Win 7 - nach Spieldownload und Schein-Installation Probleme und Chaos

Baba Yaga

Hallo liebe Leute,

ich habe vor ca. 2 Tagen ein Spiel aus dem Internet herunter geladen und installiert, und als der Installationsassistent fertig war, war von dem Spiel plötzlich keine Spur mehr auf meinem Rechner. Seit dem habe ich jeden Tag andere Probleme: MBAM startet, läuft aber erst wieder nach De- und Neuinstallation, MBAR startet aber läuft gar nicht mehr, mein PC erkennt meine Speichergeräte (USB etc.) nicht mehr, Avira poppt ständig auf wegen unerwünschter Funde, Firefox schließt während einer Sitzung meine zahlreichen Tabs und öffnet danach ein neues Fenster etc.

Vor dieser Anfrage habe ich folgende Selbsthilfe versucht:

1.MBAM Chameleon: Dabei ist auch nach einer Stunde vor dem PC nix passiert. (Scan...) Hab es unterbrochen.

2.Sophos Anti Rootkit: Anbei Logfile.

3.Dann bin ich der Anleitung gefolgt: Defogger, Frst64 und Gmer.



SOPHOS
Area: Local hard drives
Description: Unknown hidden file
Location: C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7600.16385_none_ed079508d36e3f2d\IMJPDCT.EXE
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)
Area: Local hard drives
Description: Unknown hidden file
Location: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0D2T6VCP\AF3EB3F137246B6F2812613D98AAF3[1].jpg
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)
Area: Local hard drives
Description: Unknown hidden file
Location: C:\Users\Besitzer\AppData\Roaming\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρϴϱЄϱЃϵϳЅ
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)
Area: Local hard drives
Description: Unknown hidden file
Location: C:\Users\Besitzer\AppData\Roaming\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρЂϻϵЉЃϵϳЅ
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)
Area: Local hard drives
Description: Unknown hidden file
Location: C:\Program Files (x86)\VLC\lua\intf\cli.luac
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

DEFOGGER
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:24 on 06/03/2015 (Besitzer)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by Besitzer (administrator) on LAVAMAT on 06-03-2015 21:43:36
Running from C:\Users\Besitzer\Downloads
Loaded Profiles: Besitzer & Administrator & (Available profiles: Besitzer & Administrator)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
() C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe
(Electronic Arts) C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\Core\EACoreServer.exe
() C:\Users\Besitzer\Downloads\Defogger.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\HP Deskjet 1050 J410 series\bin\HPScan.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-11-19] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2465088 2014-11-17] (NVIDIA Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Advanced SystemCare 7] => "C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe" /Auto
HKU\S-1-5-21-2472162299-3273411272-195361004-1000\...\MountPoints2: J - J:\LaunchU3.exe -a
HKU\S-1-5-21-2472162299-3273411272-195361004-1000\...\MountPoints2: {31c95400-84cf-11e1-8540-cae1fc6d0ade} - J:\LaunchU3.exe -a
HKU\S-1-5-21-2472162299-3273411272-195361004-1000\...\MountPoints2: {a1280058-1514-11e1-8adb-6c626d96faea} - J:\AutoRun.exe
HKU\S-1-5-21-2472162299-3273411272-195361004-1000\...\MountPoints2: {a128005d-1514-11e1-8adb-6c626d96faea} - J:\AutoRun.exe
HKU\S-1-5-21-2472162299-3273411272-195361004-1000\...\MountPoints2: {d8bd42b4-11cc-11e1-9e07-6c626d96faea} - J:\AutoRun.exe
HKU\S-1-5-21-2472162299-3273411272-195361004-1000\...\MountPoints2: {d8bd42ba-11cc-11e1-9e07-6c626d96faea} - J:\AutoRun.exe
HKU\S-1-5-21-2472162299-3273411272-195361004-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: J - J:\LaunchU3.exe -a
HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {31c95400-84cf-11e1-8540-cae1fc6d0ade} - J:\LaunchU3.exe -a
HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a1280058-1514-11e1-8adb-6c626d96faea} - J:\AutoRun.exe
HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a128005d-1514-11e1-8adb-6c626d96faea} - J:\AutoRun.exe
HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {d8bd42b4-11cc-11e1-9e07-6c626d96faea} - J:\AutoRun.exe
HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {d8bd42ba-11cc-11e1-9e07-6c626d96faea} - J:\AutoRun.exe
HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-18\...\Run: [Advanced SystemCare 7] => "C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe" /Auto
Startup: C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk -> C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2472162299-3273411272-195361004-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-2472162299-3273411272-195361004-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2472162299-3273411272-195361004-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.de/
HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.de/
HKU\S-1-5-21-2472162299-3273411272-195361004-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://dsl-start.computerbild.de/
HKU\S-1-5-21-2472162299-3273411272-195361004-500\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dsl-start.computerbild.de/
HKU\S-1-5-21-2472162299-3273411272-195361004-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://dsl-start.computerbild.de/
HKU\S-1-5-21-2472162299-3273411272-195361004-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dsl-start.computerbild.de/
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - No Name - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{45271E45-F8EE-4CF0-8150-EB4AE68EA381}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{68CBE66B-5D8F-4E63-8AA6-FB12EFDEB1FD}: [NameServer] 8.8.8.8,8.8.4.4
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default
FF Homepage: google.de
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20url.indexOf('play.google .com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2 C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20% 7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20shExpMatch( url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.s ongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7 C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url% 2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http %3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20sh ExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch( url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20' http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*'))%20%7B%20return%20'PROXY%20us11.sq.proxmate. me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000%3B%20PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq .proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY %20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIREC T'%3B%20%7D%7D"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1215155.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Windows\system32\npovshelper.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 -> C:\Program Files (x86)\VLC\npvlc.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2472162299-3273411272-195361004-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Besitzer\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKU\S-1-5-21-2472162299-3273411272-195361004-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Besitzer\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKU\S-1-5-21-2472162299-3273411272-195361004-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Besitzer\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Plugin HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @tools.google.com/Google Update;version=3 -> C:\Users\Besitzer\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @tools.google.com/Google Update;version=9 -> C:\Users\Besitzer\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Besitzer\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\searchplugins\webde-suche.xml
FF Extension: Avira Browser Safety - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\abs@avira.com [2015-02-06]
FF Extension: Blur (Formerly DoNotTrackMe) - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\donottrackplus@abine.com [2014-11-27]
FF Extension: HTTPS-Everywhere - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\https-everywhere@eff.org [2015-01-23]
FF Extension: WEB.DE MailCheck - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\toolbar@web.de [2015-03-03]
FF Extension: YouTube Unblocker - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\youtubeunblocker@unblocker.yt [2014-12-25]
FF Extension: ipFuck - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\ipfuck@p4ul.info.xpi [2013-05-20]
FF Extension: YouTube Center - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\jid1-cwbvBTE216jjpg@jetpack.xpi [2015-03-02]
FF Extension: Flash Control - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\jid1-sNL73VCI4UB0Fw@jetpack.xpi [2014-12-23]
FF Extension: Vlc Kontextmenü - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\vlcplaylist@helgatauscher.de.xpi [2014-03-26]
FF Extension: WebM Inline Player - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\webminline@player.xpi [2014-12-27]
FF Extension: Flagfox - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-03-08]
FF Extension: NoScript - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-11-15]
FF Extension: ImTranslator - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2013-11-25]
FF Extension: {c7f8df0d-8427-448d-b759-b71533baa0f8} - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\{c7f8df0d-8427-448d-b759-b71533baa0f8}.xpi [2014-12-25]
FF Extension: BetterPrivacy - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\p0li2xkm.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2015-03-04]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKU\S-1-5-21-2472162299-3273411272-195361004-1000\...\Firefox\Extensions: [{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}] - C:\Users\Besitzer\AppData\Roaming\14001.011
FF HKU\S-1-5-21-2472162299-3273411272-195361004-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Firefox\Extensions: [{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}] - C:\Users\Besitzer\AppData\Roaming\14001.011

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://google.de/"
CHR Profile: C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-10-25]
CHR Extension: (Google Drive) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-25]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-25]
CHR Extension: (YouTube) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-25]
CHR Extension: (Google Search) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-25]
CHR Extension: (DoNotTrackMe: Online Privacy Protection) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\epanfjkfahimkgomnigadpkobaefekcd [2014-10-25]
CHR Extension: (HTTPS Everywhere) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2014-10-25]
CHR Extension: (Google Wallet) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-25]
CHR Extension: (ScriptSafe) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiigbmnaadbkfbmpbfijlflahbdbdgdf [2014-10-25]
CHR Extension: (Gmail) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-25]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [pgifblbjgdjhcelbanblbhkhmbnnmhfg] - C:\Users\Besitzer\AppData\LocalLow\StumbleUpon\CHROME\StumbleUpon.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [992560 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-11-17] (NVIDIA Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-11-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19821376 2014-11-17] (NVIDIA Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31968 2012-10-08] (Wondershare)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-02-12] (Avira Operations GmbH & Co. KG)
U1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-02-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-22] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-02-12] (Avira Operations GmbH & Co. KG)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [107736 2015-03-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-06] (Malwarebytes Corporation)
S3 MEMSWEEP2; C:\Windows\system32\1366.tmp [6144 2009-06-18] (Sophos Plc) [File not signed]
R2 mi2c; C:\Windows\system32\drivers\mi2c.sys [20784 2015-03-05] (Nicomsoft Ltd.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20800 2014-11-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38216 2014-10-03] (NVIDIA Corporation)
S3 RTLE8023x64; C:\Windows\System32\DRIVERS\Rtenic64.sys [280344 2010-07-06] (Realtek Semiconductor Corporation )
U5 UnlockerDriver5; C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 BCMH43XX; system32\DRIVERS\bcmwlhigh664.sys [X]
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 NPF; system32\DRIVERS\npf.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 21:43 - 2015-03-06 21:44 - 00026245 _____ () C:\Users\Besitzer\Downloads\FRST.txt
2015-03-06 21:43 - 2015-03-06 21:43 - 00000000 ___DC () C:\FRST
2015-03-06 15:58 - 2015-03-06 19:24 - 00000478 _____ () C:\Users\Besitzer\Downloads\defogger_disable.log
2015-03-06 15:58 - 2015-03-06 15:58 - 00000000 _____ () C:\Users\Besitzer\defogger_reenable
2015-03-06 15:40 - 2015-03-06 15:40 - 00015719 _____ () C:\Users\Besitzer\Desktop\Fund Syphos.odt
2015-03-06 15:09 - 2015-03-06 15:09 - 00050477 _____ () C:\Users\Besitzer\Downloads\Defogger.exe
2015-03-06 15:08 - 2015-03-06 15:08 - 02092544 _____ (Farbar) C:\Users\Besitzer\Downloads\FRST64.exe
2015-03-06 15:08 - 2015-03-06 15:08 - 00380416 _____ () C:\Users\Besitzer\Downloads\Gmer-19357.exe
2015-03-06 14:21 - 2009-06-18 12:54 - 00006144 ____N (Sophos Plc) C:\Windows\system32\1366.tmp
2015-03-06 14:08 - 2009-06-18 12:54 - 00006144 ____N (Sophos Plc) C:\Windows\system32\2030.tmp
2015-03-06 14:06 - 2015-03-06 14:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
2015-03-06 14:06 - 2015-03-06 14:06 - 00000000 ____D () C:\Program Files (x86)\Sophos
2015-03-06 14:00 - 2015-03-06 14:00 - 00003186 _____ () C:\Windows\System32\Tasks\{906A96A5-4B4C-488D-BF30-A8AF8F8FF547}
2015-03-06 13:56 - 2015-03-06 13:56 - 00003180 _____ () C:\Windows\System32\Tasks\{DFE22B96-877E-43BA-8F3F-6AF3E3146E08}
2015-03-06 13:52 - 2015-03-06 13:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-03-06 11:04 - 2015-03-06 11:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 22:32 - 2015-03-06 10:26 - 00000224 _____ () C:\Windows\setupact.log
2015-03-05 22:32 - 2015-03-05 22:32 - 00000000 _____ () C:\Windows\setuperr.log
2015-03-05 21:35 - 2015-03-05 21:35 - 00001008 _____ () C:\Users\Besitzer\Desktop\Santa Claus in trouble ...again! - Demo.lnk
2015-03-05 21:35 - 2015-03-05 21:35 - 00001008 _____ () C:\Users\Administrator.LAVAMAT\Desktop\Santa Claus in trouble ...again! - Demo.lnk
2015-03-05 21:35 - 2015-03-05 21:35 - 00000000 ___DC () C:\Spiele)
2015-03-05 21:35 - 2015-03-05 21:35 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Santa Claus in trouble ...again! - Demo
2015-03-05 21:35 - 2015-03-05 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Santa Claus in trouble ...again! - Demo
2015-03-05 21:34 - 2015-03-05 21:34 - 00000000 ____D () C:\Users\Besitzer\Desktop\SantaIIDemo
2015-03-05 05:45 - 2015-03-05 05:49 - 00020784 _____ (Nicomsoft Ltd.) C:\Windows\system32\Drivers\mi2c.sys
2015-03-03 05:57 - 2015-03-03 06:21 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Besitzer\Downloads\mbar-1.09.1.1004.exe
2015-03-03 05:53 - 2015-03-06 15:23 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-03 05:53 - 2015-03-03 06:24 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-03 05:53 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-03 05:53 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-03 04:25 - 2015-03-03 04:25 - 00000000 ____D () C:\Users\Besitzer\Downloads\mbam-chameleon-3.1.7.0
2015-03-02 02:20 - 2015-03-02 02:20 - 00001317 _____ () C:\Users\Administrator.LAVAMAT\Desktop\Santa Claus in Trouble.lnk
2015-03-02 02:20 - 2015-03-02 02:20 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Santa Claus in Trouble
2015-03-02 02:20 - 2015-03-02 02:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Santa Claus in Trouble
2015-03-02 02:20 - 2015-03-02 02:20 - 00000000 ____D () C:\Program Files (x86)\Spiele
2015-02-28 16:57 - 2015-03-05 05:56 - 00000000 ____D () C:\Program Files (x86)\AOC-i-Menu
2015-02-28 16:57 - 2015-02-28 16:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\i-Menu
2015-02-28 16:56 - 2015-02-28 16:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Screen+
2015-02-28 16:56 - 2015-02-28 16:56 - 00000000 ____D () C:\Program Files (x86)\AOC-Screen+
2015-02-28 11:26 - 2015-02-05 18:57 - 00621384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-02-28 11:23 - 2015-02-05 22:01 - 13294528 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-02-28 11:23 - 2015-02-05 22:01 - 10773704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-02-28 11:23 - 2015-02-05 22:01 - 00995248 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-02-28 11:23 - 2015-02-05 22:01 - 00877816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 32106640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 25460880 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 24768144 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 20466496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 17253848 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 13208200 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 10713256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 10284872 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-02-28 11:22 - 2015-02-05 22:01 - 03610768 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 03247248 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 02902784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434752.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434752.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 00969872 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 00943760 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 00929936 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 00908104 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 00353224 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 00305136 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 00177624 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-02-28 11:22 - 2015-02-05 22:01 - 00164752 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-02-25 20:00 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 20:00 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-20 20:20 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-20 20:20 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-20 20:20 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-20 20:20 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-12 11:30 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 11:30 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 11:30 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 11:30 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 19:18 - 2015-02-11 19:18 - 00000000 ____D () C:\Users\Besitzer\Eigener Kram\PassionFruit Games
2015-02-11 16:14 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 16:14 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 16:14 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 16:14 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 16:14 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 16:14 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 16:13 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 16:13 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 16:13 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 16:13 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 16:13 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 16:13 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 16:13 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 16:13 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 16:13 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 16:13 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 16:13 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 16:13 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 16:13 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 16:13 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 16:13 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 16:13 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 16:13 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 16:13 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 16:13 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 16:13 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 16:13 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 16:13 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 16:13 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 16:13 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 16:13 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 16:13 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 16:13 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 16:13 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 16:13 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 16:13 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 16:13 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 16:13 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 16:13 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 16:13 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 16:13 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 16:13 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 16:13 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 16:13 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 16:13 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 16:13 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 16:13 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 16:13 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 16:13 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 16:13 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 16:13 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 16:13 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 16:13 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 16:13 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 16:13 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 16:13 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 16:13 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 16:13 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 16:13 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 16:13 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 16:12 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 16:12 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 16:12 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 16:12 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 16:12 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 16:12 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 16:12 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 16:12 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 16:12 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 16:12 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 16:12 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 16:12 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 16:12 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 16:12 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 16:12 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 16:12 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 16:12 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 16:12 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 16:12 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 16:12 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 16:12 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 16:12 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 16:12 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 16:12 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 16:12 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 16:12 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 16:12 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 16:12 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 16:12 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 16:12 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 16:12 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 16:12 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 16:12 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 16:12 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 16:12 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 16:12 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 16:12 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 16:12 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 16:11 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 16:11 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 16:11 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 16:11 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 16:11 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 16:11 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 16:11 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 16:11 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 16:11 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 16:11 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-06 21:41 - 2013-07-06 14:31 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-06 21:27 - 2014-07-01 00:33 - 01123687 _____ () C:\Windows\WindowsUpdate.log
2015-03-06 15:58 - 2011-04-01 10:03 - 00000000 ___RD () C:\Users\Besitzer
2015-03-06 15:41 - 2014-09-04 04:29 - 00000000 ____D () C:\ProgramData\Origin
2015-03-06 15:41 - 2014-09-04 04:29 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-03-06 14:21 - 2011-04-03 22:18 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-06 13:52 - 2013-07-13 01:05 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2015-03-06 13:52 - 2011-04-01 23:35 - 00000000 ____D () C:\ProgramData\Apple Computer
2015-03-06 13:42 - 2013-05-31 23:27 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-06 13:42 - 2013-04-02 19:16 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\Mp3tag
2015-03-06 13:38 - 2013-12-05 20:37 - 00000000 ___RD () C:\Users\Besitzer\Desktop\Aktuell
2015-03-06 13:21 - 2014-04-29 10:33 - 00022528 ____H () C:\Users\Besitzer\Desktop\photothumb.db
2015-03-06 13:10 - 2014-10-25 16:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-06 11:36 - 2012-03-31 20:32 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\vlc
2015-03-06 10:58 - 2009-07-14 05:45 - 00023712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-06 10:58 - 2009-07-14 05:45 - 00023712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-06 10:26 - 2011-04-01 10:01 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-03-06 10:26 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-05 21:34 - 2011-04-03 22:35 - 00000000 ___RD () C:\Spiele
2015-03-05 07:51 - 2009-07-14 18:58 - 00699456 _____ () C:\Windows\system32\perfh007.dat
2015-03-05 07:51 - 2009-07-14 18:58 - 00149596 _____ () C:\Windows\system32\perfc007.dat
2015-03-05 07:51 - 2009-07-14 06:13 - 01620784 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-04 04:56 - 2012-10-25 16:02 - 00000000 ___RD () C:\Users\Besitzer\Eigener Kram\Privates
2015-03-03 07:03 - 2011-11-29 18:17 - 00000000 ____D () C:\Windows\pss
2015-03-03 05:53 - 2014-12-25 21:30 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-03-03 01:36 - 2012-08-09 20:25 - 00000000 ___RD () C:\Users\Besitzer\Eigener Kram\Alice
2015-03-02 01:41 - 2009-07-14 06:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-02-28 11:26 - 2014-07-16 20:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-02-24 18:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-21 20:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-20 20:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-12 11:58 - 2013-12-03 02:40 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-02-12 11:58 - 2013-12-03 02:40 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-02-12 11:58 - 2013-12-03 02:40 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-02-11 20:34 - 2013-05-05 12:25 - 00408952 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-11 20:31 - 2014-12-10 07:44 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-11 20:31 - 2014-04-30 15:05 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-11 20:11 - 2013-08-15 02:35 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 20:03 - 2011-11-21 00:56 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 19:18 - 2012-04-26 23:02 - 00000000 ___RD () C:\Users\Besitzer\Eigener Kram
2015-02-06 17:41 - 2013-07-06 14:31 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-06 17:41 - 2012-04-01 14:01 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-06 17:41 - 2011-11-20 22:39 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 22:01 - 2015-01-23 02:09 - 18575880 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-02-05 22:01 - 2014-07-16 20:17 - 14119744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-02-05 22:01 - 2014-07-16 20:17 - 03299512 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-02-05 22:01 - 2013-11-19 16:33 - 16017040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-02-05 22:01 - 2011-10-21 18:56 - 00027441 _____ () C:\Windows\system32\nvinfo.pb
2015-02-05 20:07 - 2010-10-16 12:13 - 06861128 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-02-05 20:07 - 2010-10-16 12:13 - 03517584 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-02-05 20:07 - 2010-10-16 12:13 - 02558792 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-02-05 20:07 - 2010-10-16 12:13 - 00935056 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-02-05 20:07 - 2010-07-09 15:17 - 00062792 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-02-05 20:06 - 2010-10-16 12:13 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-02-05 13:50 - 2012-05-11 23:08 - 04236870 _____ () C:\Windows\system32\nvcoproc.bin

==================== Files in the root of some directories =======

2012-08-05 23:14 - 2012-08-08 16:48 - 0000048 _____ () C:\Users\Besitzer\AppData\Roaming\AcroIEHelpe.txt
2012-08-09 02:18 - 2012-08-09 05:20 - 0000017 _____ () C:\Users\Besitzer\AppData\Roaming\blckdom.res
2013-06-10 21:20 - 2013-06-10 21:20 - 0000046 _____ () C:\Users\Besitzer\AppData\Roaming\Camdata.ini
2013-06-10 21:20 - 2013-06-10 21:20 - 0000408 _____ () C:\Users\Besitzer\AppData\Roaming\CamLayout.ini
2013-06-10 21:20 - 2013-06-10 21:20 - 0000408 _____ () C:\Users\Besitzer\AppData\Roaming\CamShapes.ini
2013-06-10 21:19 - 2013-06-10 21:20 - 0004510 _____ () C:\Users\Besitzer\AppData\Roaming\CamStudio.cfg
2011-04-01 23:17 - 2011-11-20 15:42 - 0000146 _____ () C:\Users\Besitzer\AppData\Roaming\default.rss
2011-04-07 00:03 - 2011-04-07 00:03 - 0000000 _____ () C:\Users\Besitzer\AppData\Roaming\downloads.m3u
2014-08-30 05:17 - 2014-08-30 05:22 - 0000826 _____ () C:\Users\Besitzer\AppData\Roaming\LiveSupport.exe_log.txt
2014-08-30 05:17 - 2014-08-30 05:22 - 0000092 _____ () C:\Users\Besitzer\AppData\Roaming\regsvr32.exe_log.txt
2012-08-05 23:14 - 2012-08-05 23:14 - 0000264 _____ () C:\Users\Besitzer\AppData\Roaming\srvblck5.tmp
2011-04-02 01:47 - 2011-04-02 01:47 - 0033134 _____ () C:\Users\Besitzer\AppData\Roaming\UserTile.png
2013-12-19 02:46 - 2013-12-19 02:46 - 0005632 _____ () C:\Users\Besitzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-12-01 22:01 - 2013-12-01 22:01 - 0000057 _____ () C:\ProgramData\Ament.ini

Some content of TEMP:
====================
C:\Users\Besitzer\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-06 17:17

==================== End Of Log ============================

GMER
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-03-06 21:59:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005d ST350041 rev.CC46 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Besitzer\AppData\Local\Temp\awrdapow.sys


---- User code sections - GMER 2.1 ----

.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\kernel32.dll!CreateFileW 0000000075e63f1c 5 bytes JMP 0000000157518c00
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000767a8e4e 5 bytes JMP 00000001575180f0
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\USER32.dll!ShowWindow 00000000767b0dfb 5 bytes JMP 0000000157517ed0
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\USER32.dll!SetFocus 00000000767b2175 5 bytes JMP 0000000157517fe0
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\USER32.dll!SetActiveWindow 00000000767b3208 5 bytes JMP 0000000157518200
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\USER32.dll!BringWindowToTop 00000000767b7b3b 5 bytes JMP 0000000157517c00
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000767cf170 5 bytes JMP 0000000157517af0
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\USER32.dll!SwitchToThisWindow 00000000767e90fc 5 bytes JMP 0000000157517d10
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\USER32.dll!ShowWindowAsync 0000000076807d97 5 bytes JMP 0000000157517dc0
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\ole32.dll!DoDragDrop 000000007606a827 5 bytes JMP 0000000157517a00
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077121401 2 bytes JMP 75e8b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077121419 2 bytes JMP 75e8b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077121431 2 bytes JMP 75f08ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007712144a 2 bytes CALL 75e648ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771214dd 2 bytes JMP 75f087a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771214f5 2 bytes JMP 75f08978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007712150d 2 bytes JMP 75f08698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077121525 2 bytes JMP 75f08a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007712153d 2 bytes JMP 75e7fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077121555 2 bytes JMP 75e868ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007712156d 2 bytes JMP 75f08f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077121585 2 bytes JMP 75f08ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007712159d 2 bytes JMP 75f0865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771215b5 2 bytes JMP 75e7fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771215cd 2 bytes JMP 75e8b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771216b2 2 bytes JMP 75f08e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin\Origin.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771216bd 2 bytes JMP 75f085f1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077121401 2 bytes JMP 75e8b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077121419 2 bytes JMP 75e8b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077121431 2 bytes JMP 75f08ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007712144a 2 bytes CALL 75e648ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771214dd 2 bytes JMP 75f087a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771214f5 2 bytes JMP 75f08978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007712150d 2 bytes JMP 75f08698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077121525 2 bytes JMP 75f08a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007712153d 2 bytes JMP 75e7fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077121555 2 bytes JMP 75e868ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007712156d 2 bytes JMP 75f08f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077121585 2 bytes JMP 75f08ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007712159d 2 bytes JMP 75f0865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771215b5 2 bytes JMP 75e7fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771215cd 2 bytes JMP 75e8b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771216b2 2 bytes JMP 75f08e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Origin Games\Plants vs. Zombies\Plants vs. Zombies DE\PlantsVsZombies.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771216bd 2 bytes JMP 75f085f1 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077121401 2 bytes JMP 75e8b21b C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077121419 2 bytes JMP 75e8b346 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077121431 2 bytes JMP 75f08ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007712144a 2 bytes CALL 75e648ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771214dd 2 bytes JMP 75f087a2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771214f5 2 bytes JMP 75f08978 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007712150d 2 bytes JMP 75f08698 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077121525 2 bytes JMP 75f08a62 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007712153d 2 bytes JMP 75e7fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077121555 2 bytes JMP 75e868ef C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007712156d 2 bytes JMP 75f08f61 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077121585 2 bytes JMP 75f08ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007712159d 2 bytes JMP 75f0865c C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771215b5 2 bytes JMP 75e7fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771215cd 2 bytes JMP 75e8b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771216b2 2 bytes JMP 75f08e24 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Besitzer\Downloads\Defogger.exe[4224] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771216bd 2 bytes JMP 75f085f1 C:\Windows\syswow64\kernel32.dll

---- EOF - GMER 2.1 ----