Windows 7: Delta Search Virus

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:46 on 21/09/2013 (Toklar)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-09-2013
Ran by Toklar (administrator) on TOKLAR-PC on 21-09-2013 23:50:52
Running from C:\Users\Toklar\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Spotify Ltd) C:\Users\Toklar\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
() C:\Program Files (x86)\watchmi\TvdTray.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Spotify Ltd) C:\Users\Toklar\AppData\Roaming\Spotify\spotify.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12445288 2012-01-16] (Realtek Semiconductor)
HKLM\...\Run: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Toklar\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-06] (Spotify Ltd)
HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil64_11_2_202_235_ActiveX.exe -update activex [631456 2012-05-16] (Adobe Systems Incorporated)
MountPoints2: {b0cbcdb5-dfd5-11e1-a5d8-8c89a5dc2bd7} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\Setup.msi
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-02] (Intel Corporation)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.)
Startup: C:\Users\Toklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=MDNF&bmod=MDNF
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Winsock: Catalog5 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9 01 mswsock.dll File Not found ()
Winsock: Catalog9 02 mswsock.dll File Not found ()
Winsock: Catalog9 03 mswsock.dll File Not found ()
Winsock: Catalog9 04 mswsock.dll File Not found ()
Winsock: Catalog9 05 mswsock.dll File Not found ()
Winsock: Catalog9 06 mswsock.dll File Not found ()
Winsock: Catalog9 07 mswsock.dll File Not found ()
Winsock: Catalog9 08 mswsock.dll File Not found ()
Winsock: Catalog9 09 mswsock.dll File Not found ()
Winsock: Catalog9 10 mswsock.dll File Not found ()
Winsock: Catalog5-x64 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 05 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9-x64 01 mswsock.dll File Not found ()
Winsock: Catalog9-x64 02 mswsock.dll File Not found ()
Winsock: Catalog9-x64 03 mswsock.dll File Not found ()
Winsock: Catalog9-x64 04 mswsock.dll File Not found ()
Winsock: Catalog9-x64 05 mswsock.dll File Not found ()
Winsock: Catalog9-x64 06 mswsock.dll File Not found ()
Winsock: Catalog9-x64 07 mswsock.dll File Not found ()
Winsock: Catalog9-x64 08 mswsock.dll File Not found ()
Winsock: Catalog9-x64 09 mswsock.dll File Not found ()
Winsock: Catalog9-x64 10 mswsock.dll File Not found ()
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.60\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\gcswf32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\pdf.dll ()
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Toklar\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Toklar\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Toklar\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Intel Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U4) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.40.22) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (Facebook for Chrome) - C:\Users\Toklar\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdalhedleemkkdjddjgfjmcnbpejpapp\6.3.1_0
CHR Extension: (LyriXeeker-1) - C:\Users\Toklar\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgmpcnmaamenhngcinchjeifhhnlaig\1.24.10_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Toklar\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0

==================== Services (Whitelisted) =================

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-03-28] (Intel Corporation)
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
U2 *etadpug; "C:\Program Files (x86)\Google\Desktop\Install\{93832d05-75e6-fdfc-982d-8cf84e7110f2}\   \...\???\{93832d05-75e6-fdfc-982d-8cf84e7110f2}\GoogleUpdate.exe" < <==== ATTENTION (ZeroAccess)

==================== Drivers (Whitelisted) ====================

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-08-08] (DT Soft Ltd)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-21 23:50 - 2013-09-21 23:50 - 00000000 ____D C:\FRST
2013-09-21 23:46 - 2013-09-21 23:47 - 01956670 _____ (Farbar) C:\Users\Toklar\Downloads\FRST64.exe
2013-09-21 23:46 - 2013-09-21 23:46 - 00000544 _____ C:\Users\Toklar\Downloads\defogger_disable.log
2013-09-21 23:46 - 2013-09-21 23:46 - 00000168 _____ C:\Users\Toklar\defogger_reenable
2013-09-21 23:45 - 2013-09-21 23:45 - 00000000 ____D C:\Users\Toklar\Downloads\Neuer Ordner
2013-09-21 23:44 - 2013-09-21 23:44 - 00050477 _____ C:\Users\Toklar\Downloads\Defogger.exe
2013-09-21 19:22 - 2013-09-21 23:26 - 00000000 ____D C:\Users\Toklar\AppData\Roaming\MeldaProduction
2013-09-21 19:22 - 2013-09-21 19:22 - 00000000 ____D C:\ProgramData\MeldaProduction
2013-09-21 19:22 - 2013-09-21 19:22 - 00000000 ____D C:\Program Files\MeldaProduction
2013-09-20 20:32 - 2013-09-20 20:32 - 00459843 ____T C:\Users\Toklar\Desktop\Chiano - Maske.wav.asd
2013-09-20 20:31 - 2013-09-20 20:31 - 40567916 ____T C:\Users\Toklar\Desktop\Chicano - Maske (3).wav
2013-09-20 08:45 - 2013-09-20 08:45 - 00001787 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-09-20 08:45 - 2013-09-20 08:45 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-20 08:45 - 2013-09-20 08:45 - 00000000 ____D C:\Program Files\iTunes
2013-09-20 08:45 - 2013-09-20 08:45 - 00000000 ____D C:\Program Files\iPod
2013-09-20 08:45 - 2013-09-20 08:45 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-09-19 19:35 - 2013-09-19 19:35 - 31987244 ____T C:\Users\Toklar\Desktop\Chicano - Maske (2).wav
2013-09-19 17:28 - 2013-09-19 17:28 - 00000994 _____ C:\Users\Public\Desktop\Massive.lnk
2013-09-19 17:28 - 2013-09-19 17:28 - 00000000 __HDC C:\ProgramData\{E26B3878-7CEC-469C-B449-5CAA336DF8CD}
2013-09-17 20:09 - 2013-09-17 20:09 - 59768596 _____ C:\Users\Toklar\Desktop\Chumet - Es steht geschrieben.wav
2013-09-17 20:03 - 2013-09-17 20:03 - 00023715 _____ C:\Users\Toklar\Desktop\Chumet - Es steht geschrieben.mid
2013-09-15 17:22 - 2013-09-15 17:23 - 00000032 _____ C:\PS.log
2013-09-15 16:22 - 2013-09-15 21:03 - 00000000 ____D C:\AdwCleaner
2013-09-15 16:08 - 2013-09-15 16:12 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-09-15 16:07 - 2013-09-21 23:15 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-15 16:07 - 2013-09-21 23:15 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-15 16:07 - 2013-09-21 23:15 - 00001202 _____ C:\Windows\Tasks\LyriXeeker-1-codedownloader.job
2013-09-15 16:07 - 2013-09-21 23:15 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-15 16:07 - 2013-09-15 16:25 - 00000784 _____ C:\Users\Toklar\Desktop\Search.lnk
2013-09-15 16:07 - 2013-09-15 16:07 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-15 16:07 - 2013-09-15 16:07 - 00004232 _____ C:\Windows\System32\Tasks\LyriXeeker-1-codedownloader
2013-09-15 16:07 - 2013-09-15 16:07 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-15 16:07 - 2013-09-15 16:07 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-15 16:07 - 2013-09-15 16:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-15 16:07 - 2013-09-15 16:07 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-15 15:39 - 2013-09-15 15:40 - 103486447 _____ C:\Users\Toklar\Downloads\The Edgar Wasser Freetrack Collection Vol. 3.zip
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 __HDC C:\ProgramData\{C7E9FBB1-9CB7-4917-9D0E-7C333B122B2B}
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 __HDC C:\ProgramData\{BB5EBCFA-1B53-4EBA-A708-1AC15B03E2AB}
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 __HDC C:\ProgramData\{88FFB8E6-9C82-4D0A-8351-F2D3EAB81D35}
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 __HDC C:\ProgramData\{3F0C2AC3-0702-4760-AFC1-157546C32EC1}
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 ____D C:\Users\Public\Documents\Reaktor Spark R2
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 ____D C:\Users\Public\Documents\Reaktor Elements Selection
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 ____D C:\Users\Public\Documents\Guitar Rig 5 Elements MFXP
2013-09-15 11:27 - 2013-09-15 11:27 - 00000000 __HDC C:\ProgramData\{3FD630E4-094C-41D8-8276-77FA452C358F}
2013-09-15 11:22 - 2013-09-15 11:33 - 00000000 ____D C:\Users\Public\Documents\Kontakt Elements Selection R2 Library
2013-09-15 11:22 - 2013-09-15 11:22 - 00000000 __HDC C:\ProgramData\{86A4FE2A-247F-42EF-9C3E-C2551D2529B5}
2013-09-15 11:21 - 2013-09-15 11:33 - 00000000 ____D C:\Users\Public\Documents\Abbey Road 60s Drums Vintage Library
2013-09-15 11:21 - 2013-09-15 11:21 - 00000000 __HDC C:\ProgramData\{C1CF19B4-9194-417A-8B85-84F1471783CE}
2013-09-15 11:20 - 2013-09-15 11:20 - 00000000 __HDC C:\ProgramData\{13C5090D-8DAD-437E-B069-232C287DA432}
2013-09-15 11:18 - 2013-09-15 11:18 - 00000000 __HDC C:\ProgramData\{DD2792B0-5B90-4CC3-8D97-1C733D7FB366}
2013-09-15 11:15 - 2013-09-15 11:15 - 00001063 _____ C:\Users\Public\Desktop\Service Center.lnk
2013-09-15 11:15 - 2013-09-15 11:15 - 00000000 __HDC C:\ProgramData\{C78336EC-F2EB-4640-99A4-DFE96581B90B}
2013-09-12 18:52 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 18:52 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 18:52 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 18:52 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 18:52 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 18:52 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 18:52 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 18:52 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 18:52 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 18:52 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 18:52 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 18:52 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 18:52 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 18:52 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 18:52 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 18:52 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 18:52 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 18:52 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 18:52 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 18:52 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 18:52 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 16:20 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 16:20 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 16:20 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 16:20 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 16:20 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 16:20 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 16:20 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 16:20 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 16:20 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 16:20 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 16:20 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 16:20 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 16:20 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 16:20 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 16:20 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 16:20 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 16:20 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 16:20 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 16:20 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 16:20 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 16:20 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 16:20 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 16:20 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 16:20 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 16:20 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 16:20 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 16:20 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-06 22:40 - 2013-09-06 22:40 - 00245169 ____T C:\Users\Toklar\Desktop\Chicano - Mein letzter Herzschlag.wav.asd
2013-09-06 22:39 - 2013-09-07 17:43 - 31987244 ____T C:\Users\Toklar\Desktop\Chicano - Maske.wav
2013-09-05 01:02 - 2013-09-05 01:02 - 00000000 ____D C:\Users\Toklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ableton
2013-09-05 01:02 - 2013-09-05 01:02 - 00000000 ____D C:\Program Files (x86)\Pianissimo
2013-09-03 10:45 - 2013-09-06 22:40 - 21539416 ____T C:\Users\Toklar\Desktop\Chicano - Mein letzter Herzschlag.wav
2013-09-03 10:45 - 2013-09-03 10:45 - 00212169 ____T C:\Users\Toklar\Desktop\Chicano - Mein letzter Herzschlag (2).wav
2013-09-03 08:49 - 2013-09-03 08:49 - 00000000 ____D C:\Users\Toklar\Desktop\Tracks
2013-09-02 03:02 - 2013-09-12 18:52 - 00000000 ____D C:\Windows\system32\MRT
2013-09-01 11:32 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-01 11:31 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-01 11:31 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-09-01 11:31 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-01 11:31 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-09-01 11:31 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-01 11:31 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-01 11:31 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-01 11:31 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-01 11:31 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-09-01 11:31 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-09-01 11:31 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-09-01 11:31 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-09-01 11:31 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-09-01 11:31 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-01 11:31 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-21 23:50 - 2013-09-21 23:50 - 00000000 ____D C:\FRST
2013-09-21 23:47 - 2013-09-21 23:46 - 01956670 _____ (Farbar) C:\Users\Toklar\Downloads\FRST64.exe
2013-09-21 23:46 - 2013-09-21 23:46 - 00000544 _____ C:\Users\Toklar\Downloads\defogger_disable.log
2013-09-21 23:46 - 2013-09-21 23:46 - 00000168 _____ C:\Users\Toklar\defogger_reenable
2013-09-21 23:46 - 2012-08-04 14:19 - 00000000 ____D C:\Users\Toklar
2013-09-21 23:45 - 2013-09-21 23:45 - 00000000 ____D C:\Users\Toklar\Downloads\Neuer Ordner
2013-09-21 23:44 - 2013-09-21 23:44 - 00050477 _____ C:\Users\Toklar\Downloads\Defogger.exe
2013-09-21 23:44 - 2009-07-14 06:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-21 23:44 - 2009-07-14 06:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-21 23:26 - 2013-09-21 19:22 - 00000000 ____D C:\Users\Toklar\AppData\Roaming\MeldaProduction
2013-09-21 23:20 - 2011-05-16 16:04 - 00654602 _____ C:\Windows\system32\perfh007.dat
2013-09-21 23:20 - 2011-05-16 16:04 - 00130216 _____ C:\Windows\system32\perfc007.dat
2013-09-21 23:20 - 2009-07-14 07:13 - 01499930 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-21 23:17 - 2012-08-31 22:06 - 00000000 ____D C:\Users\Toklar\AppData\Roaming\Spotify
2013-09-21 23:15 - 2013-09-15 16:07 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-21 23:15 - 2013-09-15 16:07 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-21 23:15 - 2013-09-15 16:07 - 00001202 _____ C:\Windows\Tasks\LyriXeeker-1-codedownloader.job
2013-09-21 23:15 - 2013-09-15 16:07 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-21 23:15 - 2012-08-04 14:14 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-21 23:15 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-21 23:15 - 2009-07-14 06:51 - 00213132 _____ C:\Windows\setupact.log
2013-09-21 21:52 - 2012-08-04 14:14 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-21 19:28 - 2012-08-04 14:13 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-21 19:28 - 2012-08-04 14:12 - 01911044 _____ C:\Windows\WindowsUpdate.log
2013-09-21 19:27 - 2012-08-04 14:20 - 00000000 ____D C:\Users\Toklar\AppData\Local\Google
2013-09-21 19:22 - 2013-09-21 19:22 - 00000000 ____D C:\ProgramData\MeldaProduction
2013-09-21 19:22 - 2013-09-21 19:22 - 00000000 ____D C:\Program Files\MeldaProduction
2013-09-21 19:22 - 2013-08-03 19:33 - 00000000 ____D C:\Program Files\Common Files\VST3
2013-09-20 20:32 - 2013-09-20 20:32 - 00459843 ____T C:\Users\Toklar\Desktop\Chiano - Maske.wav.asd
2013-09-20 20:31 - 2013-09-20 20:31 - 40567916 ____T C:\Users\Toklar\Desktop\Chicano - Maske (3).wav
2013-09-20 08:45 - 2013-09-20 08:45 - 00001787 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-09-20 08:45 - 2013-09-20 08:45 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-20 08:45 - 2013-09-20 08:45 - 00000000 ____D C:\Program Files\iTunes
2013-09-20 08:45 - 2013-09-20 08:45 - 00000000 ____D C:\Program Files\iPod
2013-09-20 08:45 - 2013-09-20 08:45 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-09-19 19:35 - 2013-09-19 19:35 - 31987244 ____T C:\Users\Toklar\Desktop\Chicano - Maske (2).wav
2013-09-19 17:29 - 2013-07-07 11:41 - 00000000 ____D C:\Users\Toklar\Documents\Native Instruments
2013-09-19 17:29 - 2013-07-07 11:41 - 00000000 ____D C:\Users\Toklar\AppData\Local\Native Instruments
2013-09-19 17:28 - 2013-09-19 17:28 - 00000994 _____ C:\Users\Public\Desktop\Massive.lnk
2013-09-19 17:28 - 2013-09-19 17:28 - 00000000 __HDC C:\ProgramData\{E26B3878-7CEC-469C-B449-5CAA336DF8CD}
2013-09-19 17:28 - 2013-07-07 11:34 - 00000000 ____D C:\Program Files\Native Instruments
2013-09-19 17:27 - 2012-08-05 16:51 - 00000000 ____D C:\Users\Toklar\Documents\Salim
2013-09-17 20:09 - 2013-09-17 20:09 - 59768596 _____ C:\Users\Toklar\Desktop\Chumet - Es steht geschrieben.wav
2013-09-17 20:03 - 2013-09-17 20:03 - 00023715 _____ C:\Users\Toklar\Desktop\Chumet - Es steht geschrieben.mid
2013-09-15 21:03 - 2013-09-15 16:22 - 00000000 ____D C:\AdwCleaner
2013-09-15 20:30 - 2010-11-21 05:47 - 00046768 _____ C:\Windows\PFRO.log
2013-09-15 20:30 - 2009-07-14 06:45 - 00365760 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-15 17:39 - 2013-06-30 03:02 - 00000000 ____D C:\Program Files (x86)\Propellerhead
2013-09-15 17:38 - 2013-03-19 00:42 - 00000000 ____D C:\Users\Toklar\AppData\Local\PokerStars.EU
2013-09-15 17:38 - 2013-03-19 00:41 - 00000000 ____D C:\Program Files (x86)\PokerStars.NET
2013-09-15 17:34 - 2012-08-04 14:20 - 00090528 _____ C:\Users\Toklar\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-15 17:33 - 2011-04-12 10:28 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-09-15 17:32 - 2011-07-18 22:51 - 00000000 ____D C:\Program Files (x86)\Windows Live
2013-09-15 17:24 - 2011-07-18 23:23 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-15 17:23 - 2013-09-15 17:22 - 00000032 _____ C:\PS.log
2013-09-15 17:23 - 2012-05-16 20:00 - 00000000 ____D C:\Program Files (x86)\CyberLink
2013-09-15 17:20 - 2013-05-09 21:18 - 00000000 ____D C:\Users\Toklar\AppData\Roaming\Cyberlink
2013-09-15 17:20 - 2013-05-09 21:18 - 00000000 ____D C:\My Works
2013-09-15 16:25 - 2013-09-15 16:07 - 00000784 _____ C:\Users\Toklar\Desktop\Search.lnk
2013-09-15 16:12 - 2013-09-15 16:08 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-09-15 16:07 - 2013-09-15 16:07 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-15 16:07 - 2013-09-15 16:07 - 00004232 _____ C:\Windows\System32\Tasks\LyriXeeker-1-codedownloader
2013-09-15 16:07 - 2013-09-15 16:07 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-15 16:07 - 2013-09-15 16:07 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-15 16:07 - 2013-09-15 16:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-15 16:07 - 2013-09-15 16:07 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-15 15:40 - 2013-09-15 15:39 - 103486447 _____ C:\Users\Toklar\Downloads\The Edgar Wasser Freetrack Collection Vol. 3.zip
2013-09-15 11:33 - 2013-09-15 11:22 - 00000000 ____D C:\Users\Public\Documents\Kontakt Elements Selection R2 Library
2013-09-15 11:33 - 2013-09-15 11:21 - 00000000 ____D C:\Users\Public\Documents\Abbey Road 60s Drums Vintage Library
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 __HDC C:\ProgramData\{C7E9FBB1-9CB7-4917-9D0E-7C333B122B2B}
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 __HDC C:\ProgramData\{BB5EBCFA-1B53-4EBA-A708-1AC15B03E2AB}
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 __HDC C:\ProgramData\{88FFB8E6-9C82-4D0A-8351-F2D3EAB81D35}
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 __HDC C:\ProgramData\{3F0C2AC3-0702-4760-AFC1-157546C32EC1}
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 ____D C:\Users\Public\Documents\Reaktor Spark R2
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 ____D C:\Users\Public\Documents\Reaktor Elements Selection
2013-09-15 11:28 - 2013-09-15 11:28 - 00000000 ____D C:\Users\Public\Documents\Guitar Rig 5 Elements MFXP
2013-09-15 11:27 - 2013-09-15 11:27 - 00000000 __HDC C:\ProgramData\{3FD630E4-094C-41D8-8276-77FA452C358F}
2013-09-15 11:22 - 2013-09-15 11:22 - 00000000 __HDC C:\ProgramData\{86A4FE2A-247F-42EF-9C3E-C2551D2529B5}
2013-09-15 11:21 - 2013-09-15 11:21 - 00000000 __HDC C:\ProgramData\{C1CF19B4-9194-417A-8B85-84F1471783CE}
2013-09-15 11:20 - 2013-09-15 11:20 - 00000000 __HDC C:\ProgramData\{13C5090D-8DAD-437E-B069-232C287DA432}
2013-09-15 11:20 - 2013-07-07 11:34 - 00000000 ____D C:\Program Files\Common Files\Native Instruments
2013-09-15 11:18 - 2013-09-15 11:18 - 00000000 __HDC C:\ProgramData\{DD2792B0-5B90-4CC3-8D97-1C733D7FB366}
2013-09-15 11:15 - 2013-09-15 11:15 - 00001063 _____ C:\Users\Public\Desktop\Service Center.lnk
2013-09-15 11:15 - 2013-09-15 11:15 - 00000000 __HDC C:\ProgramData\{C78336EC-F2EB-4640-99A4-DFE96581B90B}
2013-09-15 11:15 - 2013-07-07 11:37 - 00000000 ____D C:\ProgramData\Native Instruments
2013-09-13 15:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-12 20:56 - 2012-08-04 14:19 - 00000000 ___RD C:\Users\Toklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 20:56 - 2012-08-04 14:19 - 00000000 ___RD C:\Users\Toklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 18:52 - 2013-09-02 03:02 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 18:52 - 2012-08-08 13:23 - 01526976 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-12 18:52 - 2012-08-08 13:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-12 18:50 - 2011-07-18 22:31 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 18:31 - 2012-08-31 22:06 - 00000000 ____D C:\Users\Toklar\AppData\Local\Spotify
2013-09-11 16:45 - 2012-08-18 10:11 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-09-07 17:43 - 2013-09-06 22:39 - 31987244 ____T C:\Users\Toklar\Desktop\Chicano - Maske.wav
2013-09-06 22:40 - 2013-09-06 22:40 - 00245169 ____T C:\Users\Toklar\Desktop\Chicano - Mein letzter Herzschlag.wav.asd
2013-09-06 22:40 - 2013-09-03 10:45 - 21539416 ____T C:\Users\Toklar\Desktop\Chicano - Mein letzter Herzschlag.wav
2013-09-05 22:49 - 2012-09-03 17:05 - 00000000 ____D C:\Users\Toklar\AppData\Roaming\vlc
2013-09-05 01:02 - 2013-09-05 01:02 - 00000000 ____D C:\Users\Toklar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ableton
2013-09-05 01:02 - 2013-09-05 01:02 - 00000000 ____D C:\Program Files (x86)\Pianissimo
2013-09-03 10:45 - 2013-09-03 10:45 - 00212169 ____T C:\Users\Toklar\Desktop\Chicano - Mein letzter Herzschlag (2).wav
2013-09-03 08:49 - 2013-09-03 08:49 - 00000000 ____D C:\Users\Toklar\Desktop\Tracks
2013-09-03 08:48 - 2013-06-09 12:13 - 00000000 ____D C:\Users\Toklar\Desktop\Videodreh Fast zu spät
2013-09-03 08:48 - 2012-11-21 02:08 - 00000000 ____D C:\Users\Toklar\Desktop\LICHTBLICK

ZeroAccess:
C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:
C:\Windows\assembly\GAC_64\Desktop.ini

Files to move or delete:
====================
ZeroAccess:
C:\Users\Toklar\AppData\Local\Google\Desktop\Install
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install


Some content of TEMP:
====================
C:\Users\Toklar\AppData\Local\Temp\DaxaKill.exe
C:\Users\Toklar\AppData\Local\Temp\FileSystemView.dll
C:\Users\Toklar\AppData\Local\Temp\fx-runtime.exe
C:\Users\Toklar\AppData\Local\Temp\ICReinstall_MusicConverterSetup.exe
C:\Users\Toklar\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Toklar\AppData\Local\Temp\PlaySound.dll
C:\Users\Toklar\AppData\Local\Temp\Quarantine.exe
C:\Users\Toklar\AppData\Local\Temp\SpotifyUpgrader.exe
C:\Users\Toklar\AppData\Local\Temp\uninst1.exe
C:\Users\Toklar\AppData\Local\Temp\_unps.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender


LastRegBack: 2013-09-21 01:42

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-09-2013
Ran by Toklar at 2013-09-21 23:51:34
Running from C:\Users\Toklar\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs ======================

Ableton Live 9 Suite (x32 Version: 9.0.0.0)
Adobe AIR (x32 Version: 3.2.0.2070)
Adobe Flash Player 11 ActiveX 64-bit (Version: 11.2.202.235)
Adobe Reader X (10.1.8) MUI (x32 Version: 10.1.8)
Apple Application Support (x32 Version: 2.3.6)
Apple Mobile Device Support (Version: 7.0.0.117)
Apple Software Update (x32 Version: 2.1.3.127)
ASIO4ALL (x32 Version: 2.10)
Asmedia ASM104x USB 3.0 Host Controller Driver (x32 Version: 1.12.9.0)
Bonjour (Version: 3.0.0.10)
D3DX10 (x32 Version: 15.4.2368.0902)
DAEMON Tools Lite (x32 Version: 4.45.4.0314)
Dropbox (HKCU Version: 2.0.22)
Effectrix (x32 Version: 1.0)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
Free YouTube to MP3 Converter version 3.11.33.1005 (x32 Version: 3.11.33.1005)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Google Chrome (x32 Version: 29.0.1547.76)
Google Update Helper (x32 Version: 1.3.21.153)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 8.0.10.1464)
Intel(R) Rapid Storage Technology (x32 Version: 11.1.0.1006)
Intel® Trusted Connect Service Client (Version: 1.23.943.1)
iTunes (Version: 11.1.0.126)
iZotope Ozone 4 (x32 Version: 4.00)
Java 7 Update 9 (x32 Version: 7.0.90)
Java Auto Updater (x32 Version: 2.1.9.0)
Java(TM) 7 Update 4 (64-bit) (Version: 7.0.40)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kirnu - Cream version 1.0 (Version: 1.0)
Live 8.2.2 (x32)
LyriXeeker-1 (x32 Version: 1.28.153.3)
Memeo Instant Backup (x32 Version: 4.60.0.7943)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft PowerPoint Viewer (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
Native Instruments Abbey Road 60s Drums Vintage (Version: 1.1.0.002)
Native Instruments Abbey Road 60s Drums Vintage (x32)
Native Instruments Guitar Rig 5 (Version: 5.0.0.2354)
Native Instruments Guitar Rig 5 (x32)
Native Instruments Guitar Rig Elements for Maschine (Version: 1.0.0.001)
Native Instruments Guitar Rig Elements for Maschine (x32)
Native Instruments Komplete Elements Mk2 (Version: 8.0.0.003)
Native Instruments Komplete Elements Mk2 (x32)
Native Instruments Kontakt 5 (Version: 5.0.0.5133)
Native Instruments Kontakt 5 (x32)
Native Instruments Kontakt Elements Selection R2 (Version: 1.1.0.003)
Native Instruments Kontakt Elements Selection R2 (x32)
Native Instruments Massive (Version: 1.3.0.2050)
Native Instruments Massive (x32)
Native Instruments Reaktor 5 (Version: 5.6.1.11150)
Native Instruments Reaktor 5 (x32)
Native Instruments Reaktor Elements Selection (Version: 1.1.0.003)
Native Instruments Reaktor Elements Selection (x32)
Native Instruments Reaktor Spark R2 (Version: 1.1.0.004)
Native Instruments Reaktor Spark R2 (x32)
Native Instruments Service Center (Version: 2.2.6.676)
Native Instruments Service Center (x32)
NVIDIA Control Panel 301.39 (Version: 301.39)
NVIDIA Graphics Driver 301.39 (Version: 301.39)
NVIDIA HD Audio Driver 1.3.16.0 (Version: 1.3.16.0)
NVIDIA Install Application (Version: 2.1002.75.420)
NVIDIA PhysX (x32 Version: 9.12.0507)
NVIDIA PhysX System Software 9.12.0507 (Version: 9.12.0507)
NVIDIA Update 1.8.15 (Version: 1.8.15)
NVIDIA Update Components (Version: 1.8.15)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
Pianissimo (x32)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
PokerStars.net (x32)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
QuickTime (x32 Version: 7.69.80.9)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6554)
Reason 5.0 (x32 Version: 5.0)
Spelling Dictionaries Support For Adobe Reader X (x32 Version: 10.0.0)
Spotify (HKCU Version: 0.9.1.57.ge7405149)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
VLC media player 2.0.3 (x32 Version: 2.0.3)
watchmi (x32 Version: 3.0.0)
WAV To MP3 V2 (x32)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3538.0513)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)

==================== Restore Points  =========================

15-09-2013 15:16:20 Konfiguriert PowerRecover
15-09-2013 15:17:49 Konfiguriert Power2Go
15-09-2013 15:21:53 Konfiguriert PowerStarter
15-09-2013 15:24:43 Removido Controlo ActiveX do Windows Live Mesh para Ligações Remotas
15-09-2013 15:25:06 Windows Live Mesh ActiveX control for remote connections wird entfernt
15-09-2013 15:25:34 Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz wird entfernt
15-09-2013 15:26:14 Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave wird entfernt
15-09-2013 15:26:50 Windows Live Mesh ActiveX Control for Remote Connections wird entfernt
15-09-2013 15:28:28 Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen wird entfernt
15-09-2013 15:28:41 Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych wird entfernt
15-09-2013 15:29:30 Windows Live Mesh ActiveX-objekt til fjernforbindelser wird entfernt
15-09-2013 15:29:54 Contrôle ActiveX Windows Live Mesh pour connexions à distance wird entfernt
15-09-2013 15:30:30 Uzak Bağlantılar İçin Windows Live Mesh ActiveX Denetimi wird entfernt
15-09-2013 15:31:14 Quitado Control ActiveX de Windows Live Mesh para conexiones remotas
15-09-2013 15:31:48 Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις wird entfernt
15-09-2013 15:32:20 Windows Live Mesh ActiveX Control for Remote Connections wird entfernt
15-09-2013 15:34:15 COMPUTERBILD Vorteil-Center wird entfernt
17-09-2013 11:53:49 Windows Update
20-09-2013 12:28:47 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {0E7C0266-7152-4469-BA78-3A70065C559C} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {24B20325-7EB3-463C-B7AD-1F96A171951E} - System32\Tasks\LyriXeeker-1-chromeinstaller => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-chromeinstaller.exe [2013-09-15] (Lyrics)
Task: {48A3BC25-149A-43D5-8DE5-E1E35A31194A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04] (Google Inc.)
Task: {48CCAC9A-C9C1-46D3-82A1-BC155111F7B4} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] ()
Task: {66700F3D-2ABE-4082-87B8-8D546CAE53C0} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {675A191F-A62D-4048-9168-1045925C704D} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {7DC7C829-F8ED-494D-95CE-810B4178B9C5} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1887110168-357798874-2338005250-1002 => C:\Windows\System32\portabledeviceapi.dll [2010-11-21] (Microsoft Corporation)
Task: {96C0826C-908D-449A-901D-DF3C2E8AA22E} - System32\Tasks\LyriXeeker-1-codedownloader => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-codedownloader.exe [2013-09-15] (Lyrics)
Task: {B2857D8F-7EFF-44E8-9D6A-904B0254A902} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-04] (Google Inc.)
Task: {D693F4D4-04D3-4D77-AD99-F47C0B9C1A5B} - System32\Tasks\LyriXeeker-1-enabler => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-enabler.exe [2013-09-15] (Lyrics)
Task: {D8804A90-A41F-49D4-886F-08297C5D691A} - \EPUpdater No Task File
Task: {D9B88649-99BE-4449-A049-79F5251C0E1B} - System32\Tasks\LyriXeeker-1-updater => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-updater.exe [2013-09-15] (Lyrics)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-chromeinstaller.exe
Task: C:\Windows\Tasks\LyriXeeker-1-codedownloader.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-codedownloader.exe
Task: C:\Windows\Tasks\LyriXeeker-1-enabler.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-enabler.exe
Task: C:\Windows\Tasks\LyriXeeker-1-updater.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-updater.exe

==================== Loaded Modules (whitelisted) =============

2013-05-25 02:36 - 2013-05-25 02:36 - 00164016 _____ (Dropbox, Inc.) C:\Users\Toklar\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00326144 _____ () C:\Windows\system32\MSWSOCK.dll
2012-01-31 11:24 - 2012-01-31 11:24 - 00004608 _____ () C:\Program Files (x86)\watchmi\de\TvdTray.resources.dll
2012-08-04 14:14 - 2012-08-04 14:14 - 00059904 _____ () C:\Windows\assembly\GAC_MSIL\Tvd.Remote\3.0.0.8__f722db7bec59a14b\Tvd.Remote.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00326144 _____ () C:\Windows\system32\mswsock.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00326144 _____ (Microsoft Corporation) \\.\globalroot\systemroot\system32\mswsock.dll
2012-08-10 17:51 - 2012-08-10 17:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2011-05-26 13:41 - 2011-05-26 13:41 - 00053024 _____ (Open Source Software community project) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\pthreadVC2.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-02 03:31 - 2013-09-02 03:31 - 00489472 _____ (Intel Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\591b99d5681c59ed6c5e9544d7def0ea\IAStorUtil.ni.dll
2013-07-11 16:24 - 2013-07-11 16:24 - 00014336 _____ (Intel Corp.) C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\45581138b36fd338c87813390775b65f\IAStorCommon.ni.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00232448 _____ (Microsoft Corporation) \\.\globalroot\systemroot\syswow64\mswsock.dll
2012-08-31 22:06 - 2013-07-06 23:24 - 24985600 _____ () C:\Users\Toklar\AppData\Roaming\Spotify\Data\libcef.dll
2012-08-31 22:06 - 2013-07-06 23:24 - 09964032 _____ (The ICU Project) C:\Users\Toklar\AppData\Roaming\Spotify\Data\icudt.dll
2012-05-16 19:37 - 2012-05-16 19:37 - 08778912 ____R (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_2_202_235.ocx
2010-11-21 05:24 - 2010-11-21 05:24 - 00232448 _____ (Microsoft Corporation) \\?\globalroot\systemroot\syswow64\mswsock.DLL
2013-05-25 02:36 - 2013-05-25 02:36 - 00130736 _____ (Dropbox, Inc.) C:\Users\Toklar\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
2013-09-20 14:54 - 2013-09-17 05:20 - 00709584 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\libglesv2.dll
2013-09-20 14:54 - 2013-09-17 05:20 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\libegl.dll
2013-09-20 14:54 - 2013-09-17 05:21 - 04053456 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\pdf.dll
2013-09-20 14:54 - 2013-09-17 05:21 - 00410576 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll
2013-09-20 14:54 - 2013-09-17 05:20 - 01604560 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\ffmpegsumo.dll
2013-09-20 14:54 - 2013-09-17 05:21 - 13611984 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) ======

AlternateDataStreams: C:\Users\Toklar\Desktop\Chumet Juca.mp4:com.dropbox.attributes
AlternateDataStreams: C:\Users\Toklar\Desktop\Neuer Beat ;) - 2.mp3:com.dropbox.attributes

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/21/2013 11:36:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.139, Zeitstempel: 0x4fa43c61
Name des fehlerhaften Moduls: NvUI.dll, Version: 8.17.13.139, Zeitstempel: 0x4fa42f55
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000198716
ID des fehlerhaften Prozesses: 0x970
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3

Error: (09/21/2013 11:15:35 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 09:06:57 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 07:39:31 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 05:57:22 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 02:09:41 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 11:40:32 AM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 09:05:04 AM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/20/2013 11:36:35 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.139, Zeitstempel: 0x4fa43c61
Name des fehlerhaften Moduls: NvUI.dll, Version: 8.17.13.139, Zeitstempel: 0x4fa42f55
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000198716
ID des fehlerhaften Prozesses: 0xcb0
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3

Error: (09/20/2013 11:33:11 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)


System errors:
=============
Error: (09/21/2013 11:15:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (09/21/2013 11:15:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (09/21/2013 11:15:19 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 
%%1060

Error: (09/21/2013 09:06:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (09/21/2013 09:06:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (09/21/2013 09:06:48 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 
%%1060

Error: (09/21/2013 07:39:21 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (09/21/2013 07:39:21 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (09/21/2013 07:39:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 
%%1060

Error: (09/20/2013 08:44:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (09/21/2013 11:36:57 PM) (Source: Application Error)(User: )
Description: nvtray.exe7.17.13.1394fa43c61NvUI.dll8.17.13.1394fa42f55c0000005000000000019871697001ceb70fb0bc8595C:\Program Files\NVIDIA Corporation\Display\nvtray.exeC:\Program Files\NVIDIA Corporation\Display\NvUI.dllf02dbd1a-2305-11e3-9b28-8c89a5dc2bd7

Error: (09/21/2013 11:15:35 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 09:06:57 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 07:39:31 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 05:57:22 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 02:09:41 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 11:40:32 AM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/21/2013 09:05:04 AM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/20/2013 11:36:35 PM) (Source: Application Error)(User: )
Description: nvtray.exe7.17.13.1394fa43c61NvUI.dll8.17.13.1394fa42f55c00000050000000000198716cb001ceb64909154925C:\Program Files\NVIDIA Corporation\Display\nvtray.exeC:\Program Files\NVIDIA Corporation\Display\NvUI.dllb8d84cdf-223c-11e3-b891-8c89a5dc2bd7

Error: (09/20/2013 11:33:11 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)


==================== Memory info =========================== 

Percentage of memory in use: 27%
Total physical RAM: 8158.91 MB
Available physical RAM: 5937.42 MB
Total Pagefile: 16316 MB
Available Pagefile: 13771.64 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:1811.92 GB) (Free:1573.24 GB) NTFS
Drive d: (Recover) (Fixed) (Total:50 GB) (Free:28.89 GB) NTFS
Drive g: (LIVE9SUITE90332) (CDROM) (Total:0.93 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 365FE8BA)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-253492199424) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-22 00:10:19
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST2000DL rev.CC45 1863,02GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Toklar\AppData\Local\Temp\uxriipod.sys


---- User code sections - GMER 2.1 ----

.text    C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                 0000000075a21465 2 bytes [A2, 75]
.text    C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                0000000075a214bb 2 bytes [A2, 75]
.text    ...                                                                                                                                                                                                                                                       * 2
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                      0000000075a21465 2 bytes [A2, 75]
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                     0000000075a214bb 2 bytes [A2, 75]
.text    ...                                                                                                                                                                                                                                                       * 2
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                      0000000075a21465 2 bytes [A2, 75]
.text    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                     0000000075a214bb 2 bytes [A2, 75]
.text    ...                                                                                                                                                                                                                                                       * 2
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                    0000000075a21465 2 bytes [A2, 75]
.text    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                   0000000075a214bb 2 bytes [A2, 75]
.text    ...                                                                                                                                                                                                                                                       * 2
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\syswow64\user32.dll!GetCursorPos                                                                                                                                                                         0000000075741218 5 bytes JMP 000000010025000a
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\syswow64\user32.dll!DialogBoxIndirectParamAorW                                                                                                                                                           000000007575ce54 5 bytes JMP 000000010026000a
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\syswow64\ole32.DLL!CoCreateInstance                                                                                                                                                                      00000000771c9d0b 5 bytes JMP 00000001001c000a
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\WINMM.dll!waveOutOpen                                                                                                                                                                           0000000072b4451e 5 bytes JMP 00000001001a000a
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\WINMM.dll!waveOutSetVolume                                                                                                                                                                      0000000072b6535f 5 bytes JMP 00000001001b000a
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35                                                                                                                                                                     00000000691611a8 2 bytes [16, 69]
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21                                                                                                                                                               00000000691613a8 2 bytes [16, 69]
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21                                                                                                                                                                   0000000069161422 2 bytes [16, 69]
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19                                                                                                                                                            0000000069161498 2 bytes [16, 69]
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                             0000000075a21465 2 bytes [A2, 75]
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                            0000000075a214bb 2 bytes [A2, 75]
.text    ...                                                                                                                                                                                                                                                       * 2
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 195                                                                                                                                                 00000000662f1b41 2 bytes [2F, 66]
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 362                                                                                                                                                 00000000662f1be8 2 bytes [2F, 66]
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 418                                                                                                                                                 00000000662f1c20 2 bytes [2F, 66]
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 596                                                                                                                                                 00000000662f1cd2 2 bytes [2F, 66]
.text    C:\Windows\SysWOW64\svchost.exe[5800] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 628                                                                                                                                                 00000000662f1cf2 2 bytes [2F, 66]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\services.exe [696:2124]                                                                                                                                                                                                               0000000000111de4
Thread   C:\Windows\system32\services.exe [696:3732]                                                                                                                                                                                                               0000000000151808
Thread   C:\Windows\system32\services.exe [696:3800]                                                                                                                                                                                                               0000000000cf49a0
Thread   C:\Windows\system32\services.exe [696:3804]                                                                                                                                                                                                               0000000000cf4410
Thread   C:\Windows\system32\services.exe [696:3808]                                                                                                                                                                                                               0000000000cf8ba0
Thread   C:\Windows\Explorer.EXE [1708:2576]                                                                                                                                                                                                                       0000000005e51de4
Thread   C:\Windows\SysWOW64\svchost.exe [5800:4936]                                                                                                                                                                                                               0000000066048f40
Thread   C:\Windows\SysWOW64\svchost.exe [5800:6060]                                                                                                                                                                                                               00000000660488a0
Thread   C:\Windows\SysWOW64\svchost.exe [5800:5632]                                                                                                                                                                                                               0000000066048870
---- Processes - GMER 2.1 ----

Library  \\.\globalroot\systemroot\syswow64\mswsock.dll (*** suspicious ***) @ C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [3304] (Microsoft Windows Sockets 2.0 Service Provider/Microsoft Corporation SIGNED)(2010-11-21 03:24:09)  0000000072550000
Library  \\.\globalroot\systemroot\system32\mswsock.dll (*** suspicious ***) @ C:\Program Files\Windows Media Player\wmpnetwk.exe [3692] (Microsoft Windows Sockets 2.0 Service Provider/Microsoft Corporation SIGNED)(2010-11-21 03:24:00)                        000007fefd0a0000
Library  \\.\globalroot\systemroot\system32\mswsock.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [2560] (Microsoft Windows Sockets 2.0 Service Provider/Microsoft Corporation SIGNED)(2010-11-21 03:24:00)                                           000007fefd0a0000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\services\                                                                                                                                                                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\@Parameters\0\x202e\x2764                                                                                                                                                                                          940
Reg      HKLM\SYSTEM\ControlSet002\services\ (not active ControlSet)                                                                                                                                                                                               
Reg      HKLM\SYSTEM\ControlSet002\services\@Parameters\0\x202e\x2764                                                                                                                                                                                              940

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                                                                                                     unknown MBR code

---- EOF - GMER 2.1 ----