Windows 7: E-Mail Adresse war betroffen / Verdacht auf Malware

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:09 on 24/01/2014 (Robert)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2014
Ran by Robert (administrator) on ROBERT-PC on 24-01-2014 20:27:25
Running from C:\Users\Robert\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Gainward Co.) C:\Program Files (x86)\EXPERTool\TBPANEL.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\SetPoint\SetPoint.exe
() C:\Program Files (x86)\ASUS\TurboV\TurboV.exe
(Logitech(c)) C:\Program Files (x86)\Logitech\G35\G35.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
() C:\Program Files (x86)\Logitech\SetPoint\x86\SetPoint32.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\TeamViewer.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\tv_w32.exe
(TeamViewer GmbH) E:\Programme\Teamviewer\tv_x64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\wmi64.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-08-20] (Analog Devices, Inc.)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [TurboV] - C:\Program Files (x86)\ASUS\TurboV\TurboV.exe [4040192 2008-10-21] ()
HKLM-x32\...\Run: [Logitech G35] - C:\Program Files (x86)\Logitech\G35\G35.exe [1811728 2009-06-30] (Logitech(c))
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2008-04-15] (Analog Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1644680 2013-02-08] (Ask)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-03-28] (DivX, LLC)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logitech\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [GAINWARD] - C:\Program Files (x86)\EXPERTool\TBPanel.exe [2181672 2009-05-12] (Gainward Co.)
HKCU\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3858432 2008-08-20] (Analog Devices, Inc.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
MountPoints2: {192e93a7-4fc1-11e0-8c22-00248c9fd597} - F:\LaunchU3.exe -a
IFEO: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1CF3E2E5C76FCA01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - DefaultScope {7DDC945D-68E7-480A-B922-594CD4878A41} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {7DDC945D-68E7-480A-B922-594CD4878A41} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {9213EACE-9E17-47A0-9C80-CD242746D912} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=588E267A-CBB7-48D0-BCE0-056EEA6E076C&apn_sauid=8948AD11-A5CB-4A78-95AD-B29C308810D0
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://isearch.avg.com/search?cid={2D9D9775-C2BD-4E15-8099-A602BFC047A0}&mid=ca395b9b148047d1a60dd1b647e4e9f2-c62222099914541bc2a95e063d81af64193236db&lang=de&ds=tt014&pr=sa&d=2011-12-18 15:04:29&v=12.2.5.32&sap=dsp&q={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Windows\SysWOW64\PrxerNsp.dll [56424] ()
Winsock: Catalog9 09 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 10 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 11 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 12 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 24 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog5-x64 07 %SystemRoot%\system32\PrxerNsp.dll [57448] ()
Winsock: Catalog9-x64 09 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 10 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 11 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 12 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 24 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default
FF user.js: detected! => C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\user.js
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://google.de/
FF NetworkProxy: "backup.ftp", "58.20.127.100"
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "58.20.127.100"
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "58.20.127.100"
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "80.193.214.239"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "80.193.214.239"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", ""
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "80.193.214.239"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "80.193.214.239"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 1
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.104.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.96.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 - C:\Users\Robert\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1002170-0-npoctoshape.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Robert\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Robert\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)
FF SearchPlugin: C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Ask Toolbar - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\toolbar@ask.com [2013-10-30]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Adblock Plus - C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\2xcpxftx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-04]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2011-01-20]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2011-01-20]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2012-01-22]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-10-27]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-01]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-19]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-19]

Chrome: 
=======
CHR HomePage: 
CHR DefaultSearchKeyword: google.de_
CHR DefaultSearchURL: hxxp://www.google.de/search?q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Robert\AppData\Local\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Free Studio) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\np_dvs_plugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (ijji Web Launching Plugin for FF) - C:\Program Files (x86)\Mozilla Firefox\plugins\npijjiFFPlugin1.dll (NHN USA Inc.)
CHR Plugin: (Octoshape Streaming Services) - C:\Users\Robert\AppData\Roaming\Mozilla\plugins\npoctoshape.dll (Octoshape ApS)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Google Update) - C:\Users\Robert\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (ProxTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-01-19]
CHR Extension: (Google Drive) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-09-16]
CHR Extension: (Brushed) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg [2013-03-27]
CHR Extension: (YouTube) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-09-16]
CHR Extension: (Google-Suche) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-09-16]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2012-09-16]
CHR Extension: (AdBlock) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-09-16]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2013-01-21]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-01-19]
CHR Extension: (Virtuelle Tastatur) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2012-09-16]
CHR Extension: (FVD Downloader) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2012-11-04]
CHR Extension: (Google Wallet) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-09-16]
CHR Extension: (NotScripts) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2012-09-29]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2012-11-01]
CHR Extension: (Google Mail) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-09-16]
CHR Extension: (Anti-Banner) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2012-09-16]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Robert\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx [2012-09-15]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896056 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe [86016 2008-08-15] ()
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
S4 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [678416 2012-11-14] ()
S3 LBTServ; C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe [160784 2009-07-20] (Logitech, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-01] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
R2 TeamViewer8; E:\Programme\Teamviewer\TeamViewer_Service.exe [5087584 2013-10-01] (TeamViewer GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2409272 2013-12-10] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
S3 Cardex; C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)
S3 ESLvnic1; C:\Windows\System32\DRIVERS\ESLvnic.sys [25528 2009-12-03] (Turtle Entertainment GmbH)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [160784 2012-11-14] (<Turtle Entertainment>)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-19] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620640 2014-01-19] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-01-19] (Kaspersky Lab ZAO)
R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [61712 2009-05-28] (Logitech)
R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [376848 2009-05-28] (Logitech)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15680 2006-11-01] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [47632 2009-10-20] (CACE Technologies, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-08-28] (TuneUp Software)
S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [20480 2010-08-24] (Motorola)
S3 VaneFltr; C:\Windows\System32\drivers\Lachesis.sys [30336 2007-08-17] (Razer (Asia-Pacific) Pte Ltd)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-24 20:17 - 2014-01-24 20:17 - 00044110 _____ C:\Users\Robert\Desktop\Addition.txt
2014-01-24 20:16 - 2014-01-24 20:28 - 00034673 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:11 - 2014-01-24 20:11 - 02077696 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-24 20:09 - 2014-01-24 20:16 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-21 21:57 - 2014-01-21 22:15 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:51 - 2014-01-19 22:36 - 00000000 ____D C:\Profi cash
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:19 - 2014-01-19 17:18 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-24 20:25 - 00422572 _____ C:\Windows\setupact.log
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-24 19:36 - 00007240 _____ C:\Windows\PFRO.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:55 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 07:54 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-18 07:54 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-18 07:54 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-15 16:22 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 16:22 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 16:22 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 16:22 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18310112 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-01-13 20:20 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-01-13 20:20 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

==================== One Month Modified Files and Folders =======

2014-01-24 20:28 - 2014-01-24 20:16 - 00034673 _____ C:\Users\Robert\Desktop\FRST.txt
2014-01-24 20:28 - 2009-12-11 17:22 - 01864262 _____ C:\Windows\WindowsUpdate.log
2014-01-24 20:26 - 2013-04-08 10:59 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-24 20:25 - 2014-01-18 15:26 - 00422572 _____ C:\Windows\setupact.log
2014-01-24 20:25 - 2012-11-24 16:45 - 00000000 ____D C:\ProgramData\VMware
2014-01-24 20:25 - 2009-08-13 22:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-24 20:25 - 2009-08-05 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-24 20:25 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-24 20:17 - 2014-01-24 20:17 - 00044110 _____ C:\Users\Robert\Desktop\Addition.txt
2014-01-24 20:16 - 2014-01-24 20:09 - 00000000 ____D C:\Users\Robert\Desktop\SCANS
2014-01-24 20:15 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-24 20:15 - 2009-12-11 16:59 - 00010896 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-24 20:13 - 2014-01-24 20:13 - 00000000 ____D C:\FRST
2014-01-24 20:11 - 2014-01-24 20:11 - 02077696 _____ (Farbar) C:\Users\Robert\Desktop\FRST64.exe
2014-01-24 20:09 - 2014-01-24 20:09 - 00000000 _____ C:\Users\Robert\defogger_reenable
2014-01-24 20:09 - 2009-12-11 17:03 - 00000000 ____D C:\Users\Robert
2014-01-24 20:08 - 2011-06-27 16:17 - 00000000 ____D C:\Users\Robert\AppData\Local\PMB Files
2014-01-24 19:51 - 2012-09-16 13:47 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job
2014-01-24 19:45 - 2010-03-07 03:07 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{17212944-8BF8-4509-BFF6-0D177AC05DDE}
2014-01-24 19:36 - 2014-01-18 15:25 - 00007240 _____ C:\Windows\PFRO.log
2014-01-24 00:51 - 2012-09-16 13:47 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job
2014-01-23 23:48 - 2012-10-03 00:08 - 00000000 ____D C:\Users\Robert\AppData\Roaming\vlc
2014-01-23 07:44 - 2011-03-31 17:32 - 00003694 _____ C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-01-22 19:33 - 2009-07-14 18:58 - 00747994 _____ C:\Windows\system32\perfh007.dat
2014-01-22 19:33 - 2009-07-14 18:58 - 00170676 _____ C:\Windows\system32\perfc007.dat
2014-01-22 19:33 - 2009-07-14 06:13 - 01751820 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-22 18:48 - 2013-09-15 15:53 - 00000000 ____D C:\Users\Robert\AppData\Local\Deployment
2014-01-22 17:55 - 2014-01-22 17:55 - 00000288 _____ C:\Users\Robert\AppData\Roaming\.backup.dm
2014-01-22 16:28 - 2014-01-22 16:28 - 00000000 ____D C:\Windows\pss
2014-01-22 16:28 - 2009-08-05 18:41 - 00000000 ___RD C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-22 10:30 - 2013-07-12 15:42 - 00000000 ____D C:\Users\Robert\AppData\Local\TSVNCache
2014-01-21 22:15 - 2014-01-21 21:57 - 00000202 _____ C:\Users\Robert\Desktop\EMail Prüfung.txt
2014-01-19 22:36 - 2014-01-19 20:51 - 00000000 ____D C:\Profi cash
2014-01-19 21:03 - 2014-01-19 21:03 - 00003098 _____ C:\Windows\System32\Tasks\{4508EB49-3357-4153-8ED6-C4F285F9B56D}
2014-01-19 20:52 - 2014-01-19 20:52 - 00000613 _____ C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000589 _____ C:\Users\Robert\Desktop\Profi cash.lnk
2014-01-19 20:52 - 2014-01-19 20:52 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Profi cash
2014-01-19 20:52 - 2006-11-02 13:34 - 00000237 _____ C:\Windows\win.ini
2014-01-19 20:49 - 2012-09-15 20:17 - 00000000 ____D C:\Users\Robert\AppData\Roaming\QuickScan
2014-01-19 20:11 - 2013-10-17 15:47 - 00620640 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-19 20:11 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-01-19 20:11 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-19 17:31 - 2014-01-19 17:31 - 00002330 _____ C:\Users\Robert\Desktop\Sicherer Zahlungsverkehr.lnk
2014-01-19 17:27 - 2009-12-02 12:46 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2014-01-19 17:19 - 2011-01-20 12:32 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2014-01-19 17:18 - 2014-01-19 17:19 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-01-19 03:14 - 2013-04-19 18:24 - 00768000 ___SH C:\Users\Robert\Thumbs.db
2014-01-19 03:06 - 2013-07-12 14:27 - 00000000 ____D C:\Users\Robert\AppData\Local\Package Cache
2014-01-19 00:47 - 2010-02-03 15:13 - 00000000 ____D C:\Users\Robert\AppData\Roaming\TS3Client
2014-01-18 15:38 - 2014-01-18 15:38 - 00068656 _____ C:\Users\Robert\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 15:26 - 2014-01-18 15:26 - 00000000 _____ C:\Windows\setuperr.log
2014-01-18 15:25 - 2014-01-18 15:25 - 00306808 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-18 08:24 - 2009-12-11 18:16 - 00003704 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2014-01-18 08:13 - 2013-06-22 18:18 - 00000000 ____D C:\Users\Robert\Desktop\WOW WICHTIG!
2014-01-18 07:55 - 2014-01-18 07:55 - 00000000 ____D C:\ProgramData\Oracle
2014-01-18 07:54 - 2014-01-18 07:54 - 00005402 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 07:54 - 2013-07-01 22:56 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-17 21:58 - 2009-08-14 17:31 - 00000000 ____D C:\Users\Robert\AppData\Roaming\Skype
2014-01-17 21:57 - 2011-05-12 18:30 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-17 21:57 - 2009-08-13 21:42 - 00000000 ____D C:\ProgramData\Skype
2014-01-17 21:53 - 2012-09-15 18:43 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2014-01-17 20:36 - 2009-12-11 17:02 - 01725164 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-17 20:34 - 2013-08-17 03:45 - 00000000 ____D C:\Windows\system32\MRT
2014-01-17 20:31 - 2010-01-14 17:47 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 15:52 - 2012-09-16 14:21 - 00002362 _____ C:\Users\Robert\Desktop\Google Chrome.lnk
2014-01-13 20:23 - 2009-10-24 17:27 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2014-01-11 20:04 - 2013-07-12 14:25 - 00000000 ____D C:\Users\Robert\Downloads\HonorB
2014-01-11 00:52 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Local\VMware
2014-01-09 20:45 - 2012-11-24 16:51 - 00000000 ____D C:\Users\Robert\AppData\Roaming\VMware
2014-01-09 14:56 - 2009-08-27 15:10 - 00000000 ___RD C:\Users\Robert\Wichtiges
2014-01-04 15:37 - 2013-07-12 15:51 - 00000000 ____D C:\Users\Robert\AppData\Local\HonorbuddyMeshes

Some content of TEMP:
====================
C:\Users\Robert\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-19 00:16

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2014
Ran by Robert at 2014-01-24 20:28:46
Running from C:\Users\Robert\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (x32 Version: 10.1.9 - Adobe Systems Incorporated)
Ask Toolbar (x32 Version: 1.15.15.0 - Ask.com) <==== ATTENTION
Ask Toolbar Updater (HKCU Version: 1.2.4.36191 - Ask.com) <==== ATTENTION
Assassin's Creed Revelations 1.03 (x32 Version: 1.03 - Ubisoft)
Avira Antivirus Premium (x32 Version: 14.0.2.286 - Avira)
Badaboom 1.1.1.241 (x32 Version: 1.1.1.241 - Elemental Technologies)
Battlefield 3™ (x32 Version: 1.4.0.0 - Electronic Arts)
Battlefield 4™ Beta (x32 Version: 1.0.0.0 - Electronic Arts)
Call of Duty: Black Ops II - Multiplayer (x32 Version:  - )
Call of Duty: Black Ops II (x32 Version:  - Treyarch)
CCleaner (Version: 4.08 - Piriform)
CDDRV_Installer (Version: 4.60 - Logitech) Hidden
Cool & Quiet (x32 Version:  - )
Counter-Strike: Global Offensive Beta (x32 Version:  - )
Counter-Strike: Source (x32 Version: 1.0.0.0 - Valve)
Curse Client (HKCU Version: 5.1.1.792 - Curse)
DivX Converter (x32 Version: 7.1.0 - DivX, Inc.)
DivX Plus DirectShow Filters (x32 Version:  - DivX, Inc.)
DivX-Setup (x32 Version: 2.6.1.28 - DivX, LLC)
EasyBits GO (HKCU Version:  - EasyBits Media)
EPU-6 Engine (x32 Version: 1.00.28 - )
erLT (x32 Version: 1.20.0137 - Logitech, Inc.) Hidden
ESL Wire 1.15 (Version:  - Turtle Entertainment GmbH)
ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)
EXPERTool 7.5 (x32 Version:  - Gainward Co., Ltd)
Express Gate Updater (x32 Version: 1.1.1.2 - DeviceVM)
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.23.0 - MAGIX AG)
Free YouTube to MP3 Converter version 3.12.12.827 (x32 Version: 3.12.12.827 - DVDVideoSoft Ltd.)
GameSpy Comrade (x32 Version: 1.5.0.156 - GameSpy)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKCU Version: 32.0.1700.76 - Google Inc.)
Google Update Helper (x32 Version: 1.3.21.111 - Google Inc.) Hidden
Heroes of Newerth (x32 Version: 2.3.0 - S2 Games)
Honorbuddy (HKCU Version: 2.5.7291.636 - Bossland GmbH)
Honorbuddy (HKCU Version: 2.5.7346.637 - Bossland GmbH)
Honorbuddy (HKCU Version: 2.5.9468.722 - Bossland GmbH)
Honorbuddy (x32 Version: 2.5.9468.722 - Bossland GmbH) Hidden
Host OpenAL (ADI) (x32 Version:  - )
ICQ7.2 (x32 Version: 7.2 - ICQ)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
KhalInstallWrapper (Version: 2.00.0000 - Logitech) Hidden
Logitech G35 (Version: 1.0.152 - Logitech)
Logitech SetPoint (x32 Version: 4.80 - Logitech)
MAGIX Screenshare (x32 Version: 4.3.6.1987 - MAGIX AG)
MAGIX Speed burnR (x32 Version: 7.0.2.7 - MAGIX AG)
Microsoft .NET Framework 1.1 (x32 Version:  - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 1.1 Security Update (KB953297) (x32 Version:  - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Age of Empires II (x32 Version:  - )
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
mIRC (x32 Version: 6.35 - mIRC Co. Ltd.)
Mozilla Firefox 17.0.1 (x86 de) (x32 Version: 17.0.1 - Mozilla)
Mozilla Maintenance Service (x32 Version: 17.0.1 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
NCsoft Launcher (x32 Version: 1.5.19002 - NCsoft)
Notepad++ (x32 Version: 6.5 - Notepad++ Team)
NVIDIA 3D Vision Controller Driver (x32 Version: 280.19 - NVIDIA Corporation) Hidden
NVIDIA 3D Vision Controller-Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3221 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice.org 3.3 (x32 Version: 3.3.9567 - OpenOffice.org)
Origin (x32 Version: 8.6.0.357 - Electronic Arts, Inc.)
Pando Media Booster (x32 Version: 2.3.6.0 - Pando Networks Inc.)
Profi cash (x32 Version:  - )
PROTOTYPE 2 (x32 Version:  - Radical Entertainment)
Proxifier version 3.21 (x32 Version: 3.21 - Initex)
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Skype Click to Call (x32 Version: 5.6.8442 - Skype Technologies S.A.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Sniper Elite V2 (x32 Version:  - )
SoundMAX (x32 Version: 6.10.2.6520 - Analog Devices)
Steam(TM) (x32 Version: 1.0.0.0 - Valve)
TeamSpeak 3 Client (x32 Version: 3.0.13.1 - TeamSpeak Systems GmbH)
TeamViewer 8 (x32 Version: 8.0.22298 - TeamViewer)
tools-linux (x32 Version: 9.6.1.1379776 - VMware, Inc.) Hidden
TortoiseSVN 1.8.0.24401 (64 bit) (Version: 1.8.24401 - TortoiseSVN)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.179 - TuneUp Software)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.179 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 10.0.4410.1 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.2160.11 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.4000.179 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 9.0.5100.2 - TuneUp Software) Hidden
TurboV (x32 Version: 1.00.17 - )
Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.3 (x32 Version: 2.0.3 - VideoLAN)
VLC media player 2.1.2 (Version: 2.1.2 - VideoLAN)
VMware Player (Version: 6.0.1 - VMware, Inc.) Hidden
VMware Player (x32 Version: 6.0.1 - VMware, Inc)
vReveal (x32 Version:  - MotionDSP)
Warcraft III (x32 Version:  - )
Warcraft III: All Products (HKCU Version:  - )
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
WinPcap 4.1.1 (x32 Version: 4.1.0.1753 - CACE Technologies)
WinRAR (x32 Version:  - )
World of Warcraft (x32 Version:  - Blizzard Entertainment)

==================== Restore Points  =========================

24-01-2014 04:16:53 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2006-11-02 13:34 - 2006-09-18 22:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {08631979-D016-4152-A093-6D3E4F4E7A12} - System32\Tasks\SVN Update2 => E:\SVN Update2.bat [2013-11-09] ()
Task: {13A36FA7-B51E-42A7-A24C-6928FFE7F87D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)
Task: {18010635-0EE2-4B03-9EA6-30B0C50C7AA2} - System32\Tasks\{90A3A757-3A64-445C-B407-B3956DB512CD} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-15] (Skype Technologies S.A.)
Task: {185BBCC6-9B25-4AA5-8140-FEA91F0FDB77} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {1D571EDF-1EB8-4D06-98B6-621613C54E70} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-02-08] ()
Task: {20A7E74B-22CA-479E-8562-49CB05E8038C} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2009-07-14] (Microsoft Corporation)
Task: {3BE67737-A7A8-4186-AE85-99C5B26A9113} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)
Task: {4C0E5B45-8EB2-4F5D-B752-ED53133328B6} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe [2013-12-10] (TuneUp Software)
Task: {4C2F3E75-29AC-4B0E-BB2B-6AE7C8756AF2} - System32\Tasks\{B37E03D7-724D-4ED6-A0C3-B870D6690AA1} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {4D820902-3FAA-4D64-97FE-DAFF65749979} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)
Task: {4F814AB8-EA3A-4587-B9FD-BBF302E0FE65} - System32\Tasks\{B60632FC-CD32-4786-B57E-6F6D7D05B405} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {830998AC-4D46-484A-AA33-5DF38748633E} - System32\Tasks\DivX-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2013-02-13] ()
Task: {90F5E964-C187-40A6-A384-1CF67A1D603D} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {910171FB-FEFF-46DF-9C99-7378CF46AC7A} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe
Task: {9475DD97-BB54-4FD8-A31A-032B4833F6AA} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {95C6CA51-3E2A-47DE-9288-024625960618} - System32\Tasks\{DCED82F0-7941-43D4-BB72-5307D26CA57A} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-15] (Skype Technologies S.A.)
Task: {9B34B395-2186-49B7-B5EB-CF53607FE0E9} - System32\Tasks\Google Updater and Installer => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)
Task: {A6651D8F-83E0-4A57-9E78-6B6803C1E6A8} - System32\Tasks\SVN Update => E:\SVN Update.bat [2013-10-06] ()
Task: {AB54D6C5-5BC4-4375-9039-960F7F6F2A56} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {AE17272F-8E41-4056-B822-354581F6C6E2} - System32\Tasks\{DCE9D458-5A5C-4C33-B054-1E531B793694} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {B165A169-FAA2-4ECD-818B-24F0047F56C9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)
Task: {C15A9275-9D3A-49A2-9FAE-ECBE177427D5} - System32\Tasks\{862D60CD-E564-4C01-9101-9AF7AD4B6E2B} => E:\Programme\HoN\hon.exe [2013-10-13] (S2 Games)
Task: {C15F8E8F-C064-4FEB-AF1A-4C3ACC1A2649} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {C28278BF-1ABF-4595-BB2A-15201DDF25E3} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {C592C51D-489B-4B85-BE20-EF6F489FD5E1} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: {DC69638B-35B6-4932-A742-8CF09EA335AD} - System32\Tasks\{DFB05294-0DC7-4FEE-9B93-42EC5DC53F4C} => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2008-11-13] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000Core.job => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-908869703-3165420859-1136871304-1000UA.job => C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-06-17 19:27 - 2013-06-17 19:27 - 00075504 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll
2013-06-17 19:27 - 2013-06-17 19:27 - 00088304 _____ () C:\Program Files\TortoiseSVN\bin\libsasl.dll
2009-09-14 13:08 - 2009-07-20 11:35 - 00018960 _____ () C:\Program Files (x86)\Logitech\SetPoint\khalwrapper.dll
2013-09-03 15:53 - 2012-11-22 17:57 - 00057448 _____ () C:\Windows\system32\PrxerNsp.dll
2012-11-13 15:45 - 2013-06-08 16:02 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2009-08-05 19:01 - 1998-10-31 09:55 - 00005120 _____ () C:\Program Files (x86)\EXPERTool\TBManage.dll
2009-08-05 18:58 - 2005-05-11 15:39 - 00565248 _____ () C:\Program Files (x86)\ASUS\TurboV\pngio.dll
2009-08-05 18:58 - 2008-09-04 16:42 - 01126912 _____ () C:\Program Files (x86)\ASUS\TurboV\OcProfile.dll
2009-08-05 18:58 - 2008-08-21 14:19 - 00126976 _____ () C:\Program Files (x86)\ASUS\TurboV\TVOCLIB.DLL
2013-10-18 12:46 - 2013-10-18 12:46 - 01260624 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:24721E3C

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/24/2014 08:26:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/24/2014 08:23:21 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (01/24/2014 07:38:51 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 10:47:52 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1".
Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (01/23/2014 10:45:13 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.

Error: (01/23/2014 07:21:36 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 07:18:37 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (01/22/2014 07:15:25 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Steam2k5.Launcher.exe, Version: 2.5.9468.722, Zeitstempel: 0x52d943fd
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x19a0
Startzeit der fehlerhaften Anwendung: 0xSteam2k5.Launcher.exe0
Pfad der fehlerhaften Anwendung: Steam2k5.Launcher.exe1
Pfad des fehlerhaften Moduls: Steam2k5.Launcher.exe2
Berichtskennung: Steam2k5.Launcher.exe3

Error: (01/22/2014 07:15:24 PM) (Source: .NET Runtime) (User: )
Description: Anwendung: Steam2k5.Launcher.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.InvalidOperationException
Stapel:
   bei System.Diagnostics.Process.WaitForInputIdle(Int32)
   bei System.Diagnostics.Process.WaitForInputIdle()
   bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
   bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.Input.InputManager.ProcessStagingArea()
   bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
   bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
   bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
   bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
   bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei Microsoft.Win32.NativeMethods.ShellExecuteEx(ShellExecuteInfo)
   bei System.Diagnostics.ShellExecuteHelper.ShellExecuteFunction()
   bei System.Diagnostics.ShellExecuteHelper.ShellExecuteOnSTAThread()
   bei System.Diagnostics.Process.StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)
   bei System.Diagnostics.Process.Start()
   bei System.Diagnostics.Process.Start(System.Diagnostics.ProcessStartInfo)
   bei System.Diagnostics.Process.Start(System.String, System.String)
   bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
   bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.Input.InputManager.ProcessStagingArea()
   bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
   bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
   bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
   bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
   bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.Run()
   bei System.Windows.Application.RunDispatcher(System.Object)
   bei System.Windows.Application.RunInternal(System.Windows.Window)
   bei System.Windows.Application.Run(System.Windows.Window)
   bei System.Windows.Application.Run()
   bei Honorbuddy.Launcher.App.Main()

Error: (01/22/2014 10:51:57 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1".
Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (01/24/2014 02:02:44 AM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/22/2014 05:49:18 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (01/22/2014 05:49:18 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (01/22/2014 05:49:17 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (01/22/2014 05:49:17 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (01/22/2014 10:30:11 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "TeamViewer 8" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/22/2014 10:30:11 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst TeamViewer 8 erreicht.

Error: (01/19/2014 08:11:46 PM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (01/19/2014 03:02:53 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/18/2014 03:26:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (01/24/2014 08:26:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/24/2014 08:23:21 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe)(User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (01/24/2014 07:38:51 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 10:47:52 AM) (Source: SideBySide)(User: )
Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files (x86)\windows live\messenger\wlcsdk.exe

Error: (01/23/2014 10:45:13 AM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2

Error: (01/23/2014 07:21:36 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 07:18:37 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe)(User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (01/22/2014 07:15:25 PM) (Source: Application Error)(User: )
Description: Steam2k5.Launcher.exe2.5.9468.72252d943fdKERNELBASE.dll6.1.7601.1822951fb1116e04343520000c41f19a001cf179dd9523bcfE:\Programme\BG\Steam2k5.Launcher.exeC:\Windows\syswow64\KERNELBASE.dll29b72253-8391-11e3-b4ad-005056c00008

Error: (01/22/2014 07:15:24 PM) (Source: .NET Runtime)(User: )
Description: Anwendung: Steam2k5.Launcher.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.InvalidOperationException
Stapel:
   bei System.Diagnostics.Process.WaitForInputIdle(Int32)
   bei System.Diagnostics.Process.WaitForInputIdle()
   bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
   bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.Input.InputManager.ProcessStagingArea()
   bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
   bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
   bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
   bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
   bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei Microsoft.Win32.NativeMethods.ShellExecuteEx(ShellExecuteInfo)
   bei System.Diagnostics.ShellExecuteHelper.ShellExecuteFunction()
   bei System.Diagnostics.ShellExecuteHelper.ShellExecuteOnSTAThread()
   bei System.Diagnostics.Process.StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)
   bei System.Diagnostics.Process.Start()
   bei System.Diagnostics.Process.Start(System.Diagnostics.ProcessStartInfo)
   bei System.Diagnostics.Process.Start(System.String, System.String)
   bei Honorbuddy.Launcher.MainWindow.BtnLaunch_OnPreviewMouseLeftButtonUp(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
   bei System.Windows.UIElement.OnPreviewMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   bei System.Windows.Input.MouseButtonEventArgs.InvokeEventHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.Input.InputManager.ProcessStagingArea()
   bei System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
   bei System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
   bei System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
   bei System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
   bei System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.Run()
   bei System.Windows.Application.RunDispatcher(System.Object)
   bei System.Windows.Application.RunInternal(System.Windows.Window)
   bei System.Windows.Application.Run(System.Windows.Window)
   bei System.Windows.Application.Run()
   bei Honorbuddy.Launcher.App.Main()

Error: (01/22/2014 10:51:57 AM) (Source: SideBySide)(User: )
Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files (x86)\windows live\messenger\wlcsdk.exe


CodeIntegrity Errors:
===================================
  Date: 2014-01-23 10:47:06.063
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-23 10:47:06.062
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-23 10:47:06.060
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-23 10:47:06.045
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-23 10:47:06.044
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-23 10:47:06.042
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-22 10:50:21.441
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-22 10:50:21.440
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-22 10:50:21.438
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-01-22 10:50:21.415
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 35%
Total physical RAM: 6135.12 MB
Available physical RAM: 3957.72 MB
Total Pagefile: 12268.41 MB
Available Pagefile: 9653.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:298.09 GB) (Free:194.39 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Volume) (Fixed) (Total:698.63 GB) (Free:535.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: E7091A42)
Partition 1: (Active) - (Size=298 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 114AA6A5)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-24 20:49:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 SAMSUNG_HD322HJ rev.1AC01118 298,09GB
Running: gmer.exe; Driver: C:\Users\Robert\AppData\Local\Temp\kgdiqpow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey         000000007793faa8 5 bytes JMP 00000001710c18a8
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[2184] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory  0000000077940038 5 bytes JMP 00000001710c1ea1
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                     00000000711f1a22 2 bytes [1F, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                     00000000711f1ad0 2 bytes [1F, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                     00000000711f1b08 2 bytes [1F, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                     00000000711f1bba 2 bytes [1F, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                     00000000711f1bda 2 bytes [1F, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                              00000000765f1465 2 bytes [5F, 76]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                             00000000765f14bb 2 bytes [5F, 76]
.text  ...                                                                                                                                         * 2
.text  C:\Program Files (x86)\Ask.com\Updater\Updater.exe[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                            00000000765f1465 2 bytes [5F, 76]
.text  C:\Program Files (x86)\Ask.com\Updater\Updater.exe[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                           00000000765f14bb 2 bytes [5F, 76]
.text  ...                                                                                                                                         * 2
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 26                                                  000000006f3013c6 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 74                                                  000000006f3013f6 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 257                                                 000000006f3014ad 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 303                                                 000000006f3014db 2 bytes [30, 6F]
.text  ...                                                                                                                                         * 2
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 79                                                  000000006f301577 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 175                                                 000000006f3015d7 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 620                                                 000000006f301794 2 bytes [30, 6F]
.text  C:\Windows\SysWOW64\vmnat.exe[3700] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 921                                                 000000006f3018c1 2 bytes [30, 6F]
.text  C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  00000000765f1465 2 bytes [5F, 76]
.text  C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000765f14bb 2 bytes [5F, 76]
.text  ...                                                                                                                                         * 2
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                        00000000777411f5 8 bytes {JMP 0xd}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                      0000000077741390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                             000000007774143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                             000000007774158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                     000000007774191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                     0000000077741b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                    0000000077741bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                       0000000077741d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                       0000000077741eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                           0000000077741edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                          0000000077741f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                         0000000077741fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                 0000000077741fd7 8 bytes {JMP 0xb}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                             0000000077742272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                             0000000077742301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                  0000000077742792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                         00000000777427b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                       00000000777427d2 8 bytes {JMP 0x10}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                        000000007774282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                       0000000077742890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                         * 2
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                               0000000077742d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                               0000000077742d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                         * 3
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                       0000000077743023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                           000000007774323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                           00000000777433c0 16 bytes {JMP 0x4e}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                          0000000077743a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                          0000000077743ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                              0000000077743b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                              0000000077743d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                       0000000077744190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                 0000000077791380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                               0000000077791500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                     0000000077791530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                   0000000077791650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                       0000000077791700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                       0000000077791d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                     0000000077791f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                     00000000777927e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                   00000000752713cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                   000000007527146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                00000000752716d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                  00000000752716e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                             00000000752719db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                             00000000752719fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                       0000000075271a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                         0000000075271a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                       0000000075271a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Robert\Desktop\gmer.exe[2516] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                            0000000075271a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\KLIF\Parameters@LastProcessedRevision                                                                7043064

---- EOF - GMER 2.1 ----