Ok, das hat alles geklappt. Allerdings hatte ich beim Starten von FRST und auch bei Neustart und Erstellen der Log-Datei für JRT wieder .dll-Fehler, jedoch hatten diese keine Auswirkungen.
MBAM: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 02.01.2015
Suchlauf-Zeit: 18:26:09
Logdatei: MBAM2.txt
Administrator: Ja
Version: 2.00.4.1028
Malware Datenbank: v2015.01.02.06
Rootkit Datenbank: v2014.12.30.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Tyr
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 349140
Verstrichene Zeit: 13 Min, 31 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(Keine schädliche Elemente erkannt)
Module: 0
(Keine schädliche Elemente erkannt)
Registrierungsschlüssel: 7
PUP.Optional.Koyote.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Free FLV Converter_is1, In Quarantäne, [4955c52dcabf82b4fd1b5f01fe03a65a],
PUP.Optional.SupraSavings, HKLM\SOFTWARE\suprasavings, In Quarantäne, [abf31ed4a0e9a39360196b1142c131cf],
PUP.Optional.Babylon.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dhkplhfnhceodhffomolpfigojocbpcb, In Quarantäne, [841a16dc8aff41f55cf79a4292724fb1],
PUP.Optional.1ClickDownload.A, HKU\S-1-5-21-2317310838-2281009756-1505973531-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\1ClickDownload, In Quarantäne, [435b8d658efb16202f29536af50f60a0],
PUP.Optional.PriceMeter.A, HKU\S-1-5-21-2317310838-2281009756-1505973531-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\PriceMeterLiveUpdate, In Quarantäne, [58465c96ff8a6fc7444ed78b788bfb05],
PUP.Optional.Softonic.A, HKU\S-1-5-21-2317310838-2281009756-1505973531-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Softonic, In Quarantäne, [6e30f8fa197064d2d5862a3b20e39b65],
PUP.Optional.SupraSavings.A, HKU\S-1-5-21-2317310838-2281009756-1505973531-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\suprasavings, In Quarantäne, [346a06ec8dfc9e982c159602da29817f],
Registrierungswerte: 0
(Keine schädliche Elemente erkannt)
Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)
Ordner: 13
PUP.Optional.OpenCandy, C:\Users\Tyr\AppData\Roaming\OpenCandy, In Quarantäne, [e3bbc929acdd56e0ab8082aaf70c0bf5],
PUP.Optional.OpenCandy, C:\Users\Tyr\AppData\Roaming\OpenCandy\455D7DFA25204A62A3C799A5F1B9579F, In Quarantäne, [e3bbc929acdd56e0ab8082aaf70c0bf5],
PUP.Optional.OpenCandy, C:\Users\Tyr\AppData\Roaming\OpenCandy\A531CD94E1394C77B1A36B2694ADD596, In Quarantäne, [e3bbc929acdd56e0ab8082aaf70c0bf5],
PUP.Optional.PriceMeter.A, C:\Program Files (x86)\PriceMeterLiveUpdate, In Quarantäne, [c7d7cc265237a6908d49b181e023ed13],
PUP.Optional.PriceMeter.A, C:\Program Files (x86)\PriceMeterLiveUpdate\CrashReports, In Quarantäne, [c7d7cc265237a6908d49b181e023ed13],
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\LocalLow\BabylonToolbar, In Quarantäne, [6f2f4ca66029af877d3060dd7b8853ad],
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\LocalLow\BabylonToolbar\BabylonToolbar, In Quarantäne, [6f2f4ca66029af877d3060dd7b8853ad],
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft, In Quarantäne, [6f2f4ca66029af877d3060dd7b8853ad],
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft\Windows, In Quarantäne, [6f2f4ca66029af877d3060dd7b8853ad],
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft\Windows\IETldCache, In Quarantäne, [6f2f4ca66029af877d3060dd7b8853ad],
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft\Windows\PrivacIE, In Quarantäne, [6f2f4ca66029af877d3060dd7b8853ad],
PUP.Optional.PriceMeter.A, C:\Users\Tyr\AppData\Local\PriceMeterLiveUpdate, In Quarantäne, [bde1e30f78119c9a2255402038cb3ac6],
PUP.Optional.PriceMeter.A, C:\Users\Tyr\AppData\Local\PriceMeterLiveUpdate\CrashReports, In Quarantäne, [bde1e30f78119c9a2255402038cb3ac6],
Dateien: 15
PUP.Optional.OpenCandy.A, C:\Users\Tyr\AppData\Roaming\OpenCandy\455D7DFA25204A62A3C799A5F1B9579F\LatestDLMgr.exe, In Quarantäne, [2f6f8e6430592f0780e4d966877a56aa],
PUP.Optional.Koyote.A, C:\Program Files (x86)\Free FLV Converter\Uninstall.exe, In Quarantäne, [4955c52dcabf82b4fd1b5f01fe03a65a],
PUP.Optional.Conduit.A, C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\searchplugins\conduit-search.xml, In Quarantäne, [5747688a3356fd39e860452d669d3dc3],
PUP.Optional.OpenCandy, C:\Users\Tyr\AppData\Roaming\OpenCandy\455D7DFA25204A62A3C799A5F1B9579F\3707.ico, In Quarantäne, [e3bbc929acdd56e0ab8082aaf70c0bf5],
PUP.Optional.OpenCandy, C:\Users\Tyr\AppData\Roaming\OpenCandy\455D7DFA25204A62A3C799A5F1B9579F\SnapDo_ALL_p2v1.exe, In Quarantäne, [e3bbc929acdd56e0ab8082aaf70c0bf5],
PUP.Optional.OpenCandy, C:\Users\Tyr\AppData\Roaming\OpenCandy\A531CD94E1394C77B1A36B2694ADD596\driverscannerDE.exe, In Quarantäne, [e3bbc929acdd56e0ab8082aaf70c0bf5],
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft\Windows\IETldCache\index.dat, In Quarantäne, [6f2f4ca66029af877d3060dd7b8853ad],
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft\Windows\PrivacIE\index.dat, In Quarantäne, [6f2f4ca66029af877d3060dd7b8853ad],
PUP.Optional.CrossRider.A, C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.crossrider.bic", "145b79d2e22f1f66bbb30f384516bb5b");), Ersetzt,[702efff3fc8d3105eeb207b84db8d828]
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar.bbDpng", 17);), Ersetzt,[cfcf787aafda58de8e2118a76b9a4fb1]
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\prefs.js, Gut: (), Schlecht: (references
/* Do not edit this file.
*
* If ), Ersetzt,[b0ee3cb64d3c90a6505f2699e91c9967]
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\prefs.js, Gut: (), Schlecht: (eferences
/* Do not edit this file.
*
* If you m), Ersetzt,[f7a789697316b2845f502c936a9bd030]
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\prefs.js, Gut: (), Schlecht: (ences
/* Do not edit this file.
*
* If you make changes to this file while ), Ersetzt,[b7e7f5fd642592a45d52eed1fa0b25db]
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\prefs.js, Gut: (), Schlecht: (s file.
*
* If you make changes to this file while), Ersetzt,[ddc1787ac7c24aeceec17f40d82d37c9]
PUP.Optional.Babylon.A, C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\prefs.js, Gut: (), Schlecht: (rences
/* Do not edit this file.
*
* If you), Ersetzt,[623ca2508efb8aac604f249ba85d7f81]
Physische Sektoren: 0
(Keine schädliche Elemente erkannt)
(end) AdwCleaner: Code:
# AdwCleaner v4.106 - Bericht erstellt am 02/01/2015 um 19:51:54
# Aktualisiert 21/12/2014 von Xplode
# Database : 2015-01-01.1 [Live]
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Tyr - TYR-PC
# Gestartet von : C:\Users\Tyr\Desktop\AdwCleaner_4.106.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\ParetoLogic
Ordner Gelöscht : C:\ProgramData\PriceMeterLiveUpdate
Ordner Gelöscht : C:\ProgramData\Trymedia
Ordner Gelöscht : C:\ProgramData\PC Drivers HeadQuarters
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Trymedia
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\Tyr\AppData\Local\eSupport.com
Ordner Gelöscht : C:\Users\Tyr\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Tyr\AppData\Roaming\DriverCure
Ordner Gelöscht : C:\Users\Tyr\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Tyr\AppData\Roaming\ParetoLogic
Ordner Gelöscht : C:\Users\Tyr\AppData\Roaming\pdfforge
Datei Gelöscht : C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\user.js
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\eSupport.com
Schlüssel Gelöscht : HKCU\Software\lollipop
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\ParetoLogic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\ParetoLogic
Schlüssel Gelöscht : HKLM\SOFTWARE\Trymedia Systems
Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17496
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
-\\ Mozilla Firefox v34.0 (x86 de)
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.bbDpng", 17);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.cntry", "DE");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.firstRun", false);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.hdrMd5", "C2AF8D550E6528A1B0D00B3D60651D61");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.lastActv", "17");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("extensions.BabylonToolbar.lastDP", 17);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossrider.bic", "145b79d2e22f1f66bbb30f384516bb5b");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.engineVerified", true);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1298382057);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.history", "slayerexumerusb%203.0%20vergleich%202.0usb%203.0digittrade%20dvb%20t%20driverdigittrade%20dvbt%20driver");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.installTime", "1298382057");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.installsource", "1");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "1");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "3.6.13");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "129838071212983806021298382057023");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1298382059);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.version", "1.1.7");
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 1);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
[vbg6f0jb.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
-\\ Chromium v
*************************
AdwCleaner[R0].txt - [6733 octets] - [02/01/2015 19:50:41]
AdwCleaner[S0].txt - [6250 octets] - [02/01/2015 19:51:54]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6310 octets] ########## JRT: Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Professional x64
Ran by Tyr on 02.01.2015 at 19:58:28,36
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Tyr\AppData\Roaming\mozilla\firefox\profiles\vbg6f0jb.default\minidumps [471 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.01.2015 at 20:00:34,07
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-01-2015
Ran by Tyr (administrator) on TYR-PC on 02-01-2015 20:02:53
Running from C:\Users\Tyr\Desktop
Loaded Profile: Tyr (Available profiles: Tyr)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\Gigabyte\EasySaver\essvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Windows\SysWOW64\XSrvSetup.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
() C:\Program Files (x86)\Join Air\AssistantServices.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Valve Corporation) C:\Spiele\Steam\Steam.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Valve Corporation) C:\Spiele\Steam\bin\steamwebhelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10144288 2010-04-06] (Realtek Semiconductor)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
HKLM\...\Run: [Cm106Sound] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cm106.dll,CMICtrlWnd
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-2317310838-2281009756-1505973531-1000\...\Run: [Steam] => C:\Spiele\Steam\steam.exe [1940160 2014-11-18] (Valve Corporation)
HKU\S-1-5-21-2317310838-2281009756-1505973531-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2317310838-2281009756-1505973531-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2317310838-2281009756-1505973531-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2317310838-2281009756-1505973531-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hsu-hh.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File
BHO-x32: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default
FF SelectedSearchEngine: Google
FF Homepage: https://www.google.de/
FF NetworkProxy: "http", "backspace.unibw-hamburg.de"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Windows\SysWOW64\npdeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2317310838-2281009756-1505973531-1000: @phonostar.de/phonostar -> C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\Extensions\abs@avira.com [2014-12-11]
FF Extension: DownloadHelper - C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]
FF Extension: No Name - C:\Users\Tyr\AppData\Roaming\Mozilla\Firefox\Profiles\vbg6f0jb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-17]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-08-29]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 ES lite Service; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72304 2010-01-19] ()
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
R2 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [241664 2009-08-31] () [File not signed]
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [X]
S2 HPSLPSVC; C:\Users\Tyr\AppData\Local\Temp\7zS2EC2\hpslpsvc64.dll [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [325376 2007-03-20] (AfaTech )
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21544 2010-04-27] ()
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW76.sys [96256 2012-11-06] (Advanced Micro Devices) [File not signed]
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-02-28] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
S2 CdaC15BA; C:\Windows\SysWOW64\drivers\CDAC15BA.SYS [8864 2012-01-16] () [File not signed]
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-26] (Disc Soft Ltd)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2011-06-28] ()
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-02-28] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
S3 RTL2832UBDA; C:\Windows\SysWOW64\drivers\RTL2832UBDA.sys [225256 2011-05-17] (REALTEK SEMICONDUCTOR Corp.)
S3 RTL2832UUSB; C:\Windows\SysWOW64\Drivers\RTL2832UUSB.sys [39016 2011-05-17] (REALTEK SEMICONDUCTOR Corp.)
S3 RTL2832U_IRHID; C:\Windows\SysWOW64\DRIVERS\RTL2832U_IRHID.sys [48488 2011-06-13] (Realtek)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2015-01-01] (Windows (R) Win 7 DDK provider)
S3 USBMULCD; C:\Windows\System32\drivers\CM10664.sys [1307648 2009-10-01] (C-Media Electronics Inc)
S2 AODDriver4.01; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz130; \??\C:\Users\Tyr\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-02 20:00 - 2015-01-02 20:00 - 00000754 _____ () C:\Users\Tyr\Desktop\JRT.txt
2015-01-02 19:58 - 2015-01-02 19:58 - 00000000 ____D () C:\Windows\ERUNT
2015-01-02 19:54 - 2015-01-02 19:54 - 00006394 _____ () C:\Users\Tyr\Desktop\AdwCleaner[S0].txt
2015-01-02 19:50 - 2015-01-02 19:51 - 00000000 ____D () C:\AdwCleaner
2015-01-02 18:46 - 2015-01-02 18:55 - 00007146 _____ () C:\Users\Tyr\Desktop\MBAM.txt
2015-01-02 18:25 - 2015-01-02 19:55 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-02 18:24 - 2015-01-02 18:24 - 01707939 _____ (Thisisu) C:\Users\Tyr\Desktop\JRT.exe
2015-01-02 18:24 - 2015-01-02 18:24 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-02 18:24 - 2015-01-02 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-02 18:24 - 2015-01-02 18:24 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-02 18:24 - 2015-01-02 18:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-02 18:24 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-02 18:24 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-02 18:24 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-02 18:23 - 2015-01-02 18:23 - 02173952 _____ () C:\Users\Tyr\Desktop\AdwCleaner_4.106.exe
2015-01-02 18:23 - 2015-01-02 18:23 - 02123264 _____ (Farbar) C:\Users\Tyr\Desktop\FRST64.exe
2015-01-02 14:04 - 2015-01-02 14:04 - 00022995 _____ () C:\Users\Tyr\Desktop\ComboFix.txt
2015-01-02 13:58 - 2015-01-02 19:53 - 00007388 _____ () C:\Windows\PFRO.log
2015-01-02 13:50 - 2015-01-02 14:04 - 00000000 ____D () C:\Qoobox
2015-01-02 13:50 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-02 13:50 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-02 13:50 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-02 13:50 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-02 13:50 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-02 13:50 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-02 13:50 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-02 13:50 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-02 13:49 - 2015-01-02 14:02 - 00000000 ____D () C:\Windows\erdnt
2015-01-02 13:48 - 2015-01-02 13:48 - 05605575 ____R (Swearware) C:\Users\Tyr\Desktop\ComboFix.exe
2015-01-02 13:46 - 2015-01-02 13:46 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-01 22:56 - 2015-01-01 22:56 - 00011690 _____ () C:\Users\Tyr\Desktop\gmer.txt
2015-01-01 22:48 - 2015-01-01 22:48 - 00380416 _____ () C:\Users\Tyr\Desktop\Gmer-19357.exe
2015-01-01 22:48 - 2015-01-01 22:48 - 00050477 _____ () C:\Users\Tyr\Desktop\Defogger.exe
2015-01-01 22:41 - 2015-01-02 19:53 - 00000728 _____ () C:\Windows\setupact.log
2015-01-01 22:41 - 2015-01-01 22:42 - 00346072 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-01 22:41 - 2015-01-01 22:42 - 00262192 _____ () C:\Windows\Minidump\010115-30170-01.dmp
2015-01-01 22:41 - 2015-01-01 22:41 - 354052741 _____ () C:\Windows\MEMORY.DMP
2015-01-01 22:41 - 2015-01-01 22:41 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-01 21:02 - 2015-01-02 20:02 - 00016314 _____ () C:\Users\Tyr\Desktop\FRST.txt
2015-01-01 21:02 - 2015-01-02 20:02 - 00000000 ____D () C:\FRST
2015-01-01 21:00 - 2015-01-01 22:48 - 00000538 _____ () C:\Users\Tyr\Desktop\defogger_disable.log
2015-01-01 21:00 - 2015-01-01 22:48 - 00000336 _____ () C:\Users\Tyr\defogger_reenable
2015-01-01 20:49 - 2015-01-01 20:49 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\Chip Digital GmbH
2015-01-01 20:03 - 2015-01-01 20:03 - 00084896 _____ () C:\Users\Tyr\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-01 19:35 - 2015-01-02 14:01 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2015-01-01 19:35 - 2015-01-01 22:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator 2012
2015-01-01 19:35 - 2015-01-01 22:40 - 00000000 ____D () C:\Program Files (x86)\Spyware Terminator
2015-01-01 19:35 - 2015-01-01 19:35 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2015-01-01 19:35 - 2015-01-01 19:35 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\Spyware Terminator
2015-01-01 19:23 - 2015-01-01 22:40 - 00000000 ____D () C:\Windows\pss
2015-01-01 19:14 - 2014-12-30 14:30 - 00895912 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2015-01-01 19:14 - 2014-12-30 14:30 - 00816552 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2015-01-01 19:05 - 2015-01-01 19:06 - 00201678 _____ () C:\Users\Tyr\Desktop\cc_20150101_190550.reg
2015-01-01 18:51 - 2015-01-01 18:51 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-01-01 18:50 - 2015-01-01 18:50 - 00006862 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-01-01 18:49 - 2015-01-01 18:49 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-01-01 18:48 - 2015-01-01 18:48 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-01-01 18:45 - 2015-01-01 18:45 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-01-01 18:37 - 2015-01-01 22:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-01 18:37 - 2015-01-01 22:40 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-24 10:23 - 2014-12-24 10:27 - 00000000 ____D () C:\Users\Tyr\Desktop\Neuer Ordner
2014-12-23 18:37 - 2014-12-23 18:37 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-23 17:57 - 2014-12-13 01:47 - 00620176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-12-23 17:55 - 2014-12-13 11:08 - 32099472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-12-23 17:55 - 2014-12-13 11:08 - 24764232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-12-23 17:55 - 2014-12-13 11:08 - 13288360 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-12-23 17:55 - 2014-12-13 11:08 - 10770120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-12-23 17:55 - 2014-12-13 11:08 - 00994384 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-12-23 17:55 - 2014-12-13 11:08 - 00876976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-12-23 17:55 - 2014-12-13 11:08 - 00353224 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-12-23 17:55 - 2014-12-13 11:08 - 00306328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-12-23 17:55 - 2014-10-09 18:02 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-12-23 17:55 - 2014-10-09 18:02 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-12-23 17:55 - 2014-10-09 08:17 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco64.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 25460552 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 20465808 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 17264312 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 13202520 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 10710160 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 10345280 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-12-23 17:54 - 2014-12-13 11:08 - 03610440 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 03248968 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 02897824 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 01895056 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434709.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 01556624 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434709.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 00968336 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 00942400 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 00928072 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 00906560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 00496272 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 00391488 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 00346944 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 00178632 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-12-23 17:54 - 2014-12-13 11:08 - 00165760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-12-18 12:11 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 12:11 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-17 14:16 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-12-17 14:16 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-12-11 14:41 - 2014-12-11 14:41 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-11 11:42 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-11 11:42 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-11 10:34 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-11 10:34 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-11 10:34 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-11 10:34 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-11 10:34 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-11 10:34 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-11 10:34 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-11 10:34 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-11 10:33 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-11 10:33 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-11 10:33 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-11 10:33 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-11 10:33 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-11 10:33 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-11 10:33 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-11 10:33 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-11 10:33 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-11 10:33 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-11 10:33 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-11 10:33 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-11 10:33 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-11 10:33 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-11 10:33 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-11 10:33 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-11 10:33 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-11 10:33 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-11 10:33 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-11 10:33 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-11 10:33 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-11 10:33 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-11 10:33 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-11 10:33 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-11 10:33 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-11 10:33 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-11 10:33 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-11 10:33 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-11 10:33 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-11 10:33 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-11 10:33 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-11 10:33 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-11 10:33 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-11 10:33 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-11 10:33 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-11 10:33 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-11 10:33 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-11 10:33 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-11 10:33 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-11 10:33 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-11 10:33 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-11 10:33 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-11 10:33 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-11 10:33 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-11 10:33 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-11 10:33 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-11 10:33 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-11 10:33 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-11 10:33 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-11 10:33 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-11 10:33 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-11 10:33 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-11 10:33 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-11 10:33 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-11 10:33 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-11 10:33 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-11 10:33 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-11 10:32 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-11 10:32 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-11 10:32 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-11 10:32 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-11 10:32 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-11 10:32 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-11 10:32 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-11 10:32 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-11 10:32 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-11 10:32 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-11 10:32 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-11 10:32 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-11 10:32 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-11 10:32 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-03 00:28 - 2014-12-03 00:28 - 00000000 ____D () C:\Games
2014-12-03 00:27 - 2014-12-03 00:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager
2014-12-03 00:26 - 2014-12-03 00:27 - 00000000 ____D () C:\Program Files\Nexus Mod Manager
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-02 20:02 - 2009-07-14 05:45 - 00026144 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-02 20:02 - 2009-07-14 05:45 - 00026144 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-02 19:55 - 2011-02-22 13:21 - 00000144 _____ () C:\service.log
2015-01-02 19:53 - 2013-07-10 17:23 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-02 19:53 - 2011-10-27 18:21 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-01-02 19:53 - 2011-02-22 13:31 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2015-01-02 19:53 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-02 19:52 - 2011-02-22 13:02 - 01205622 _____ () C:\Windows\WindowsUpdate.log
2015-01-02 19:33 - 2014-10-02 10:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-02 18:47 - 2014-01-24 16:49 - 00000000 ____D () C:\Windows\de
2015-01-02 18:46 - 2014-11-12 01:51 - 00000000 ____D () C:\Program Files (x86)\Free FLV Converter
2015-01-02 18:22 - 2011-02-22 14:45 - 00000000 ____D () C:\Users\Tyr\Programme
2015-01-02 15:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-01-02 14:04 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-01-02 13:58 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-02 13:57 - 2014-06-26 00:52 - 00000000 ____D () C:\Users\Tyr\AppData\Local\Adobe
2015-01-02 12:02 - 2011-02-22 16:20 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\vlc
2015-01-01 22:52 - 2011-04-12 15:44 - 00000000 ____D () C:\Users\Tyr\AppData\Local\Google
2015-01-01 22:45 - 2011-10-21 07:46 - 00000000 ____D () C:\Users\Tyr\Documents\Sonstiges
2015-01-01 22:41 - 2011-03-07 20:42 - 00000000 ____D () C:\Windows\Minidump
2015-01-01 22:41 - 2011-02-22 13:02 - 00000000 ____D () C:\Users\Tyr
2015-01-01 22:40 - 2014-04-22 20:21 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\uTorrent
2015-01-01 22:40 - 2014-03-23 23:36 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\XMedia Recode
2015-01-01 22:40 - 2014-03-23 23:36 - 00000000 ____D () C:\Program Files (x86)\XMedia Recode
2015-01-01 22:40 - 2013-10-18 11:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-01 22:40 - 2012-11-30 23:06 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\ArcSoft
2015-01-01 22:40 - 2012-03-07 13:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks
2015-01-01 22:40 - 2011-12-14 20:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
2015-01-01 22:40 - 2011-12-14 20:24 - 00000000 ____D () C:\Program Files (x86)\Amazon
2015-01-01 22:40 - 2011-12-01 06:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wecker für Windows
2015-01-01 22:40 - 2011-10-27 12:58 - 00000000 ____D () C:\Program Files (x86)\Join Air
2015-01-01 22:40 - 2011-10-27 10:01 - 00000000 ____D () C:\ProgramData\Origin
2015-01-01 22:40 - 2011-09-27 19:57 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\phonostar GmbH
2015-01-01 22:40 - 2011-03-14 21:45 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-01-01 22:40 - 2011-02-22 14:43 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-01 22:40 - 2011-02-22 14:43 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\Skype
2015-01-01 22:40 - 2011-02-22 14:10 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\Winamp
2015-01-01 22:40 - 2011-02-22 13:42 - 00000000 ____D () C:\Program Files (x86)\OpenVPN
2015-01-01 22:39 - 2014-03-23 23:37 - 00000000 ____D () C:\Program Files (x86)\MSI Afterburner
2015-01-01 22:39 - 2013-10-18 11:44 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-01 22:39 - 2012-05-14 16:00 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-01 22:39 - 2012-01-16 22:40 - 00000000 ____D () C:\ProgramData\TuneUp Software
2015-01-01 22:39 - 2011-12-03 20:40 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2015-01-01 22:39 - 2011-10-27 10:01 - 00000000 ____D () C:\ProgramData\Electronic Arts
2015-01-01 22:39 - 2011-02-22 15:10 - 00000000 ____D () C:\Spiele
2015-01-01 22:39 - 2011-02-22 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN
2015-01-01 22:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-01-01 22:31 - 2009-07-14 19:18 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-01-01 22:30 - 2011-02-22 13:17 - 00000000 ____D () C:\Users\Tyr\AppData\Local\Mozilla
2015-01-01 22:29 - 2013-02-21 18:35 - 00000000 ____D () C:\Users\Tyr\AppData\Local\e-academy Inc
2015-01-01 22:28 - 2011-03-17 19:10 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2015-01-01 20:45 - 2014-05-21 21:57 - 00007617 _____ () C:\Users\Tyr\AppData\Local\Resmon.ResmonCfg
2015-01-01 19:29 - 2011-09-27 19:57 - 00000000 ____D () C:\Program Files (x86)\phonostar-Player
2015-01-01 19:29 - 2011-02-22 14:43 - 00000000 ____D () C:\ProgramData\Skype
2015-01-01 19:21 - 2011-12-14 20:25 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\Amazon
2015-01-01 19:20 - 2012-11-30 23:06 - 00000000 ____D () C:\ProgramData\ArcSoft
2015-01-01 19:20 - 2011-02-22 13:21 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-01 19:18 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-01 19:17 - 2011-10-27 19:44 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins
2015-01-01 19:15 - 2011-03-10 22:20 - 00000000 ____D () C:\Program Files (x86)\GTactix
2015-01-01 19:14 - 2014-12-02 16:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-01 19:11 - 2014-03-23 23:37 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MSI Afterburner
2015-01-01 19:01 - 2013-08-29 22:01 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2015-01-01 19:01 - 2011-07-02 18:37 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\TS3Client
2015-01-01 19:01 - 2011-03-17 19:10 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\TeamViewer
2015-01-01 19:01 - 2011-02-22 13:14 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\DAEMON Tools Lite
2015-01-01 19:01 - 2011-02-22 12:55 - 00000000 ____D () C:\Windows\Panther
2014-12-31 04:08 - 2011-03-02 23:17 - 00000000 ____D () C:\Users\Tyr\AppData\Local\Last.fm
2014-12-30 14:30 - 2014-09-02 23:27 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-12-30 14:30 - 2014-09-02 23:27 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-12-30 14:30 - 2014-09-02 23:27 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-12-30 14:30 - 2014-09-02 23:27 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-12-24 10:33 - 2009-07-14 18:58 - 00710046 _____ () C:\Windows\system32\perfh007.dat
2014-12-24 10:33 - 2009-07-14 18:58 - 00154482 _____ () C:\Windows\system32\perfc007.dat
2014-12-24 10:33 - 2009-07-14 06:13 - 01650148 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-23 17:57 - 2013-07-10 17:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-12-23 17:57 - 2011-08-05 08:15 - 00000000 ____D () C:\Temp
2014-12-23 17:52 - 2012-01-05 01:15 - 00000000 ____D () C:\Users\Tyr\AppData\Local\Paint.NET
2014-12-22 22:37 - 2014-11-05 14:57 - 00155136 _____ () C:\Windows\SysWOW64\unrar.dll
2014-12-22 22:37 - 2014-11-05 14:57 - 00034308 _____ () C:\Windows\SysWOW64\bassmod.dll
2014-12-16 20:05 - 2014-10-02 10:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-16 20:04 - 2014-10-02 10:03 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-16 20:04 - 2014-10-02 10:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-16 19:57 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-14 12:46 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-14 02:18 - 2014-07-31 17:39 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-14 02:18 - 2012-11-15 11:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-14 02:18 - 2012-11-15 11:40 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-13 11:08 - 2014-11-10 18:46 - 16040184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-12-13 11:08 - 2013-07-10 17:17 - 18594432 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-12-13 11:08 - 2013-07-10 17:17 - 14128496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-12-13 11:08 - 2013-07-10 17:17 - 03293136 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-12-13 11:08 - 2013-07-10 17:17 - 00027983 _____ () C:\Windows\system32\nvinfo.pb
2014-12-13 09:03 - 2013-07-10 17:22 - 06859408 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-12-13 09:03 - 2013-07-10 17:22 - 03513488 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-12-13 09:03 - 2013-07-10 17:22 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-12-13 09:03 - 2013-07-10 17:22 - 00935240 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-12-13 09:03 - 2013-07-10 17:22 - 00386368 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-12-13 09:03 - 2013-07-10 17:22 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-12-13 01:12 - 2014-06-02 18:27 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-12-13 01:12 - 2014-06-02 18:27 - 01291464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-12-13 01:12 - 2013-10-28 19:52 - 02824504 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-12-13 01:12 - 2013-10-28 19:52 - 02210040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-12-13 00:11 - 2013-07-10 17:22 - 04151176 _____ () C:\Windows\system32\nvcoproc.bin
2014-12-11 14:47 - 2014-11-12 01:52 - 00000000 ____D () C:\Users\Tyr\AppData\Roaming\FreeFLVConverter
2014-12-11 14:41 - 2014-04-30 17:20 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-11 14:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-11 14:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-11 11:45 - 2013-07-19 21:30 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-11 11:45 - 2011-02-22 13:40 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-11 11:43 - 2011-03-14 20:48 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-04 08:43 - 2012-04-27 12:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-03 00:46 - 2011-11-20 15:45 - 00000000 ____D () C:\Users\Tyr\AppData\Local\Skyrim
2014-12-03 00:35 - 2012-02-26 16:01 - 00000000 ____D () C:\Users\Tyr\Documents\Nexus Mod Manager
2014-12-03 00:27 - 2012-02-26 16:01 - 00000000 ____D () C:\Users\Tyr\AppData\Local\Black_Tree_Gaming
Some content of TEMP:
====================
C:\Users\Tyr\AppData\Local\Temp\avgnt.exe
C:\Users\Tyr\AppData\Local\Temp\Quarantine.exe
C:\Users\Tyr\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-15 10:23
==================== End Of Log ============================ --- --- --- |