"Polizei" Trojaner und/oder wigon.ph trojan bzw. Injector.AZOJ trojan

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 21.04.2014
Scan Time: 10:50:15
Logfile: malware log.txt
Administrator: No

Version: 2.00.1.1004
Malware Database: v2014.04.21.01
Rootkit Database: v2014.03.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: I.M

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 254834
Time Elapsed: 14 min, 58 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 2
Trojan.Crypt.NKN, C:\Users\I.M\AppData\Local\Temp\Low\bnd.dll, , [1fd6b676ea9105315182263ba06138c8], 
Trojan.Crypt.NKN, C:\Users\I.M\AppData\Local\Temp\Low\yupyr.dll, , [fff6dd4f69124fe7a42c94b7679aad53], 

Physical Sectors: 0
(No malicious items detected)


(end)
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2014 02
Ran by I.M (administrator) on IM-PC on 21-04-2014 10:38:47
Running from C:\Users\I.M\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe
() C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\REALTEK\Realtek Bluetooth\RtkBleServ.exe
(StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(BlackBerry Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe
() C:\Program Files (x86)\REALTEK\Realtek Bluetooth\SkypePlugin.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(BlackBerry Limited) C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_12_0_0_44_ActiveX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13538376 2013-05-21] (Realtek Semiconductor)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [253440 2013-04-23] (Realtek Semiconductor Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-21] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1179576 2014-01-21] (NVIDIA Corporation)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5618456 2013-09-12] (ESET)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2014-01-21] (BlackBerry Limited)
HKLM-x32\...\Run: [RIM PeerManager] => C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [4484608 2014-01-22] (Research In Motion Limited)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-380536522-1895783427-2845753458-1000\...\Run: [AlcoholAutomount] => C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)
HKU\S-1-5-21-380536522-1895783427-2845753458-1000\...\MountPoints2: {196721c0-9631-11e3-acf5-806e6f6e6963} - E:\setup.exe
HKU\S-1-5-21-380536522-1895783427-2845753458-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AlcoholAutomount] => C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)
HKU\S-1-5-21-380536522-1895783427-2845753458-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {196721c0-9631-11e3-acf5-806e6f6e6963} - E:\setup.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-19] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-12-19] (NVIDIA Corporation)
Startup: C:\Users\I.M\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rjsj638q.lnk
ShortcutTarget: rjsj638q.lnk -> C:\PROGRA~3\299219~1\q836jsjr.cpp (No File)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA44D2D71342ACF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

FireFox:
========
FF ProfilePath: C:\Users\I.M\AppData\Roaming\Mozilla\Firefox\Profiles\b7q4indg.default
FF Homepage: https://www.google.at/
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2014-02-15]

==================== Services (Whitelisted) =================

R2 AvrcpService; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe [35328 2013-04-02] (Realtek Semiconductor Corporation)
S2 AxAutoMntSrv; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)
R3 BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2014-01-21] (BlackBerry Limited)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [47104 2013-04-25] ()
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1337752 2013-09-12] (ESET)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-02-15] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-21] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-21] (NVIDIA Corporation)
R2 RIM MDNS; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [389632 2014-01-22] (Apple Inc.)
R2 RIM Tunnel Service; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [1309696 2014-01-22] (Research In Motion Limited)
R2 RtkBleServ; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\RtkBleServ.exe [42496 2013-04-25] (Realtek Semiconductor Corporation)
S2 Winmgmt; C:\ProgramData\2992199F9A\jncfn.faa [332020 2014-04-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310728 2014-03-23] ()
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [157432 2013-09-17] (ESET)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [118504 2012-12-19] (Qualcomm Atheros Co., Ltd.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2014-03-22] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-21] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [79872 2013-12-02] (BlackBerry Limited)
R3 rimvndis; C:\Windows\System32\Drivers\rimvndis6_AMD64.sys [17920 2014-01-22] (Research in Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
R3 RtkBtFilter; C:\Windows\System32\DRIVERS\RtkBtfilter.sys [535624 2013-03-28] (Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [1460808 2013-05-02] (Realtek Semiconductor Corporation                           )
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2014-02-15] (Duplex Secure Ltd.)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2009-07-14] (Microsoft Corporation)
U3 a36ev4b0; C:\Windows\System32\Drivers\a36ev4b0.sys [0 ] (Advanced Micro Devices)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-21 10:38 - 2014-04-21 10:38 - 02056704 _____ (Farbar) C:\Users\I.M\Desktop\FRST64.exe
2014-04-21 10:38 - 2014-04-21 10:38 - 00013793 _____ () C:\Users\I.M\Desktop\FRST.txt
2014-04-21 10:38 - 2014-04-21 10:38 - 00000000 ____D () C:\FRST
2014-04-21 03:01 - 2014-04-21 03:01 - 00000154 _____ () C:\Users\I.M\Documents\trojan.txt
2014-04-21 01:52 - 2014-04-21 10:19 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-21 01:52 - 2014-04-21 01:52 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-21 01:52 - 2014-04-21 01:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-21 01:52 - 2014-04-21 01:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-21 01:52 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-21 01:52 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-21 01:52 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-21 01:14 - 2014-04-21 01:58 - 00000000 ____D () C:\ProgramData\2992199F9A
2014-04-20 19:40 - 2014-04-20 19:40 - 00000000 ____D () C:\Users\I.M\Downloads\Scooby.Doo.Der.Film.German.AC3.xxx4-FuN
2014-04-20 18:44 - 2014-04-20 18:44 - 00000000 ____D () C:\Users\I.M\Downloads\Scooby.Doo.2.Die.Monster.sind.los.German.xxx.xxx4-FuN
2014-04-15 20:38 - 2014-04-15 20:39 - 00000000 ___RD () C:\Users\I.M\Google Drive
2014-04-15 20:38 - 2014-04-15 20:38 - 00001708 _____ () C:\Users\I.M\Desktop\Google Drive.lnk
2014-04-15 20:37 - 2014-04-15 20:37 - 00002042 _____ () C:\Users\Public\Desktop\Google Slides.lnk
2014-04-15 20:37 - 2014-04-15 20:37 - 00002040 _____ () C:\Users\Public\Desktop\Google Sheets.lnk
2014-04-15 20:37 - 2014-04-15 20:37 - 00002030 _____ () C:\Users\Public\Desktop\Google Docs.lnk
2014-04-15 20:36 - 2014-04-21 10:19 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-15 20:36 - 2014-04-21 02:43 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-15 20:36 - 2014-04-15 20:37 - 00000000 ____D () C:\Users\I.M\AppData\Local\Google
2014-04-15 20:36 - 2014-04-15 20:37 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-15 20:36 - 2014-04-15 20:36 - 00004100 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-15 20:36 - 2014-04-15 20:36 - 00003848 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-15 19:34 - 2014-04-15 19:53 - 00000000 ___RD () C:\Users\I.M\Dropbox
2014-04-15 19:34 - 2014-04-15 19:34 - 00001034 _____ () C:\Users\I.M\Desktop\Dropbox.lnk
2014-04-15 19:33 - 2014-04-15 19:34 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\DropboxMaster
2014-04-15 19:33 - 2014-04-15 19:33 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-15 19:32 - 2014-04-15 20:32 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\Dropbox
2014-04-15 07:10 - 2014-04-15 07:10 - 00000000 ____D () C:\Users\I.M\Downloads\Gam.of.Thrones.S04E02.Ger.Sub.108p.HDTV.DD5.1.x264-E
2014-04-13 19:02 - 2014-04-13 19:02 - 00000000 ____D () C:\Users\I.M\Downloads\SWTCWP.U3
2014-04-11 20:10 - 2014-04-11 20:10 - 00000000 ____D () C:\Users\I.M\Downloads\SDudMvMG20DDXLSE
2014-04-08 19:12 - 2014-04-08 19:22 - 684980244 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e10.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 19:03 - 2014-04-08 19:19 - 579852308 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e09.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 19:02 - 2014-04-08 19:15 - 580460564 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e08.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:59 - 2014-04-08 19:12 - 581136404 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e07.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:45 - 2014-04-08 19:03 - 580249620 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e04.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:45 - 2014-04-08 19:02 - 580476948 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e05.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:45 - 2014-04-08 18:59 - 580130836 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e06.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:29 - 2014-04-08 18:45 - 580825108 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e02.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:29 - 2014-04-08 18:45 - 580673556 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e03.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:29 - 2014-04-08 18:45 - 580417556 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e01.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-07 19:24 - 2014-04-07 19:24 - 00002172 _____ () C:\Users\I.M\Desktop\Subtitle Workshop.lnk
2014-04-07 19:24 - 2014-04-07 19:24 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\URUSoft
2014-04-07 19:24 - 2014-04-07 19:24 - 00000000 ____D () C:\Program Files (x86)\URUSoft
2014-04-07 19:12 - 2014-04-07 19:12 - 00000000 ____D () C:\Users\I.M\Downloads\EN.GOT.SD.401
2014-04-03 17:38 - 2014-04-03 17:38 - 00031232 _____ () C:\Users\I.M\Downloads\müll.xls
2014-03-30 21:49 - 2014-03-30 21:49 - 00001219 _____ () C:\Users\Public\Desktop\Total War Rome II - Hannibal at the Gates.lnk
2014-03-30 21:20 - 2014-03-30 21:45 - 00000000 ____D () C:\Program Files (x86)\Total War Rome II - Hannibal at the Gates
2014-03-30 20:25 - 2014-03-30 20:25 - 00000000 ____D () C:\Users\I.M\Downloads\TW1arRo7meIIHann6ibalatG1.11.0.0-elamigos
2014-03-27 19:24 - 2014-03-29 23:58 - 00000000 ____D () C:\Users\I.M\AppData\Local\Harebrained Schemes
2014-03-27 19:24 - 2014-03-27 19:24 - 00000000 ____D () C:\Users\I.M\Documents\Shadowrun Returns
2014-03-27 18:30 - 2014-03-27 18:30 - 00000000 ____D () C:\Users\I.M\Downloads\K1NG-4N5CHL4G
2014-03-23 21:43 - 2014-03-23 21:53 - 00000000 ____D () C:\Users\I.M\Downloads\Castle_of_Glass_-_EP
2014-03-22 23:50 - 2014-03-23 00:05 - 00310728 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-03-22 23:50 - 2014-03-22 23:50 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-03-22 23:34 - 2014-03-22 23:34 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\NVIDIA
2014-03-22 10:43 - 2014-03-22 10:43 - 00000000 ____D () C:\Users\I.M\AppData\Local\My Games
2014-03-22 10:34 - 2014-04-19 19:50 - 00000000 ____D () C:\Program Files (x86)\2K Games
2014-03-22 00:40 - 2014-03-22 00:40 - 00000000 ____D () C:\Users\I.M\Downloads\ronin

==================== One Month Modified Files and Folders =======

2014-04-21 10:38 - 2014-04-21 10:38 - 02056704 _____ (Farbar) C:\Users\I.M\Desktop\FRST64.exe
2014-04-21 10:38 - 2014-04-21 10:38 - 00013793 _____ () C:\Users\I.M\Desktop\FRST.txt
2014-04-21 10:38 - 2014-04-21 10:38 - 00000000 ____D () C:\FRST
2014-04-21 10:26 - 2009-07-14 06:45 - 00021088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-21 10:26 - 2009-07-14 06:45 - 00021088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-21 10:20 - 2014-02-15 12:18 - 00083020 _____ () C:\Users\I.M\AppData\Local\BTServer.log
2014-04-21 10:19 - 2014-04-21 01:52 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-21 10:19 - 2014-04-15 20:36 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-21 10:19 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-21 10:19 - 2009-07-14 06:51 - 00043320 _____ () C:\Windows\setupact.log
2014-04-21 10:18 - 2010-11-21 05:47 - 00017076 _____ () C:\Windows\PFRO.log
2014-04-21 10:18 - 2009-07-14 07:37 - 00000000 ____D () C:\Windows\DigitalLocker
2014-04-21 03:01 - 2014-04-21 03:01 - 00000154 _____ () C:\Users\I.M\Documents\trojan.txt
2014-04-21 02:56 - 2014-02-15 11:06 - 01802051 _____ () C:\Windows\WindowsUpdate.log
2014-04-21 02:43 - 2014-04-15 20:36 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-21 02:12 - 2014-02-15 14:01 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-04-21 02:04 - 2014-02-22 19:25 - 00000000 ____D () C:\Windows\pss
2014-04-21 02:04 - 2014-02-15 11:23 - 00000000 ___RD () C:\Users\I.M\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-21 01:58 - 2014-04-21 01:14 - 00000000 ____D () C:\ProgramData\2992199F9A
2014-04-21 01:58 - 2014-02-15 11:28 - 604586655 _____ () C:\Windows\MEMORY.DMP
2014-04-21 01:58 - 2014-02-15 11:28 - 00000000 ____D () C:\Windows\Minidump
2014-04-21 01:52 - 2014-04-21 01:52 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-21 01:52 - 2014-04-21 01:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-21 01:52 - 2014-04-21 01:52 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-20 19:44 - 2011-04-12 09:43 - 00696370 _____ () C:\Windows\system32\perfh007.dat
2014-04-20 19:44 - 2011-04-12 09:43 - 00147634 _____ () C:\Windows\system32\perfc007.dat
2014-04-20 19:44 - 2009-07-14 07:13 - 01611160 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-20 19:40 - 2014-04-20 19:40 - 00000000 ____D () C:\Users\I.M\Downloads\Scooby.Doo.Der.Film.German.AC3.xxx4-FuN
2014-04-20 18:44 - 2014-04-20 18:44 - 00000000 ____D () C:\Users\I.M\Downloads\Scooby.Doo.2.Die.Monster.sind.los.German.xxx.xxx4-FuN
2014-04-20 18:09 - 2014-02-18 19:02 - 00000000 ____D () C:\w102
2014-04-19 19:57 - 2014-02-15 11:48 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-19 19:50 - 2014-03-22 10:34 - 00000000 ____D () C:\Program Files (x86)\2K Games
2014-04-15 20:39 - 2014-04-15 20:38 - 00000000 ___RD () C:\Users\I.M\Google Drive
2014-04-15 20:38 - 2014-04-15 20:38 - 00001708 _____ () C:\Users\I.M\Desktop\Google Drive.lnk
2014-04-15 20:38 - 2014-02-15 11:22 - 00000000 ____D () C:\Users\I.M
2014-04-15 20:37 - 2014-04-15 20:37 - 00002042 _____ () C:\Users\Public\Desktop\Google Slides.lnk
2014-04-15 20:37 - 2014-04-15 20:37 - 00002040 _____ () C:\Users\Public\Desktop\Google Sheets.lnk
2014-04-15 20:37 - 2014-04-15 20:37 - 00002030 _____ () C:\Users\Public\Desktop\Google Docs.lnk
2014-04-15 20:37 - 2014-04-15 20:36 - 00000000 ____D () C:\Users\I.M\AppData\Local\Google
2014-04-15 20:37 - 2014-04-15 20:36 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-15 20:36 - 2014-04-15 20:36 - 00004100 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-15 20:36 - 2014-04-15 20:36 - 00003848 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-15 20:32 - 2014-04-15 19:32 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\Dropbox
2014-04-15 19:53 - 2014-04-15 19:34 - 00000000 ___RD () C:\Users\I.M\Dropbox
2014-04-15 19:34 - 2014-04-15 19:34 - 00001034 _____ () C:\Users\I.M\Desktop\Dropbox.lnk
2014-04-15 19:34 - 2014-04-15 19:33 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\DropboxMaster
2014-04-15 19:33 - 2014-04-15 19:33 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-15 19:06 - 2014-02-16 22:31 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\vlc
2014-04-15 07:10 - 2014-04-15 07:10 - 00000000 ____D () C:\Users\I.M\Downloads\Gam.of.Thrones.S04E02.Ger.Sub.108p.HDTV.DD5.1.x264-E
2014-04-13 19:02 - 2014-04-13 19:02 - 00000000 ____D () C:\Users\I.M\Downloads\SWTCWP.U3
2014-04-11 20:10 - 2014-04-11 20:10 - 00000000 ____D () C:\Users\I.M\Downloads\SDudMvMG20DDXLSE
2014-04-08 19:22 - 2014-04-08 19:12 - 684980244 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e10.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 19:19 - 2014-04-08 19:03 - 579852308 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e09.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 19:15 - 2014-04-08 19:02 - 580460564 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e08.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 19:12 - 2014-04-08 18:59 - 581136404 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e07.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 19:03 - 2014-04-08 18:45 - 580249620 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e04.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 19:02 - 2014-04-08 18:45 - 580476948 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e05.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:59 - 2014-04-08 18:45 - 580130836 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e06.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:45 - 2014-04-08 18:29 - 580825108 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e02.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:45 - 2014-04-08 18:29 - 580673556 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e03.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-08 18:45 - 2014-04-08 18:29 - 580417556 _____ () C:\Users\I.M\Downloads\Gam.of.Thros.s03e01.Ger.A3.BRiP.XviD-FIJ.avi
2014-04-07 19:24 - 2014-04-07 19:24 - 00002172 _____ () C:\Users\I.M\Desktop\Subtitle Workshop.lnk
2014-04-07 19:24 - 2014-04-07 19:24 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\URUSoft
2014-04-07 19:24 - 2014-04-07 19:24 - 00000000 ____D () C:\Program Files (x86)\URUSoft
2014-04-07 19:12 - 2014-04-07 19:12 - 00000000 ____D () C:\Users\I.M\Downloads\EN.GOT.SD.401
2014-04-04 19:05 - 2014-02-15 12:16 - 00000000 ____D () C:\ProgramData\Realtek
2014-04-04 19:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-03 17:38 - 2014-04-03 17:38 - 00031232 _____ () C:\Users\I.M\Downloads\müll.xls
2014-04-03 09:51 - 2014-04-21 01:52 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-21 01:52 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-21 01:52 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-30 22:35 - 2014-02-15 14:13 - 00000565 _____ () C:\Users\I.M\Documents\ax_files.xml
2014-03-30 21:49 - 2014-03-30 21:49 - 00001219 _____ () C:\Users\Public\Desktop\Total War Rome II - Hannibal at the Gates.lnk
2014-03-30 21:45 - 2014-03-30 21:20 - 00000000 ____D () C:\Program Files (x86)\Total War Rome II - Hannibal at the Gates
2014-03-30 20:25 - 2014-03-30 20:25 - 00000000 ____D () C:\Users\I.M\Downloads\TW1arRo7meIIHann6ibalatG1.11.0.0-elamigos
2014-03-30 11:40 - 2014-03-17 21:45 - 00000385 _____ () C:\Users\I.M\AppData\Roaming\Rim.DesktopHelper.Exception.log
2014-03-30 11:40 - 2014-03-17 21:45 - 00000385 _____ () C:\Users\I.M\AppData\Roaming\Rim.Desktop.Exception.log
2014-03-30 10:39 - 2014-03-17 20:39 - 00000000 ____D () C:\Users\I.M\AppData\Local\Research In Motion
2014-03-29 23:58 - 2014-03-27 19:24 - 00000000 ____D () C:\Users\I.M\AppData\Local\Harebrained Schemes
2014-03-27 19:24 - 2014-03-27 19:24 - 00000000 ____D () C:\Users\I.M\Documents\Shadowrun Returns
2014-03-27 18:30 - 2014-03-27 18:30 - 00000000 ____D () C:\Users\I.M\Downloads\K1NG-4N5CHL4G
2014-03-23 21:53 - 2014-03-23 21:43 - 00000000 ____D () C:\Users\I.M\Downloads\Castle_of_Glass_-_EP
2014-03-23 21:03 - 2014-02-15 12:48 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-03-23 00:05 - 2014-03-22 23:50 - 00310728 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-03-22 23:50 - 2014-03-22 23:50 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-03-22 23:50 - 2014-02-21 23:10 - 00178858 _____ () C:\Windows\DirectX.log
2014-03-22 23:34 - 2014-03-22 23:34 - 00000000 ____D () C:\Users\I.M\AppData\Roaming\NVIDIA
2014-03-22 10:43 - 2014-03-22 10:43 - 00000000 ____D () C:\Users\I.M\AppData\Local\My Games
2014-03-22 10:43 - 2014-02-22 14:00 - 00000000 ____D () C:\Users\I.M\Documents\My Games
2014-03-22 04:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-03-22 00:40 - 2014-03-22 00:40 - 00000000 ____D () C:\Users\I.M\Downloads\ronin

Some content of TEMP:
====================
C:\Users\I.M\AppData\Local\Temp\BlackBerryDeviceManager.exe
C:\Users\I.M\AppData\Local\Temp\BlackBerryLauncher.exe
C:\Users\I.M\AppData\Local\Temp\drm_dialogs.dll
C:\Users\I.M\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpsj63cu.dll
C:\Users\I.M\AppData\Local\Temp\ubi7196.tmp.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-20 20:22

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-04-2014 02
Ran by I.M at 2014-04-21 10:39:01
Running from C:\Users\I.M\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================


==================== Installed Programs ======================

Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
BlackBerry Desktop Software 7.1 (HKLM-x32\...\BlackBerry_Desktop) (Version: 7.1.0.41 - Research in Motion Ltd.)
BlackBerry Desktop Software 7.1 (x32 Version: 7.1.0.41 - Research in Motion Ltd.) Hidden
BlackBerry Link (HKLM-x32\...\BlackBerry_10_Desktop) (Version: 1.2.3.23 - BlackBerry Ltd.)
BlackBerry Link (x32 Version: 1.2.3.23 - BlackBerry Ltd.) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.6.29 - Dropbox, Inc.)
ESET Antivirus License Finder (MiNODLogin) (HKLM-x32\...\MiNODLogin) (Version: 4.0.2.66 - GuillerSoft)
ESET NOD32 Antivirus (HKLM\...\{89B0ECE0-A41F-4A45-98D9-D54C74338117}) (Version: 7.0.302.26 - ESET, spol s r. o.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Fable III (x32 Version: 1.0.0001.131 - Microsoft Game Studios) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Drive (HKLM-x32\...\{84B981C8-D6E4-473F-8062-63F14F44183E}) (Version: 1.15.6464.228 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1310 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3186 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.757.1 - Intel Corporation) Hidden
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE (HKLM-x32\...\{B45FABE7-D101-4D99-A671-E16DA40AF7F0}) (Version: 3.0.86.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{B578C85A-A84C-4230-A177-C5B2AF565B8C}) (Version: 3.0.17.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
NVIDIA GeForce Experience 1.8.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 332.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.21 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden
NVIDIA Update 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
Qualcomm Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.13 - Qualcomm Atheros Communications Inc.)
Rainmeter (HKLM-x32\...\Rainmeter) (Version: 3.0.2 r2161 - )
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.728.728.042813 - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6914 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30127 - Realtek Semiconductor Corp.)
Red Light Center 3D Client (HKLM-x32\...\Red Light Center 3D Client) (Version: 1.9.4745 - Utherverse Digital Inc)
SHIELD Streaming (Version: 1.7.306 - NVIDIA Corporation) Hidden
Subtitle Workshop 2.51 (HKLM-x32\...\SubtitleWorkshop) (Version:  - )
Total War Rome II - Hannibal at the Gates Version 1.11.0.0 (HKLM-x32\...\Total War Rome II - Hannibal at the Gates_is1) (Version: 1.11.0.0 - SEGA)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WinRAR 5.00 beta 2 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.2 - win.rar GmbH)

==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1FFE8E28-1D2B-4DCF-95F3-5B9BAE004B24} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-15] (Google Inc.)
Task: {B3A309D4-C432-4F97-B75C-B24A12C99FDF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-15] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-02-15 12:26 - 2013-12-19 20:53 - 00117536 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-02-15 12:16 - 2013-04-25 17:32 - 00047104 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2014-02-15 12:16 - 2013-04-09 15:42 - 00265728 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\SkypePlugin.exe
2014-02-15 12:21 - 2013-02-15 17:15 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^Users^I.M^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^jncfn.lnk => C:\Windows\pss\jncfn.lnk.Startup

==================== Faulty Device Manager Devices =============

Could not list Devices. Check "winmgmt" service or repair WMI.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/21/2014 10:44:32 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.3221, Zeitstempel: 0x52b3378d
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7c8f9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000004e4b4
ID des fehlerhaften Prozesses: 0xd54
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3

Error: (04/21/2014 02:12:28 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/21/2014 02:12:25 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/20/2014 05:25:47 PM) (Source: RIM MDNS) (User: )
Description: 728: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (04/20/2014 05:25:47 PM) (Source: RIM MDNS) (User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053

Error: (04/20/2014 05:25:47 PM) (Source: RIM MDNS) (User: )
Description: 732: DNSServiceGetAddrInfo      v4v6 BLACKBERRY-56AA.local.

Error: (04/20/2014 05:25:47 PM) (Source: RIM MDNS) (User: )
Description: 732: Could not write data to client because of error - aborting connection

Error: (04/20/2014 05:25:47 PM) (Source: RIM MDNS) (User: )
Description: send_msg ERROR: failed to write 89 of 89 bytes to fd 732 errno 10053 (Eine bestehende Verbindung wurde softwaregesteuert
durch den Hostcomputer abgebrochen.)

Error: (04/20/2014 10:22:51 AM) (Source: RIM MDNS) (User: )
Description: 368: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (04/20/2014 10:22:51 AM) (Source: RIM MDNS) (User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053


System errors:
=============
Error: (04/21/2014 10:48:24 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (04/21/2014 10:47:59 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%127

Error: (04/21/2014 10:47:38 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (04/21/2014 10:47:29 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%127

Error: (04/21/2014 10:47:23 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (04/21/2014 10:47:06 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (04/21/2014 10:46:59 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%127

Error: (04/21/2014 10:46:36 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (04/21/2014 10:46:29 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: 
%%127

Error: (04/21/2014 10:46:04 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.


Microsoft Office Sessions:
=========================
Error: (04/21/2014 10:44:32 AM) (Source: Application Error)(User: )
Description: nvtray.exe7.17.13.322152b3378dntdll.dll6.1.7601.175144ce7c8f9c0000005000000000004e4b4d5401cf5d3a73e39dc3C:\Program Files\NVIDIA Corporation\Display\nvtray.exeC:\Windows\SYSTEM32\ntdll.dll286a745d-c931-11e3-9eb9-240a64f9fc7a

Error: (04/21/2014 02:12:28 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\I.M\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\732F08LK\esetsmartinstaller_enu[1].exe

Error: (04/21/2014 02:12:25 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\I.M\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\732F08LK\esetsmartinstaller_enu[1].exe

Error: (04/20/2014 05:25:47 PM) (Source: RIM MDNS)(User: )
Description: 728: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (04/20/2014 05:25:47 PM) (Source: RIM MDNS)(User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053

Error: (04/20/2014 05:25:47 PM) (Source: RIM MDNS)(User: )
Description: 732: DNSServiceGetAddrInfo      v4v6 BLACKBERRY-56AA.local.

Error: (04/20/2014 05:25:47 PM) (Source: RIM MDNS)(User: )
Description: 732: Could not write data to client because of error - aborting connection

Error: (04/20/2014 05:25:47 PM) (Source: RIM MDNS)(User: )
Description: send_msg ERROR: failed to write 89 of 89 bytes to fd 732 errno 10053 (Eine bestehende Verbindung wurde softwaregesteuert
durch den Hostcomputer abgebrochen.)

Error: (04/20/2014 10:22:51 AM) (Source: RIM MDNS)(User: )
Description: 368: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (04/20/2014 10:22:51 AM) (Source: RIM MDNS)(User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053


==================== Memory info =========================== 

Percentage of memory in use: 29%
Total physical RAM: 8113.18 MB
Available physical RAM: 5723.02 MB
Total Pagefile: 16224.57 MB
Available Pagefile: 13564.74 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:696.77 GB) (Free:543.33 GB) NTFS
Drive e: (Rome II) (CDROM) (Total:15.78 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 786ABEB3)
Partition 1: (Active) - (Size=2 GB) - (Type=0B)
Partition 2: (Not Active) - (Size=697 GB) - (Type=07 NTFS)

==================== End Of Log ============================