Merkwürdiger Link bei Start von Chrome / Bundestrojaner

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:20 on 02/01/2014 (moonspell)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-01-2014 01
Ran by moonspell (administrator) on MOONSPELL-PC on 02-01-2014 13:22:05
Running from C:\Users\moonspell\Desktop
Windows 8.1 Pro (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIIVE.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIIVE.EXE
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Comvigo, Inc.) C:\Windows\SysWOW64\qimlsrv.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Comvigo, Inc.) C:\Windows\SysWOW64\dsrviml.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-04-11] (Realtek Semiconductor)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2013-12-20] (APN)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-06-10] (Intel Corporation)
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\System32\spool\drivers\x64\3\E_YATIIVE.EXE [283232 2012-10-05] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\System32\spool\drivers\x64\3\E_YATIIVE.EXE [283232 2012-10-05] (SEIKO EPSON CORPORATION)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://nmd.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://url24.info/?id=5221g9001s1254
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.hyrican.de
SearchScopes: HKLM - DefaultScope {D4C4B41F-8273-4681-A04B-45A45055C805} URL = hxxp://url24.info/?id=5221g9001s1254&q={searchTerms}
SearchScopes: HKLM - {D4C4B41F-8273-4681-A04B-45A45055C805} URL = hxxp://url24.info/?id=5221g9001s1254&q={searchTerms}
SearchScopes: HKCU - DefaultScope {D4C4B41F-8273-4681-A04B-45A45055C805} URL = hxxp://url24.info/?id=5221g9001s1254&q={searchTerms}
SearchScopes: HKCU - {48376332-983A-4B3A-A5A7-96D32A0CE8E6} URL = hxxp://ecosia.org/search?q={searchTerms}&addon=opsensearch-ie
SearchScopes: HKCU - {84EB3040-FC08-4227-AC14-85754D6EBAE1} URL = 
SearchScopes: HKCU - {D4C4B41F-8273-4681-A04B-45A45055C805} URL = hxxp://url24.info/?id=5221g9001s1254&q={searchTerms}
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: E-Web Print - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\EPSON Software\E-Web Print\ewps_tb.dll (SEIKO EPSON CORPORATION)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class - {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} - C:\Program Files (x86)\Perfect World Entertainment\Arc\plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - E-Web Print - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\EPSON Software\E-Web Print\ewps_tb.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\moonspell\AppData\Roaming\Mozilla\Firefox\Profiles\0n7wlc74.default
FF Homepage: hxxp://url24.info/?id=5221g9001s1254
FF Keyword.URL: hxxp://url24.info/?id=5221g9001s1254&q=
FF SearchEngineOrder.1: Websuche
FF SelectedSearchEngine: Websuche
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF SearchPlugin: C:\Users\moonspell\AppData\Roaming\Mozilla\Firefox\Profiles\0n7wlc74.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [e-webprint@epson.com] - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on
FF Extension: E-Web Print - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on

Chrome: 
=======
CHR RestoreOnStartup: "hxxp://url24.info/?id=5221g9001s1254"
CHR DefaultSearchKeyword: websuche
CHR DefaultSearchProvider: Websuche
CHR DefaultSearchURL: hxxp://url24.info/?id=5221g9001s1254&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\moonspell\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh\31.8_0
CHR Extension: (ProxTube) - C:\Users\moonspell\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.7_0
CHR Extension: (Google Docs) - C:\Users\moonspell\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\moonspell\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\moonspell\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Ecosia - The search engine that plants trees) - C:\Users\moonspell\AppData\Local\Google\Chrome\User Data\Default\Extensions\clellnciejhoedgepbdilbkdkaoecgpc\1.0.5_0
CHR Extension: (Google Search) - C:\Users\moonspell\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Google Wallet) - C:\Users\moonspell\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0
CHR Extension: (Gmail) - C:\Users\moonspell\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)
S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88424 2013-10-10] (Perfect World Entertainment Inc)
R2 EpsonScanSvc; C:\windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 MSMQ; C:\Windows\system32\mqsvc.exe [25600 2013-11-13] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [96184 2013-12-09] (Overwolf)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2013-11-13] (Microsoft Corporation)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [546304 2013-11-13] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-18] (Avira Operations GmbH & Co. KG)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [24496 2011-12-19] (Intel Corporation)
S3 iaStorS; C:\Windows\system32\drivers\iaStorS.sys [637360 2011-12-19] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
S3 kbldfltr; C:\Windows\System32\drivers\kbldfltr.sys [22272 2013-09-30] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MQAC; C:\Windows\System32\drivers\mqac.sys [173568 2013-11-13] (Microsoft Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S3 PciIsaSerial; C:\Windows\system32\drivers\PciIsaSerial.sys [68608 2008-12-19] (Windows (R) Codename Longhorn DDK provider)
S3 PciPPorts; C:\Windows\system32\drivers\PciPPorts.sys [96768 2009-07-23] ()
S3 PciSPorts; C:\Windows\system32\drivers\PciSPorts.sys [122880 2008-12-19] ()
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation                           )
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-13] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
U3 idsvc; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-02 13:22 - 2014-01-02 13:22 - 00018724 _____ C:\Users\moonspell\Desktop\FRST.txt
2014-01-02 13:21 - 2014-01-02 13:21 - 01931426 _____ (Farbar) C:\Users\moonspell\Downloads\FRST64.exe
2014-01-02 13:21 - 2014-01-02 13:21 - 01931426 _____ (Farbar) C:\Users\moonspell\Desktop\FRST64.exe
2014-01-02 13:21 - 2014-01-02 13:21 - 00000000 ____D C:\FRST
2014-01-02 13:20 - 2014-01-02 13:20 - 00000480 _____ C:\Users\moonspell\Desktop\defogger_disable.log
2014-01-02 13:20 - 2014-01-02 13:19 - 00050477 _____ C:\Users\moonspell\Desktop\Defogger.exe
2014-01-02 13:19 - 2014-01-02 13:20 - 00000480 _____ C:\Users\moonspell\Downloads\defogger_disable.log
2014-01-02 13:19 - 2014-01-02 13:19 - 00050477 _____ C:\Users\moonspell\Downloads\Defogger.exe
2014-01-02 13:19 - 2014-01-02 13:19 - 00000252 _____ C:\Users\moonspell\Downloads\defogger_enable.log
2014-01-02 13:19 - 2014-01-02 13:19 - 00000000 _____ C:\Users\moonspell\defogger_reenable
2014-01-02 00:14 - 2014-01-02 00:14 - 00000000 ____D C:\Users\moonspell\AppData\Local\{374582E2-50DD-4A30-817C-E36D0550AAD2}
2014-01-01 21:01 - 2014-01-01 21:01 - 00001089 _____ C:\Users\Public\Desktop\VLC media player.lnk
2014-01-01 21:01 - 2014-01-01 21:01 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2014-01-01 20:56 - 2014-01-01 20:58 - 24987272 _____ C:\Users\moonspell\Downloads\vlc-2.1.2-win32.exe
2014-01-01 11:35 - 2014-01-01 11:35 - 00000000 ____D C:\Users\moonspell\AppData\Local\{583D3A01-05D8-4370-9E00-E7200B8136DA}
2013-12-31 14:14 - 2013-12-31 14:15 - 00000000 ____D C:\Users\moonspell\AppData\Local\{64E3A106-3F10-4450-B245-B032CF10E5A8}
2013-12-30 18:03 - 2013-12-30 18:03 - 00000000 ____D C:\Users\moonspell\AppData\Local\{24E9E46D-51ED-4681-B6BD-A194A70378CD}
2013-12-29 11:20 - 2013-12-29 11:20 - 00000000 ____D C:\Users\moonspell\AppData\Local\{4AF7139B-5136-4F4C-8748-7309AFA69FAF}
2013-12-28 10:05 - 2013-12-28 10:06 - 00000000 ____D C:\Users\moonspell\AppData\Local\{B4D0A00F-0CB1-4037-A1C1-41653FB16755}
2013-12-27 14:52 - 2013-12-27 14:52 - 00000000 ____D C:\Users\moonspell\AppData\Local\{B999F8B2-0446-4615-BA6C-6BB842C97514}
2013-12-26 14:06 - 2013-12-26 14:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-26 11:06 - 2013-12-26 11:06 - 00000000 ____D C:\Users\moonspell\AppData\Local\{BD208872-EBB9-4CA3-980C-7ED56598D80B}
2013-12-25 22:43 - 2013-12-25 22:43 - 00000000 ____D C:\Users\moonspell\AppData\Local\{A75DBECB-1713-4B0F-A3C6-9AAF3B2F700C}
2013-12-25 10:43 - 2013-12-25 10:43 - 00000000 ____D C:\Users\moonspell\AppData\Local\{59024AB9-F815-451E-A577-CFD15CDDAFDD}
2013-12-24 09:22 - 2013-12-24 09:22 - 00000000 ____D C:\Users\moonspell\AppData\Local\{4B9F2A7E-2960-4CAE-83D0-C93273EF175E}
2013-12-23 17:54 - 2013-12-23 17:54 - 00000000 ____D C:\Users\moonspell\AppData\Local\{AD74BED9-1CCD-4051-9050-E05A1639324D}
2013-12-22 13:42 - 2013-12-22 13:42 - 00000000 ____D C:\Users\moonspell\AppData\Local\{F5CFFDF6-C4B4-41C8-9299-7A8644B6025A}
2013-12-22 01:42 - 2013-12-22 01:42 - 00000000 ____D C:\Users\moonspell\AppData\Local\{DABAFA3C-0380-41FA-9119-E3F70453E264}
2013-12-21 11:43 - 2013-12-21 11:43 - 00000000 ____D C:\Users\moonspell\AppData\Local\{D3F9523C-DF83-4932-8808-155AEF862C8B}
2013-12-20 15:12 - 2013-12-20 15:12 - 00000000 ____D C:\Users\moonspell\AppData\Local\{8502E91F-8FA6-4088-85E4-FAC03F1E904D}
2013-12-19 18:09 - 2013-12-19 18:09 - 00000000 ____D C:\Users\moonspell\AppData\Local\{FB5F7D1E-9A6A-46F8-B730-71E243906948}
2013-12-18 20:12 - 2013-12-18 20:12 - 00000000 ____D C:\Users\moonspell\AppData\Local\{52C83AA0-702F-4909-BCA9-DBDD90DC672D}
2013-12-17 19:06 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys
2013-12-17 19:06 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2013-12-17 19:01 - 2013-12-17 19:01 - 00000000 ____D C:\Users\moonspell\AppData\Local\{412D8B2D-999E-483A-951B-406F02D13297}
2013-12-16 17:46 - 2013-12-16 17:46 - 00000000 ____D C:\Users\moonspell\AppData\Local\{38457060-CEC9-4D5E-B686-B06DD3B4AEE9}
2013-12-15 10:39 - 2013-12-15 10:39 - 00000000 ____D C:\Users\moonspell\AppData\Local\{F74EBF12-2C69-43D4-94F6-947FE3D208B0}
2013-12-14 21:34 - 2013-12-14 21:34 - 00000000 ____D C:\Users\moonspell\AppData\Local\{7C7A98DD-413D-4300-99F6-425B8043C9A6}
2013-12-14 18:34 - 2013-11-12 00:41 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2013-12-14 18:34 - 2013-11-12 00:40 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2013-12-14 18:34 - 2013-11-12 00:27 - 00701440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2013-12-14 18:34 - 2013-11-12 00:24 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2013-12-14 18:34 - 2013-11-11 03:48 - 00039768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2013-12-14 18:34 - 2013-11-09 12:55 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2013-12-14 18:34 - 2013-11-09 07:37 - 01756160 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe
2013-12-14 18:34 - 2013-11-09 06:56 - 01391104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe
2013-12-14 18:34 - 2013-11-08 11:26 - 00358896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2013-12-14 18:34 - 2013-11-08 06:23 - 00449024 _____ (Microsoft Corporation) C:\WINDOWS\system32\appmgr.dll
2013-12-14 18:34 - 2013-11-08 05:43 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2013-12-14 18:34 - 2013-11-08 05:42 - 00366080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appmgr.dll
2013-12-14 18:34 - 2013-11-08 05:28 - 13177344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2013-12-14 18:34 - 2013-11-08 05:26 - 11674624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2013-12-14 18:34 - 2013-11-08 05:16 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2013-12-14 18:34 - 2013-11-08 05:15 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2013-12-14 18:34 - 2013-11-08 05:07 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2013-12-14 18:34 - 2013-11-08 04:41 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2013-12-14 18:34 - 2013-11-08 04:14 - 00922624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2013-12-14 18:34 - 2013-11-05 15:19 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2013-12-14 18:34 - 2013-11-05 15:03 - 00637952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2013-12-14 18:34 - 2013-11-05 14:57 - 00479744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2013-12-14 18:34 - 2013-11-05 14:33 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2013-12-14 18:34 - 2013-11-05 14:32 - 00744448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2013-12-14 18:34 - 2013-11-04 18:13 - 01530200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2013-12-14 18:34 - 2013-11-04 18:13 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2013-12-14 18:34 - 2013-11-04 14:07 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2013-12-14 18:34 - 2013-11-04 12:50 - 02143744 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2013-12-14 18:34 - 2013-11-04 11:32 - 02570240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2013-12-14 18:34 - 2013-11-04 03:28 - 01816576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll
2013-12-14 18:34 - 2013-11-04 02:30 - 01765376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2013-12-14 18:34 - 2013-11-01 12:39 - 00086872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2013-12-14 18:34 - 2013-11-01 07:08 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidcli.dll
2013-12-14 18:34 - 2013-11-01 06:57 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcli.dll
2013-12-14 18:34 - 2013-10-31 01:58 - 00372568 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2013-12-14 18:34 - 2013-10-31 01:42 - 07399256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2013-12-14 18:34 - 2013-10-31 01:33 - 01642016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2013-12-14 18:34 - 2013-10-31 01:33 - 01506680 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2013-12-14 18:34 - 2013-10-31 01:33 - 01476184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2013-12-14 18:34 - 2013-10-31 01:33 - 01345536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2013-12-14 18:34 - 2013-10-26 02:54 - 00146776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\SerCx2.sys
2013-12-14 18:34 - 2013-10-24 10:31 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll
2013-12-14 18:34 - 2013-10-24 10:12 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll
2013-12-14 18:34 - 2013-10-17 12:21 - 02896896 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2013-12-14 18:34 - 2013-10-17 11:36 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2013-12-14 18:34 - 2013-10-05 15:21 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2013-12-14 18:34 - 2013-10-05 15:21 - 00516496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2013-12-14 18:34 - 2013-10-05 13:05 - 01765384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2013-12-14 18:34 - 2013-10-05 13:05 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2013-12-14 09:34 - 2013-12-14 09:34 - 00000000 ____D C:\Users\moonspell\AppData\Local\{0AD84699-3919-471D-B629-17BD36899103}
2013-12-13 15:41 - 2013-12-13 15:41 - 00000000 ____D C:\Users\moonspell\AppData\Local\{68E8DAD4-4922-4DEE-B357-3FD4D5EF561C}
2013-12-12 21:08 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-12-12 21:08 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2013-12-12 21:08 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-12-12 21:08 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2013-12-12 21:08 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2013-12-12 21:08 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2013-12-12 21:08 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2013-12-12 21:08 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2013-12-12 21:08 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-12-12 21:08 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2013-12-12 21:08 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2013-12-12 21:08 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2013-12-12 21:08 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2013-12-12 21:08 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2013-12-12 21:08 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2013-12-12 21:08 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2013-12-12 21:08 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2013-12-12 21:08 - 2013-11-23 05:34 - 00393216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
2013-12-12 21:08 - 2013-11-23 05:13 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
2013-12-12 21:08 - 2013-11-23 04:32 - 04105728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2013-12-12 21:08 - 2013-11-23 04:10 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2013-12-12 21:08 - 2013-11-09 07:34 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2013-12-12 21:08 - 2013-11-09 07:34 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2013-12-12 21:08 - 2013-11-09 06:52 - 00240128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2013-12-12 21:08 - 2013-11-08 08:21 - 04191744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2013-12-12 21:08 - 2013-10-19 09:53 - 00075360 _____ (Microsoft Corporation) C:\WINDOWS\system32\imagehlp.dll
2013-12-12 21:08 - 2013-10-19 08:14 - 00070680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imagehlp.dll
2013-12-12 21:08 - 2013-10-15 09:54 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2013-12-12 21:08 - 2013-10-15 09:03 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll
2013-12-12 20:05 - 2013-12-12 20:05 - 00000000 ____D C:\Users\moonspell\AppData\Local\{C03BB3C0-621A-4D99-AA91-5C9D72200A5B}
2013-12-11 21:09 - 2013-12-11 21:09 - 00000000 ____D C:\Users\moonspell\AppData\Local\{6E21FED0-CB73-4053-8CD2-F227D6E8DF1F}
2013-12-10 11:42 - 2013-12-10 11:43 - 00000000 ____D C:\Users\moonspell\AppData\Local\{338CF125-7444-45F4-9A08-30483A7BBF62}
2013-12-09 17:41 - 2013-12-09 17:42 - 00000000 ____D C:\Users\moonspell\AppData\Local\{560F83A4-5EFF-48FD-AFF0-20AB84049C57}
2013-12-08 13:11 - 2013-12-24 13:59 - 00148480 ___SH C:\Users\moonspell\Downloads\Thumbs.db
2013-12-08 12:35 - 2013-12-08 12:35 - 00000000 ____D C:\Users\moonspell\AppData\Local\{2C4DCE37-2C98-4D62-ABE3-63D18F5430D1}
2013-12-07 23:03 - 2013-12-07 23:03 - 00000000 ____D C:\Users\moonspell\AppData\Local\{7D933708-2FD4-4DF7-86AF-5186E04EA132}
2013-12-07 11:02 - 2013-12-07 11:02 - 00000000 ____D C:\Users\moonspell\AppData\Local\{76CE8D02-FB42-41C0-A75E-624CA34B10F3}
2013-12-06 17:01 - 2013-12-06 17:01 - 00000000 ____D C:\Users\moonspell\AppData\Local\{73F5461E-39E0-4A2E-B23D-88E8B6B3ED6B}
2013-12-05 16:55 - 2013-12-05 16:55 - 00000460 __RSH C:\ProgramData\ntuser.pol
2013-12-05 12:44 - 2013-12-05 12:44 - 00000000 ____D C:\Users\moonspell\AppData\Local\Chromium
2013-12-05 12:43 - 2013-12-05 12:43 - 00000000 ____D C:\Users\moonspell\AppData\Local\The Lord of the Rings Online
2013-12-05 12:42 - 2013-12-05 12:42 - 00000000 ____D C:\Users\moonspell\AppData\Local\Turbine
2013-12-05 12:41 - 2013-12-05 12:44 - 00000000 ____D C:\Users\moonspell\Documents\The Lord of the Rings Online
2013-12-05 12:41 - 2013-12-05 12:41 - 00001971 _____ C:\Users\moonspell\Desktop\Der Herr der Ringe Online™.lnk
2013-12-05 12:33 - 2014-01-01 21:26 - 00000000 ____D C:\ProgramData\HappyCloud
2013-12-05 12:33 - 2013-12-05 12:33 - 00000000 ____D C:\Users\moonspell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Turbine
2013-12-05 12:33 - 2013-12-05 12:33 - 00000000 ____D C:\Users\moonspell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2013-12-05 12:33 - 2013-12-05 12:33 - 00000000 ____D C:\ProgramData\Turbine
2013-12-05 12:32 - 2013-12-05 12:32 - 05287304 _____ C:\Users\moonspell\Downloads\LOTROProgressive_de_3.41.exe
2013-12-05 12:31 - 2013-12-05 12:31 - 00000000 ____D C:\ProgramData\ClassicShell
2013-12-05 12:08 - 2013-12-05 12:08 - 00000000 ____D C:\Users\moonspell\AppData\Local\{1734F677-2EB6-47B1-BB91-33A5D8882C0A}
2013-12-04 11:51 - 2013-12-04 11:51 - 00000000 ____D C:\Users\moonspell\AppData\Local\{F5060116-51FF-4E6B-9EA9-59FD06C35689}
2013-12-03 18:38 - 2013-12-03 18:38 - 00000000 ____D C:\Users\moonspell\AppData\Local\{AC3E77A0-D9E0-4BD5-9C94-F2254C8F4120}

==================== One Month Modified Files and Folders =======

2014-01-02 13:22 - 2014-01-02 13:22 - 00018724 _____ C:\Users\moonspell\Desktop\FRST.txt
2014-01-02 13:21 - 2014-01-02 13:21 - 01931426 _____ (Farbar) C:\Users\moonspell\Downloads\FRST64.exe
2014-01-02 13:21 - 2014-01-02 13:21 - 01931426 _____ (Farbar) C:\Users\moonspell\Desktop\FRST64.exe
2014-01-02 13:21 - 2014-01-02 13:21 - 00000000 ____D C:\FRST
2014-01-02 13:20 - 2014-01-02 13:20 - 00000480 _____ C:\Users\moonspell\Desktop\defogger_disable.log
2014-01-02 13:20 - 2014-01-02 13:19 - 00000480 _____ C:\Users\moonspell\Downloads\defogger_disable.log
2014-01-02 13:20 - 2013-08-09 11:15 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-01-02 13:19 - 2014-01-02 13:20 - 00050477 _____ C:\Users\moonspell\Desktop\Defogger.exe
2014-01-02 13:19 - 2014-01-02 13:19 - 00050477 _____ C:\Users\moonspell\Downloads\Defogger.exe
2014-01-02 13:19 - 2014-01-02 13:19 - 00000252 _____ C:\Users\moonspell\Downloads\defogger_enable.log
2014-01-02 13:19 - 2014-01-02 13:19 - 00000000 _____ C:\Users\moonspell\defogger_reenable
2014-01-02 13:19 - 2013-11-13 18:19 - 00000000 ____D C:\Users\moonspell
2014-01-02 13:18 - 2013-11-13 15:13 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-390645384-1554936560-3143771478-1002
2014-01-02 13:15 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\FxsTmp
2014-01-02 13:13 - 2013-11-13 19:10 - 00000000 __RDO C:\Users\moonspell\SkyDrive
2014-01-02 13:13 - 2013-10-31 19:10 - 00002202 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-02 13:13 - 2013-10-31 19:09 - 00001112 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-02 13:00 - 2013-11-13 18:15 - 02007455 _____ C:\WINDOWS\WindowsUpdate.log
2014-01-02 13:00 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\sru
2014-01-02 00:14 - 2014-01-02 00:14 - 00000000 ____D C:\Users\moonspell\AppData\Local\{374582E2-50DD-4A30-817C-E36D0550AAD2}
2014-01-01 21:38 - 2013-11-13 19:51 - 00000000 ____D C:\Users\moonspell\AppData\Roaming\ClassicShell
2014-01-01 21:37 - 2013-10-31 19:09 - 00001116 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-01 21:26 - 2013-12-05 12:33 - 00000000 ____D C:\ProgramData\HappyCloud
2014-01-01 21:01 - 2014-01-01 21:01 - 00001089 _____ C:\Users\Public\Desktop\VLC media player.lnk
2014-01-01 21:01 - 2014-01-01 21:01 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2014-01-01 20:58 - 2014-01-01 20:56 - 24987272 _____ C:\Users\moonspell\Downloads\vlc-2.1.2-win32.exe
2014-01-01 20:52 - 2013-09-30 05:14 - 02063984 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2014-01-01 20:52 - 2013-09-30 04:56 - 00876824 _____ C:\WINDOWS\system32\perfh007.dat
2014-01-01 20:52 - 2013-09-30 04:56 - 00200914 _____ C:\WINDOWS\system32\perfc007.dat
2014-01-01 20:49 - 2013-10-31 21:31 - 00000000 ____D C:\Users\moonspell\AppData\Roaming\UseNeXT
2014-01-01 20:48 - 2013-10-31 21:31 - 00000000 ____D C:\Users\moonspell\Documents\UseNeXT
2014-01-01 18:54 - 2013-11-14 10:49 - 00003962 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{227708E2-C152-4B71-9127-EA36036FA76E}
2014-01-01 17:14 - 2013-11-13 18:16 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-01 17:14 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2014-01-01 17:14 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2014-01-01 11:35 - 2014-01-01 11:35 - 00000000 ____D C:\Users\moonspell\AppData\Local\{583D3A01-05D8-4370-9E00-E7200B8136DA}
2013-12-31 17:12 - 2013-11-06 19:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-31 14:15 - 2013-12-31 14:14 - 00000000 ____D C:\Users\moonspell\AppData\Local\{64E3A106-3F10-4450-B245-B032CF10E5A8}
2013-12-30 18:03 - 2013-12-30 18:03 - 00000000 ____D C:\Users\moonspell\AppData\Local\{24E9E46D-51ED-4681-B6BD-A194A70378CD}
2013-12-29 11:20 - 2013-12-29 11:20 - 00000000 ____D C:\Users\moonspell\AppData\Local\{4AF7139B-5136-4F4C-8748-7309AFA69FAF}
2013-12-28 12:04 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2013-12-28 10:06 - 2013-12-28 10:05 - 00000000 ____D C:\Users\moonspell\AppData\Local\{B4D0A00F-0CB1-4037-A1C1-41653FB16755}
2013-12-28 10:01 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2013-12-27 14:52 - 2013-12-27 14:52 - 00000000 ____D C:\Users\moonspell\AppData\Local\{B999F8B2-0446-4615-BA6C-6BB842C97514}
2013-12-26 19:15 - 2013-11-08 21:33 - 00000000 ____D C:\Users\moonspell\AppData\Roaming\TS3Client
2013-12-26 14:06 - 2013-12-26 14:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-26 11:06 - 2013-12-26 11:06 - 00000000 ____D C:\Users\moonspell\AppData\Local\{BD208872-EBB9-4CA3-980C-7ED56598D80B}
2013-12-25 22:43 - 2013-12-25 22:43 - 00000000 ____D C:\Users\moonspell\AppData\Local\{A75DBECB-1713-4B0F-A3C6-9AAF3B2F700C}
2013-12-25 10:43 - 2013-12-25 10:43 - 00000000 ____D C:\Users\moonspell\AppData\Local\{59024AB9-F815-451E-A577-CFD15CDDAFDD}
2013-12-24 13:59 - 2013-12-08 13:11 - 00148480 ___SH C:\Users\moonspell\Downloads\Thumbs.db
2013-12-24 09:22 - 2013-12-24 09:22 - 00000000 ____D C:\Users\moonspell\AppData\Local\{4B9F2A7E-2960-4CAE-83D0-C93273EF175E}
2013-12-23 17:54 - 2013-12-23 17:54 - 00000000 ____D C:\Users\moonspell\AppData\Local\{AD74BED9-1CCD-4051-9050-E05A1639324D}
2013-12-22 13:42 - 2013-12-22 13:42 - 00000000 ____D C:\Users\moonspell\AppData\Local\{F5CFFDF6-C4B4-41C8-9299-7A8644B6025A}
2013-12-22 01:42 - 2013-12-22 01:42 - 00000000 ____D C:\Users\moonspell\AppData\Local\{DABAFA3C-0380-41FA-9119-E3F70453E264}
2013-12-21 11:43 - 2013-12-21 11:43 - 00000000 ____D C:\Users\moonspell\AppData\Local\{D3F9523C-DF83-4932-8808-155AEF862C8B}
2013-12-20 15:12 - 2013-12-20 15:12 - 00000000 ____D C:\Users\moonspell\AppData\Local\{8502E91F-8FA6-4088-85E4-FAC03F1E904D}
2013-12-19 18:13 - 2013-10-31 19:20 - 00000000 ____D C:\Users\moonspell\Downloads\Neverwinter_en
2013-12-19 18:09 - 2013-12-19 18:09 - 00000000 ____D C:\Users\moonspell\AppData\Local\{FB5F7D1E-9A6A-46F8-B730-71E243906948}
2013-12-18 20:13 - 2013-10-31 20:43 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-12-18 20:13 - 2013-10-31 20:43 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2013-12-18 20:13 - 2013-10-31 20:43 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys
2013-12-18 20:12 - 2013-12-18 20:12 - 00000000 ____D C:\Users\moonspell\AppData\Local\{52C83AA0-702F-4909-BCA9-DBDD90DC672D}
2013-12-17 19:06 - 2013-08-22 15:46 - 00348920 _____ C:\WINDOWS\setupact.log
2013-12-17 19:01 - 2013-12-17 19:01 - 00000000 ____D C:\Users\moonspell\AppData\Local\{412D8B2D-999E-483A-951B-406F02D13297}
2013-12-16 17:46 - 2013-12-16 17:46 - 00000000 ____D C:\Users\moonspell\AppData\Local\{38457060-CEC9-4D5E-B686-B06DD3B4AEE9}
2013-12-16 17:44 - 2013-08-09 12:15 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-12-16 17:43 - 2013-08-09 12:03 - 90708896 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-12-16 14:31 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache
2013-12-16 14:13 - 2013-08-22 16:36 - 00000000 ___RD C:\WINDOWS\ToastData
2013-12-16 14:13 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\WinStore
2013-12-16 14:13 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\MediaViewer
2013-12-16 14:13 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\FileManager
2013-12-16 14:13 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\Camera
2013-12-15 19:18 - 2013-11-12 23:36 - 00000000 ____D C:\Program Files (x86)\RIFT
2013-12-15 10:39 - 2013-12-15 10:39 - 00000000 ____D C:\Users\moonspell\AppData\Local\{F74EBF12-2C69-43D4-94F6-947FE3D208B0}
2013-12-14 21:34 - 2013-12-14 21:34 - 00000000 ____D C:\Users\moonspell\AppData\Local\{7C7A98DD-413D-4300-99F6-425B8043C9A6}
2013-12-14 14:27 - 2013-08-22 15:44 - 00362720 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-12-14 09:34 - 2013-12-14 09:34 - 00000000 ____D C:\Users\moonspell\AppData\Local\{0AD84699-3919-471D-B629-17BD36899103}
2013-12-13 15:41 - 2013-12-13 15:41 - 00000000 ____D C:\Users\moonspell\AppData\Local\{68E8DAD4-4922-4DEE-B357-3FD4D5EF561C}
2013-12-12 20:06 - 2013-11-08 21:29 - 00000000 ____D C:\Users\moonspell\AppData\Local\Overwolf
2013-12-12 20:05 - 2013-12-12 20:05 - 00000000 ____D C:\Users\moonspell\AppData\Local\{C03BB3C0-621A-4D99-AA91-5C9D72200A5B}
2013-12-12 20:05 - 2013-11-08 21:31 - 00000000 ____D C:\Program Files (x86)\Overwolf
2013-12-11 21:09 - 2013-12-11 21:09 - 00000000 ____D C:\Users\moonspell\AppData\Local\{6E21FED0-CB73-4053-8CD2-F227D6E8DF1F}
2013-12-10 20:20 - 2013-08-09 11:15 - 00003796 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2013-12-10 11:43 - 2013-12-10 11:42 - 00000000 ____D C:\Users\moonspell\AppData\Local\{338CF125-7444-45F4-9A08-30483A7BBF62}
2013-12-10 03:13 - 2013-10-31 21:28 - 01100248 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2013-12-10 03:13 - 2013-10-31 21:28 - 00982232 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2013-12-09 17:42 - 2013-12-09 17:41 - 00000000 ____D C:\Users\moonspell\AppData\Local\{560F83A4-5EFF-48FD-AFF0-20AB84049C57}
2013-12-08 12:35 - 2013-12-08 12:35 - 00000000 ____D C:\Users\moonspell\AppData\Local\{2C4DCE37-2C98-4D62-ABE3-63D18F5430D1}
2013-12-07 23:03 - 2013-12-07 23:03 - 00000000 ____D C:\Users\moonspell\AppData\Local\{7D933708-2FD4-4DF7-86AF-5186E04EA132}
2013-12-07 11:02 - 2013-12-07 11:02 - 00000000 ____D C:\Users\moonspell\AppData\Local\{76CE8D02-FB42-41C0-A75E-624CA34B10F3}
2013-12-06 17:01 - 2013-12-06 17:01 - 00000000 ____D C:\Users\moonspell\AppData\Local\{73F5461E-39E0-4A2E-B23D-88E8B6B3ED6B}
2013-12-05 16:55 - 2013-12-05 16:55 - 00000460 __RSH C:\ProgramData\ntuser.pol
2013-12-05 16:54 - 2013-09-29 20:04 - 00062432 _____ C:\WINDOWS\PFRO.log
2013-12-05 12:44 - 2013-12-05 12:44 - 00000000 ____D C:\Users\moonspell\AppData\Local\Chromium
2013-12-05 12:44 - 2013-12-05 12:41 - 00000000 ____D C:\Users\moonspell\Documents\The Lord of the Rings Online
2013-12-05 12:43 - 2013-12-05 12:43 - 00000000 ____D C:\Users\moonspell\AppData\Local\The Lord of the Rings Online
2013-12-05 12:42 - 2013-12-05 12:42 - 00000000 ____D C:\Users\moonspell\AppData\Local\Turbine
2013-12-05 12:41 - 2013-12-05 12:41 - 00001971 _____ C:\Users\moonspell\Desktop\Der Herr der Ringe Online™.lnk
2013-12-05 12:33 - 2013-12-05 12:33 - 00000000 ____D C:\Users\moonspell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Turbine
2013-12-05 12:33 - 2013-12-05 12:33 - 00000000 ____D C:\Users\moonspell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2013-12-05 12:33 - 2013-12-05 12:33 - 00000000 ____D C:\ProgramData\Turbine
2013-12-05 12:32 - 2013-12-05 12:32 - 05287304 _____ C:\Users\moonspell\Downloads\LOTROProgressive_de_3.41.exe
2013-12-05 12:31 - 2013-12-05 12:31 - 00000000 ____D C:\ProgramData\ClassicShell
2013-12-05 12:08 - 2013-12-05 12:08 - 00000000 ____D C:\Users\moonspell\AppData\Local\{1734F677-2EB6-47B1-BB91-33A5D8882C0A}
2013-12-05 09:42 - 2013-12-17 19:06 - 00039200 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys
2013-12-05 09:42 - 2013-12-17 19:06 - 00032544 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2013-12-05 09:42 - 2013-12-02 18:45 - 00035104 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcap64v.dll
2013-12-04 14:51 - 2013-11-13 13:29 - 00000000 ____D C:\Users\moonspell\Downloads\Dragon
2013-12-04 11:51 - 2013-12-04 11:51 - 00000000 ____D C:\Users\moonspell\AppData\Local\{F5060116-51FF-4E6B-9EA9-59FD06C35689}
2013-12-04 01:05 - 2013-08-22 16:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2013-12-04 01:05 - 2013-08-22 16:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-03 18:38 - 2013-12-03 18:38 - 00000000 ____D C:\Users\moonspell\AppData\Local\{AC3E77A0-D9E0-4BD5-9C94-F2254C8F4120}
2013-12-03 18:32 - 2013-10-31 19:09 - 00004088 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-03 18:32 - 2013-10-31 19:09 - 00003852 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

Files to move or delete:
====================
C:\ProgramData\winiml.dat


Some content of TEMP:
====================
C:\Users\moonspell\AppData\Local\Temp\avgnt.exe
C:\Users\moonspell\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\moonspell\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\moonspell\AppData\Local\Temp\nvStInst.exe
C:\Users\moonspell\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\moonspell\AppData\Local\Temp\sqlite3.exe
C:\Users\moonspell\AppData\Local\Temp\vlc-2.1.2-win32.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-01 19:48

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-01-2014 01
Ran by moonspell at 2014-01-02 13:22:45
Running from C:\Users\moonspell\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
Arc (x32 Version: 1.0.0.5510 - Perfect World Entertainment)
ASUS USB-N13 WLAN Card Utilities & Driver (x32 Version: 1.0.0.7 - ASUS)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Avira SearchFree Toolbar (x32 Version: 12.10.0.2949 - APN, LLC)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.)
Classic Shell (Version: 4.0.2 - IvoSoft)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Der Herr der Ringe Online (HKCU Version:  - )
Download Navigator (x32 Version: 3.3.0 - SEIKO EPSON CORPORATION)
Epson Connect Printer Setup (x32 Version: 1.1.1 - SEIKO EPSON CORPORATION)
Epson E-Web Print (x32 Version: 1.17.0000 - SEIKO EPSON CORPORATION)
EPSON Printer Finder (x32 Version: 1.0.0 - SEIKO EPSON CORPORATION)
EPSON Remote Print Uninstall (Version:  - SEIKO EPSON Corporation)
EPSON Scan (x32 Version:  - Seiko Epson Corporation)
EPSON WF-2530 Series Printer Uninstall (Version:  - SEIKO EPSON Corporation)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Happy Cloud Client (HKCU Version: 3.41 - Happy Cloud, Inc.)
IM Lock (x32 Version:  - Comvigo, Inc.)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.8.251 - Intel Corporation)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (x32 Version: 3.5.30730.0 - Microsoft Corporation)
Microsoft Office (x32 Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
Nullsoft Install System (x32 Version: 3.0a1 - )
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 331.82 (Version: 331.82 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.82 (Version: 331.82 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.82 (Version: 331.82 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice 4.0.1 (x32 Version: 4.01.9714 - Apache Software Foundation)
Overwolf (x32 Version: 0.47.284 - Overwolf)
Overwolf.Setup.VC100CRTx64.Dist (Version: 1.0.0 - Overwolf)
Realtek Ethernet Controller Driver (x32 Version: 7.72.410.2013 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6873 - Realtek Semiconductor Corp.)
RIFT (HKCU Version:  - Trion Worlds, Inc.)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Software Updater (x32 Version: 4.1.6 - SEIKO EPSON CORPORATION)
System Requirements Lab CYRI (x32 Version: 6.0.8.0 - Husdawg, LLC)
TeamSpeak 3 Client (Version: 3.0.13 - TeamSpeak Systems GmbH)
UseNeXT by Tangysoft (x32 Version:  - Tangysoft Ltd.)
VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 5.00 (64-Bit) (Version: 5.00.0 - win.rar GmbH)

==================== Restore Points  =========================

17-12-2013 18:07:05 DirectX wurde installiert
26-12-2013 18:32:15 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {12320AE9-B98B-44A4-952A-4B55E61368D8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-31] (Google Inc.)
Task: {150D3F5C-28FD-44FC-9000-32DFC95A0A62} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {1E039A45-9100-48CD-9E71-3304682009C6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2360DDA0-6071-4B0B-9384-6DCF1538EF21} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {2D60836F-478B-4F2C-91F7-6E3E8843254C} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\System32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {3C399C05-8D78-455C-81D1-1CFB3A7B2ED2} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {3D0BFE95-BA69-4E42-9074-A9F47D6A0AAD} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {3FEB8C1F-C588-4720-A229-3022359455A2} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {43B51C6C-A331-4984-9A17-08218C0BDDDA} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {49E914D4-87A0-46AC-99BB-40CC5BD41567} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {5F9AEADD-4629-468A-970E-5D648753B03B} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {62D7CE69-27A1-4685-B914-255B9AD70F92} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {68538B49-5050-4679-BB99-F50F6FE14E90} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {881133F0-C696-4FC7-9A4A-6B85BFCBB53E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-31] (Google Inc.)
Task: {8AD904F0-14C2-4736-8A73-4B98F98D735B} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {90A912C4-D6C6-4926-903A-DD0D2286FF71} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {958D5F9F-CE05-4E64-82A0-42C663D6EF76} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {9B393F2E-6CEF-4A53-B391-A8350854765D} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A67D9C44-8CB5-4425-BAC0-62AAEAF55172} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {BEE555D5-C4D7-410A-85A9-9D23BA0B581A} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {C586DBB6-3FDD-4C50-9DB3-02EAB267DEAA} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {CEFE0B0C-C0FB-4EE6-A909-713F035E60BB} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DB894D4B-D5CF-4565-86A3-6A51C4369D12} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {E6716B73-40F4-4233-A096-52C7C40C8199} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {F3B7FB5C-E658-49D4-AC50-9EE82BEC881D} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {FA5971D9-FB83-40F1-A5F0-AB96DFA5DECD} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2013-10-31 20:43 - 2013-10-10 19:14 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-12-06 17:38 - 2013-12-04 03:47 - 00702416 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libglesv2.dll
2013-12-06 17:38 - 2013-12-04 03:47 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libegl.dll
2013-12-06 17:38 - 2013-12-04 03:48 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll
2013-12-06 17:38 - 2013-12-04 03:48 - 00399312 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll
2013-12-06 17:38 - 2013-12-04 03:47 - 01619408 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll
2013-12-06 17:38 - 2013-12-04 03:48 - 13586896 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Alex Alt\Downloads\nachweis.eml:OECustomProperty
AlternateDataStreams: C:\Users\Alex Alt\Documents\raddatz bestätigung.eml:OECustomProperty
AlternateDataStreams: C:\Users\moonspell\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Controller der Familie Realtek PCIe GBE
Description: Controller der Familie Realtek PCIe GBE
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8168
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: 802.11n-Drahtlos-LAN-Karte
Description: 802.11n-Drahtlos-LAN-Karte
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Ralink Technology, Corp.
Service: netr28x
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/02/2014 00:59:20 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest.

Error: (01/01/2014 09:26:18 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TurbineLauncher.exe, Version: 1201.54.1950.4009, Zeitstempel: 0x52a7fd34
Name des fehlerhaften Moduls: patchclient.DLL, Version: 3.0.1.8, Zeitstempel: 0x5284f609
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00024359
ID des fehlerhaften Prozesses: 0xe68
Startzeit der fehlerhaften Anwendung: 0xTurbineLauncher.exe0
Pfad der fehlerhaften Anwendung: TurbineLauncher.exe1
Pfad des fehlerhaften Moduls: TurbineLauncher.exe2
Berichtskennung: TurbineLauncher.exe3
Vollständiger Name des fehlerhaften Pakets: TurbineLauncher.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: TurbineLauncher.exe5

Error: (01/01/2014 09:24:51 PM) (Source: Perflib) (User: )
Description: rdyboost4

Error: (01/01/2014 11:36:04 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: delegate_execute.exe, Version: 31.0.1650.63, Zeitstempel: 0x529e8449
Name des fehlerhaften Moduls: delegate_execute.exe, Version: 31.0.1650.63, Zeitstempel: 0x529e8449
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002a838
ID des fehlerhaften Prozesses: 0x1be0
Startzeit der fehlerhaften Anwendung: 0xdelegate_execute.exe0
Pfad der fehlerhaften Anwendung: delegate_execute.exe1
Pfad des fehlerhaften Moduls: delegate_execute.exe2
Berichtskennung: delegate_execute.exe3
Vollständiger Name des fehlerhaften Pakets: delegate_execute.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: delegate_execute.exe5

Error: (12/24/2013 09:18:53 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest.

Error: (12/22/2013 08:41:46 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TurbineLauncher.exe, Version: 1201.54.1950.4009, Zeitstempel: 0x52a7fd34
Name des fehlerhaften Moduls: patchclient.DLL, Version: 3.0.1.8, Zeitstempel: 0x5284f609
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00024359
ID des fehlerhaften Prozesses: 0x1bd8
Startzeit der fehlerhaften Anwendung: 0xTurbineLauncher.exe0
Pfad der fehlerhaften Anwendung: TurbineLauncher.exe1
Pfad des fehlerhaften Moduls: TurbineLauncher.exe2
Berichtskennung: TurbineLauncher.exe3
Vollständiger Name des fehlerhaften Pakets: TurbineLauncher.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: TurbineLauncher.exe5

Error: (12/22/2013 04:54:44 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TurbineLauncher.exe, Version: 1201.54.1950.4009, Zeitstempel: 0x52a7fd34
Name des fehlerhaften Moduls: patchclient.DLL, Version: 3.0.1.8, Zeitstempel: 0x5284f609
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00024359
ID des fehlerhaften Prozesses: 0x1250
Startzeit der fehlerhaften Anwendung: 0xTurbineLauncher.exe0
Pfad der fehlerhaften Anwendung: TurbineLauncher.exe1
Pfad des fehlerhaften Moduls: TurbineLauncher.exe2
Berichtskennung: TurbineLauncher.exe3
Vollständiger Name des fehlerhaften Pakets: TurbineLauncher.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: TurbineLauncher.exe5

Error: (12/22/2013 01:57:27 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TurbineLauncher.exe, Version: 1201.54.1950.4009, Zeitstempel: 0x528db044
Name des fehlerhaften Moduls: patchclient.DLL, Version: 3.0.1.8, Zeitstempel: 0x52583cc2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002c18f
ID des fehlerhaften Prozesses: 0x1114
Startzeit der fehlerhaften Anwendung: 0xTurbineLauncher.exe0
Pfad der fehlerhaften Anwendung: TurbineLauncher.exe1
Pfad des fehlerhaften Moduls: TurbineLauncher.exe2
Berichtskennung: TurbineLauncher.exe3
Vollständiger Name des fehlerhaften Pakets: TurbineLauncher.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: TurbineLauncher.exe5

Error: (12/22/2013 01:56:04 PM) (Source: Perflib) (User: )
Description: rdyboost4

Error: (12/21/2013 11:26:27 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest.


System errors:
=============
Error: (01/02/2014 00:47:43 PM) (Source: disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.

Error: (01/02/2014 00:47:43 PM) (Source: disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (01/02/2014 00:47:43 PM) (Source: disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/02/2014 00:13:39 AM) (Source: disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.

Error: (01/02/2014 00:13:39 AM) (Source: disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.

Error: (01/02/2014 00:13:39 AM) (Source: disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (01/01/2014 09:38:51 PM) (Source: Microsoft-Windows-Kernel-Power) (User: )
Description: 4

Error: (01/01/2014 09:38:50 PM) (Source: disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/01/2014 08:43:37 PM) (Source: disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk4\DR4 gefunden.

Error: (01/01/2014 08:43:37 PM) (Source: disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.


Microsoft Office Sessions:
=========================
Error: (01/02/2014 00:59:20 PM) (Source: SideBySide)(User: )
Description: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifestC:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifestC:\Program Files (x86)\EPSON Software\Download Navigator\EPSDNAVI.EXE

Error: (01/01/2014 09:26:18 PM) (Source: Application Error)(User: )
Description: TurbineLauncher.exe1201.54.1950.400952a7fd34patchclient.DLL3.0.1.85284f609c000000500024359e6801cf072f833e553aC:\ProgramData\Turbine\The Lord of the Rings Online\TurbineLauncher.exeC:\ProgramData\Turbine\The Lord of the Rings Online\patchclient.DLLf79be271-7322-11e3-be75-89c4c68b64a0

Error: (01/01/2014 09:24:51 PM) (Source: Perflib)(User: )
Description: rdyboost4

Error: (01/01/2014 11:36:04 AM) (Source: Application Error)(User: )
Description: delegate_execute.exe31.0.1650.63529e8449delegate_execute.exe31.0.1650.63529e8449c00000050002a8381be001cf06dd427cf0b3C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\delegate_execute.exeC:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\delegate_execute.exe838afd97-72d0-11e3-be74-f5bd805ba527

Error: (12/24/2013 09:18:53 AM) (Source: SideBySide)(User: )
Description: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifestC:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifestC:\Program Files (x86)\EPSON Software\Download Navigator\EPSDNAVI.EXE

Error: (12/22/2013 08:41:46 PM) (Source: Application Error)(User: )
Description: TurbineLauncher.exe1201.54.1950.400952a7fd34patchclient.DLL3.0.1.85284f609c0000005000243591bd801ceff4dbce02252C:\ProgramData\Turbine\The Lord of the Rings Online\TurbineLauncher.exeC:\ProgramData\Turbine\The Lord of the Rings Online\patchclient.DLL16f7fe3b-6b41-11e3-be71-d24ba913eba5

Error: (12/22/2013 04:54:44 PM) (Source: Application Error)(User: )
Description: TurbineLauncher.exe1201.54.1950.400952a7fd34patchclient.DLL3.0.1.85284f609c000000500024359125001ceff247c9859ccC:\ProgramData\Turbine\The Lord of the Rings Online\TurbineLauncher.exeC:\ProgramData\Turbine\The Lord of the Rings Online\patchclient.DLL5fe6dbec-6b21-11e3-be71-d24ba913eba5

Error: (12/22/2013 01:57:27 PM) (Source: Application Error)(User: )
Description: TurbineLauncher.exe1201.54.1950.4009528db044patchclient.DLL3.0.1.852583cc2c00000050002c18f111401ceff152afd3bd6C:\ProgramData\Turbine\The Lord of the Rings Online\TurbineLauncher.exeC:\ProgramData\Turbine\The Lord of the Rings Online\patchclient.DLL9b48f7e2-6b08-11e3-be71-d24ba913eba5

Error: (12/22/2013 01:56:04 PM) (Source: Perflib)(User: )
Description: rdyboost4

Error: (12/21/2013 11:26:27 AM) (Source: SideBySide)(User: )
Description: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifestC:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifestC:\Program Files (x86)\EPSON Software\Download Navigator\EPSDNAVI.EXE


CodeIntegrity Errors:
===================================
  Date: 2013-12-20 17:42:57.679
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2013-12-20 17:42:57.569
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2013-12-20 17:42:57.366
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2013-12-20 17:42:57.054
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2013-12-20 17:42:56.913
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2013-12-20 17:42:56.694
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2013-12-20 17:42:56.569
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2013-12-20 17:42:56.361
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2013-12-20 17:42:56.017
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2013-12-20 17:37:38.719
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Percentage of memory in use: 25%
Total physical RAM: 8133.98 MB
Available physical RAM: 6075.19 MB
Total Pagefile: 16325.98 MB
Available Pagefile: 13852.9 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:919.41 GB) (Free:789.53 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: C867134B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=919 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12 GB) - (Type=27)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-02 13:30:10
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000002c ST1000DM003-1CH162 rev.CC47 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\MOONSP~1\AppData\Local\Temp\kwdyquob.sys


---- User code sections - GMER 2.1 ----

.text   C:\WINDOWS\System32\dwm.exe[7312] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                     00007ffadf9d169a 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\System32\dwm.exe[7312] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                     00007ffadf9d16a2 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\System32\dwm.exe[7312] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                        00007ffadf9d181a 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\System32\dwm.exe[7312] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                        00007ffadf9d1832 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\system32\nvvsvc.exe[7536] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                  00007ffadf9d169a 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\system32\nvvsvc.exe[7536] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                  00007ffadf9d16a2 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\system32\nvvsvc.exe[7536] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                     00007ffadf9d181a 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\system32\nvvsvc.exe[7536] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                     00007ffadf9d1832 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\Explorer.EXE[3192] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                         00007ffadf9d169a 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\Explorer.EXE[3192] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                         00007ffadf9d16a2 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\Explorer.EXE[3192] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                            00007ffadf9d181a 4 bytes [9D, DF, FA, 7F]
.text   C:\WINDOWS\Explorer.EXE[3192] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                            00007ffadf9d1832 4 bytes [9D, DF, FA, 7F]
.text   C:\Users\moonspell\Desktop\FRST64.exe[2584] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194                                                 00007ffad4e01f6a 4 bytes [E0, D4, FA, 7F]
.text   C:\Users\moonspell\Desktop\FRST64.exe[2584] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218                                                 00007ffad4e01f82 4 bytes [E0, D4, FA, 7F]
.text   C:\Users\moonspell\Desktop\FRST64.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                           00007ffadf9d169a 4 bytes [9D, DF, FA, 7F]
.text   C:\Users\moonspell\Desktop\FRST64.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                           00007ffadf9d16a2 4 bytes [9D, DF, FA, 7F]
.text   C:\Users\moonspell\Desktop\FRST64.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                              00007ffadf9d181a 4 bytes [9D, DF, FA, 7F]
.text   C:\Users\moonspell\Desktop\FRST64.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                              00007ffadf9d1832 4 bytes [9D, DF, FA, 7F]

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [3188:7496]                                                                                                    fffff9600088c4d0

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{187D0CA3-836A-43B7-A63E-374BD073EA49}\Connection@Name  isatap.fritz.box
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                            -1591203846
Reg     HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{187D0CA3-836A-43B7-A63E-374BD073EA49}@ReusableType                        0
Reg     HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{187D0CA3-836A-43B7-A63E-374BD073EA49}@DefunctTimestamp                    0xEC 0x53 0xC5 0x52 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Services\rdyboost\Parameters@LastBootPlanUserTime                                                              ?Mi?, ?Jan ?01 ?14, 09:29:47???????????????????????????????????
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                              1824
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                             4056
Reg     HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw                                                                                           0x64 0x62 0x03 0x00 ...
Reg     HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask                                                                                       0x64 0x62 0x03 0x00 ...
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown@CleanShutdown                                                               1
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{449D0D6E-2412-4E61-B68F-1CB625CD9E52}\iexplore@Count                               141
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{553891B7-A0D5-4526-BE18-D3CE461D6310}\iexplore@Count                               141
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastRenewCollectionsInterest                                       0x07 0x0C 0x73 0xB7 ...
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\SettingSync\SyncData@PendingOperations                                                        28
Reg     HKCU\Software\Microsoft\Windows\DWM@ColorizationColor                                                                                        -1354109965
Reg     HKCU\Software\Microsoft\Windows\DWM@ColorizationAfterglow                                                                                    -1354109965

---- EOF - GMER 2.1 ----