AppData\Local\Temp\{FEEC3F63-99AA-4A03-BE57-E3266DF453E9}\ISSetup.dll
C:\Users\User\AppData\Local\Temp\{8F8CF2E4-A3F5-4FEC-8FB6-C8036212738B}\ISSetup.dll
C:\Users\User\AppData\Local\Temp\{8F8CF2E4-A3F5-4FEC-8FB6-C8036212738B}\_Setup.dll
C:\Users\User\AppData\Local\Temp\{8B7E883E-F164-4560-805C-918CA564176B}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\InstallHelper.dll
C:\Users\User\AppData\Local\Temp\{6E57F5E4-47A7-4656-B0EC-A55021C2384F}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\InstallHelper.dll
C:\Users\User\AppData\Local\Temp\{6375E3D5-52A4-4B6F-A523-53CF41AA6565}\dotnetinstaller.exe
C:\Users\User\AppData\Local\Temp\{6375E3D5-52A4-4B6F-A523-53CF41AA6565}\ISBEW64.exe
C:\Users\User\AppData\Local\Temp\{6375E3D5-52A4-4B6F-A523-53CF41AA6565}\{2A3A4BD6-6CE0-4e2a-80D2-1D0FF6ACBFBA}\isrt.dll
C:\Users\User\AppData\Local\Temp\{6375E3D5-52A4-4B6F-A523-53CF41AA6565}\{2A3A4BD6-6CE0-4e2a-80D2-1D0FF6ACBFBA}\_isuser_0x0407.dll
C:\Users\User\AppData\Local\Temp\{53B4C32B-5318-4CF6-9329-86CC2195424C}\ISSetup.dll
C:\Users\User\AppData\Local\Temp\{53B4C32B-5318-4CF6-9329-86CC2195424C}\_Setup.dll
C:\Users\User\AppData\Local\Temp\{2FC6C9CC-0249-413E-8A06-965F264D4A98}\dotnetinstaller.exe
C:\Users\User\AppData\Local\Temp\{2FC6C9CC-0249-413E-8A06-965F264D4A98}\ISBEW64.exe
C:\Users\User\AppData\Local\Temp\{2FC6C9CC-0249-413E-8A06-965F264D4A98}\{2A3A4BD6-6CE0-4e2a-80D2-1D0FF6ACBFBA}\isrt.dll
C:\Users\User\AppData\Local\Temp\{2FC6C9CC-0249-413E-8A06-965F264D4A98}\{2A3A4BD6-6CE0-4e2a-80D2-1D0FF6ACBFBA}\_isuser_0x0407.dll
C:\Users\User\AppData\Local\Temp\{2EF361A9-F97C-43C6-A23A-1906032754EF}\ISSetup.dll
C:\Users\User\AppData\Local\Temp\{2EF361A9-F97C-43C6-A23A-1906032754EF}\_Setup.dll
C:\Users\User\AppData\Local\Temp\{2BFA5D7D-1398-465C-BB83-EFA285A526DC}\{92606477-9366-4D3B-8AE3-6BE4B29727AB}\DSETUP.dll
C:\Users\User\AppData\Local\Temp\{2BFA5D7D-1398-465C-BB83-EFA285A526DC}\{92606477-9366-4D3B-8AE3-6BE4B29727AB}\dsetup32.dll
C:\Users\User\AppData\Local\Temp\{2BFA5D7D-1398-465C-BB83-EFA285A526DC}\{92606477-9366-4D3B-8AE3-6BE4B29727AB}\DXSETUP.exe
C:\Users\User\AppData\Local\Temp\{2757BD45-CCE4-4FF3-8282-2BFB46F919E8}\{28006915-2739-4EBE-B5E8-49B25D32EB33}\InstallHelper.dll
C:\Users\User\AppData\Local\Temp\{13632BCE-DE2F-4557-9BAA-89EA5DB98EB0}\ISBEW64.exe
C:\Users\User\AppData\Local\Temp\SDIAG_10e21fe4-555c-4e16-850e-7c640cee33be\DiagPackage.dll
C:\Users\User\AppData\Local\Temp\RarSFX0\Binaries\IExploreInstaller.exe
C:\Users\User\AppData\Local\Temp\nsvF8D1.tmp\sqlite3.dll
C:\Users\User\AppData\Local\Temp\nsvF8D1.tmp\uph.dll
C:\Users\User\AppData\Local\Temp\nsvF8D1.tmp\userid.dll
C:\Users\User\AppData\Local\Temp\nspD94F.tmp\uph.dll
C:\Users\User\AppData\Local\Temp\nskF622.tmp\uph.dll
C:\Users\User\AppData\Local\Temp\nsaDA2A.tmp\sqlite3.dll
C:\Users\User\AppData\Local\Temp\nsaDA2A.tmp\uph.dll
C:\Users\User\AppData\Local\Temp\nsaDA2A.tmp\userid.dll
C:\Users\User\AppData\Local\Temp\is-T9QUA.tmp\_isetup\_shfoldr.dll
C:\Users\User\AppData\Local\Temp\is-R61JI.tmp\ManifestUpdater.exe
C:\Users\User\AppData\Local\Temp\is-R61JI.tmp\_isetup\_shfoldr.dll
C:\Users\User\AppData\Local\Temp\is-GUJUU.tmp\Alcohol120_de_retail_5.5.7.6719.exe
C:\Users\User\AppData\Local\Temp\is-6UE8Q.tmp\gbinit.exe
C:\Users\User\AppData\Local\Temp\F\LGAutoRun.exe
C:\Users\User\AppData\Local\Temp\F\P5_LGPsLvDlChk.dll
C:\Users\User\AppData\Local\Temp\F\SendScsiCmd.dll
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\BabMaint.exe
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\BExternal.dll
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\BUSolution.dll
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\BUSUninstall.exe
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\ccp.exe
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\ChromeToolbarSetup.dll
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\CrxInstaller.dll
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\GUninstaller.exe
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\IEHelper.dll
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\MyBabylonTB.exe
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\Setup.exe
C:\Users\User\AppData\Local\Temp\648D31E1-BAB0-7891-A590-107B0E0B5F1B\Latest\sqlite3.dll
C:\Users\User\AppData\Local\Temp\1.tmp\F_IN_BOX.dll

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-08-16 16:25:42
Restore point made on: 2013-08-18 12:30:07
Restore point made on: 2013-08-18 16:59:35
Restore point made on: 2013-08-18 22:50:32
Restore point made on: 2013-08-20 14:30:46
Restore point made on: 2013-08-20 19:31:18
Restore point made on: 2013-08-25 16:59:24

==================== Memory info =========================== 

Percentage of memory in use: 10%
Total physical RAM: 7862.75 MB
Available physical RAM: 7017.74 MB
Total Pagefile: 7860.95 MB
Available Pagefile: 7013.68 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:698.54 GB) (Free:538.48 GB) NTFS
Drive g: () (Removable) (Total:0.98 GB) (Free:0.77 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 35C812CA)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 1002 MB) (Disk ID: 0046E0A7)
Partition 1: (Active) - (Size=1002 MB) - (Type=0B)


LastRegBack: 2013-09-01 13:00

==================== End Of Log ============================