Windows 8.1: Trojan:Win32/Meredrop, Trojan:Win32/Malagent, Trojan:Win32/Matsnu.L und Worm:Win32/Ainslot.A

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:18 on 14/01/2014 (Yogi)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-01-2014 02
Ran by Yogi (administrator) on YOGI-PC on 14-01-2014 21:20:53
Running from C:\Users\Yogi\Desktop
Windows 8.1 Pro (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official downoad link fo FRST:
Farbar Recovery Scan Tool Download Link Download Now 32-Bit Version 
Farbar Recovery Scan Tool Download Link Download Now 32-Bit Version 
Any other download link is unpermitted or outdated.
The tutorial for FRST can be find here: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\LogonUI.exe
(Microsoft Corporation) C:\Windows\System32\LogonUI.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Flux Software LLC) C:\Users\Yogi\AppData\Local\FluxSoftware\Flux\flux.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTE.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7199448 2013-09-05] (Realtek Semiconductor)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [8290584 2013-08-01] (Logitech Inc.)
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-12-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Live Update 5] - C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [315392 2012-01-30] ()
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe Creative Cloud] - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2239376 2013-12-19] (Adobe Systems Incorporated)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [f.lux] - C:\Users\Yogi\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
MountPoints2: {30c0de46-5aaf-11e3-825e-8c89a5163261} - "G:\LaunchU3.exe" -a
Startup: C:\Users\Yogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Yogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe (Samsung Electronics.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9C6648AE3BDACE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\Yogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0 [2013-11-05]
CHR Extension: (Google Drive) - C:\Users\Yogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0 [2013-11-05]
CHR Extension: (YouTube) - C:\Users\Yogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 [2013-11-05]
CHR Extension: (Google Search) - C:\Users\Yogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 [2013-11-05]
CHR Extension: (Google Wallet) - C:\Users\Yogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_1 [2014-01-08]
CHR Extension: (Gmail) - C:\Users\Yogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0 [2013-11-05]

==================== Services (Whitelisted) =================

U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
U2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
U2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-11-07] ()
U3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
U2 RzKLService; C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448 2013-11-22] (Razer Inc.)
U3 VsEtwService120; C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [87728 2013-10-04] (Microsoft Corporation)
U3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
U2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
U4 WinVNC4; C:\Program Files (x86)\TigerVNC\winvnc4.exe [5737493 2013-07-04] (TigerVNC Project)

==================== Drivers (Whitelisted) ====================

U0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
U3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
U3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
U3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
U0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
U0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
U3 kbldfltr; C:\Windows\System32\drivers\kbldfltr.sys [22272 2013-09-30] (Microsoft Corporation)
U3 LGSHidFilt; C:\Windows\system32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
U0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
U3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
U3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
U2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
U3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
U3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
U3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
U3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [230912 2013-08-22] (Microsoft Corporation)
U3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
U0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
U3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
U2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-14 21:20 - 2014-01-14 21:21 - 00011691 _____ C:\Users\Yogi\Desktop\FRST.txt
2014-01-14 21:20 - 2014-01-14 21:20 - 00000000 ____D C:\FRST
2014-01-14 21:19 - 2014-01-14 21:15 - 02076160 _____ (Farbar) C:\Users\Yogi\Desktop\FRST64.exe
2014-01-14 21:18 - 2014-01-14 21:18 - 00050477 _____ C:\Users\Yogi\Desktop\Defogger (1).exe
2014-01-14 21:18 - 2014-01-14 21:18 - 00000470 _____ C:\Users\Yogi\Desktop\defogger_disable.log
2014-01-14 21:17 - 2014-01-14 21:17 - 00000000 _____ C:\Users\Yogi\defogger_reenable
2014-01-14 20:53 - 2014-01-14 20:53 - 00000000 ____D C:\Windows\system32\log
2014-01-14 20:53 - 2014-01-14 20:53 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\iSafe
2014-01-14 20:53 - 2014-01-14 20:53 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\eCyber
2014-01-13 08:28 - 2014-01-13 08:28 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\Wireshark
2014-01-12 22:41 - 2014-01-12 22:41 - 00000000 ____D C:\Program Files\Wireshark
2014-01-12 22:41 - 2014-01-12 22:41 - 00000000 ____D C:\Program Files (x86)\WinPcap
2014-01-11 11:17 - 2014-01-11 11:17 - 00002151 _____ C:\Users\Public\Desktop\3D Vision Photo Viewer.lnk
2014-01-11 11:16 - 2014-01-11 11:17 - 00000000 ____D C:\Windows\LastGood
2014-01-11 11:16 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-01-11 11:16 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 01242400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00479520 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00405280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00357152 _____ C:\Windows\system32\NvIFROpenGL.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00317472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00314656 _____ C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00266984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00168616 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-01-11 11:16 - 2013-12-19 21:33 - 00141336 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-01-11 11:16 - 2013-11-28 14:38 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-01-11 11:16 - 2013-11-28 14:38 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-01-11 11:16 - 2013-11-22 09:36 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-01-10 22:32 - 2014-01-10 22:32 - 00003498 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Yogi-PC-Yogi
2014-01-10 22:31 - 2014-01-10 22:32 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2014-01-10 22:31 - 2014-01-10 22:31 - 00000000 ____D C:\Users\Yogi\Documents\Adobe
2014-01-10 22:31 - 2014-01-10 22:31 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\PDAppFlex
2014-01-10 19:49 - 2014-01-10 20:10 - 00000000 ____D C:\Program Files\Common Files\Adobe
2014-01-10 19:49 - 2014-01-10 20:10 - 00000000 ____D C:\Program Files\Adobe
2014-01-10 19:21 - 2014-01-10 19:50 - 00000000 ____D C:\ProgramData\Adobe
2014-01-10 19:20 - 2014-01-10 19:20 - 00001086 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk
2014-01-10 19:20 - 2014-01-10 19:20 - 00000000 ____D C:\Program Files (x86)\Adobe
2014-01-10 19:16 - 2014-01-14 02:00 - 00000000 ____D C:\Users\Yogi\AppData\Local\Adobe
2014-01-05 17:41 - 2014-01-05 17:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-01-03 19:13 - 2014-01-12 19:11 - 00119830 _____ C:\Users\Yogi\Desktop\IljasRechner.xlsx
2014-01-03 13:49 - 2014-01-03 13:49 - 00000000 ____D C:\Program Files (x86)\gnuplot
2014-01-02 21:31 - 2014-01-02 21:31 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\WinRAR
2014-01-02 21:30 - 2014-01-02 21:30 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-02 21:30 - 2014-01-02 21:30 - 00000000 ____D C:\Program Files\WinRAR
2013-12-29 20:30 - 2013-12-29 20:30 - 00000000 ____D C:\ProgramData\Battle.net
2013-12-22 19:32 - 2013-12-22 19:32 - 00000000 ____D C:\Windows\LastGood.Tmp
2013-12-22 19:32 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-22 19:32 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-21 18:21 - 2014-01-13 08:32 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\DataWork
2013-12-19 12:20 - 2013-12-19 12:20 - 00590112 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2013-12-18 21:09 - 2013-12-21 18:21 - 00000915 _____ C:\Users\Yogi\AppData\Roaming\Sample.lnk
2013-12-16 20:42 - 2013-12-16 20:42 - 00000295 _____ C:\Users\Yogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Papierkorb.lnk

==================== One Month Modified Files and Folders =======

2014-01-14 21:21 - 2014-01-14 21:20 - 00011691 _____ C:\Users\Yogi\Desktop\FRST.txt
2014-01-14 21:20 - 2014-01-14 21:20 - 00000000 ____D C:\FRST
2014-01-14 21:18 - 2014-01-14 21:18 - 00050477 _____ C:\Users\Yogi\Desktop\Defogger (1).exe
2014-01-14 21:18 - 2014-01-14 21:18 - 00000470 _____ C:\Users\Yogi\Desktop\defogger_disable.log
2014-01-14 21:17 - 2014-01-14 21:17 - 00000000 _____ C:\Users\Yogi\defogger_reenable
2014-01-14 21:17 - 2013-11-05 16:26 - 00000000 ____D C:\Users\Yogi
2014-01-14 21:15 - 2014-01-14 21:19 - 02076160 _____ (Farbar) C:\Users\Yogi\Desktop\FRST64.exe
2014-01-14 21:06 - 2013-11-05 16:32 - 00003592 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-720677535-148065905-500027379-1001
2014-01-14 21:04 - 2013-11-05 19:48 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-14 21:00 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\sru
2014-01-14 20:53 - 2014-01-14 20:53 - 00000000 ____D C:\Windows\system32\log
2014-01-14 20:53 - 2014-01-14 20:53 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\iSafe
2014-01-14 20:53 - 2014-01-14 20:53 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\eCyber
2014-01-14 20:33 - 2013-11-05 16:22 - 02064632 _____ C:\Windows\WindowsUpdate.log
2014-01-14 20:13 - 2013-11-05 19:49 - 00002201 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-14 20:13 - 2013-11-05 19:48 - 00001118 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-14 02:00 - 2014-01-10 19:16 - 00000000 ____D C:\Users\Yogi\AppData\Local\Adobe
2014-01-13 20:28 - 2013-11-21 21:19 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\UseNeXT
2014-01-13 08:32 - 2013-12-21 18:21 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\DataWork
2014-01-13 08:28 - 2014-01-13 08:28 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\Wireshark
2014-01-12 22:41 - 2014-01-12 22:41 - 00000000 ____D C:\Program Files\Wireshark
2014-01-12 22:41 - 2014-01-12 22:41 - 00000000 ____D C:\Program Files (x86)\WinPcap
2014-01-12 22:19 - 2013-11-05 19:21 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\TS3Client
2014-01-12 21:43 - 2013-11-05 18:57 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-12 20:46 - 2013-11-05 18:57 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2014-01-12 19:12 - 2013-11-05 18:27 - 00000000 ____D C:\Program Files (x86)\Origin
2014-01-12 19:11 - 2014-01-03 19:13 - 00119830 _____ C:\Users\Yogi\Desktop\IljasRechner.xlsx
2014-01-11 11:20 - 2013-11-05 16:33 - 01886820 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-11 11:20 - 2013-09-30 04:58 - 00805954 _____ C:\Windows\system32\perfh007.dat
2014-01-11 11:20 - 2013-09-30 04:58 - 00176466 _____ C:\Windows\system32\perfc007.dat
2014-01-11 11:17 - 2014-01-11 11:17 - 00002151 _____ C:\Users\Public\Desktop\3D Vision Photo Viewer.lnk
2014-01-11 11:17 - 2014-01-11 11:16 - 00000000 ____D C:\Windows\LastGood
2014-01-11 11:17 - 2013-11-05 16:56 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-11 11:17 - 2013-11-05 16:56 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2014-01-11 11:17 - 2013-08-22 15:46 - 00023519 _____ C:\Windows\setupact.log
2014-01-10 22:32 - 2014-01-10 22:32 - 00003498 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Yogi-PC-Yogi
2014-01-10 22:32 - 2014-01-10 22:31 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2014-01-10 22:31 - 2014-01-10 22:31 - 00000000 ____D C:\Users\Yogi\Documents\Adobe
2014-01-10 22:31 - 2014-01-10 22:31 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\PDAppFlex
2014-01-10 22:31 - 2013-11-05 16:26 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\Adobe
2014-01-10 22:29 - 2013-11-21 23:05 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\vlc
2014-01-10 20:10 - 2014-01-10 19:49 - 00000000 ____D C:\Program Files\Common Files\Adobe
2014-01-10 20:10 - 2014-01-10 19:49 - 00000000 ____D C:\Program Files\Adobe
2014-01-10 19:50 - 2014-01-10 19:21 - 00000000 ____D C:\ProgramData\Adobe
2014-01-10 19:20 - 2014-01-10 19:20 - 00001086 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk
2014-01-10 19:20 - 2014-01-10 19:20 - 00000000 ____D C:\Program Files (x86)\Adobe
2014-01-05 17:41 - 2014-01-05 17:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-01-04 17:58 - 2013-11-05 16:26 - 00000000 ____D C:\Users\Yogi\AppData\Local\Packages
2014-01-03 22:40 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-03 22:40 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2014-01-03 13:49 - 2014-01-03 13:49 - 00000000 ____D C:\Program Files (x86)\gnuplot
2014-01-02 21:31 - 2014-01-02 21:31 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\WinRAR
2014-01-02 21:30 - 2014-01-02 21:30 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-02 21:30 - 2014-01-02 21:30 - 00000000 ____D C:\Program Files\WinRAR
2013-12-29 20:30 - 2013-12-29 20:30 - 00000000 ____D C:\ProgramData\Battle.net
2013-12-22 19:32 - 2013-12-22 19:32 - 00000000 ____D C:\Windows\LastGood.Tmp
2013-12-21 18:21 - 2013-12-18 21:09 - 00000915 _____ C:\Users\Yogi\AppData\Roaming\Sample.lnk
2013-12-21 18:21 - 2013-11-16 17:34 - 00000000 ____D C:\Users\Yogi\AppData\Roaming\NVIDIA
2013-12-19 21:33 - 2014-01-11 11:16 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2013-12-19 21:33 - 2014-01-11 11:16 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 01242400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00479520 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00405280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00357152 _____ C:\Windows\system32\NvIFROpenGL.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00317472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00314656 _____ C:\Windows\SysWOW64\NvIFROpenGL.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00266984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00168616 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2013-12-19 21:33 - 2014-01-11 11:16 - 00141336 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2013-12-19 21:33 - 2013-11-05 16:56 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2013-12-19 21:33 - 2013-11-05 16:56 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2013-12-19 21:33 - 2013-10-27 09:12 - 18310112 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2013-12-19 21:33 - 2013-10-27 09:12 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2013-12-19 21:33 - 2013-10-27 09:12 - 03071656 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2013-12-19 21:33 - 2013-10-27 09:12 - 02698272 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2013-12-19 21:33 - 2013-10-27 09:12 - 01436528 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2013-12-19 21:33 - 2013-10-27 09:12 - 00023754 _____ C:\Windows\system32\nvinfo.pb
2013-12-19 19:53 - 2013-11-05 16:56 - 06671648 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2013-12-19 19:53 - 2013-11-05 16:56 - 03490080 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2013-12-19 19:53 - 2013-11-05 16:56 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2013-12-19 19:53 - 2013-11-05 16:56 - 00922912 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2013-12-19 19:53 - 2013-11-05 16:56 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2013-12-19 19:53 - 2013-11-05 16:56 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2013-12-19 12:20 - 2013-12-19 12:20 - 00590112 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2013-12-19 06:01 - 2013-11-05 16:56 - 03539040 _____ C:\Windows\system32\nvcoproc.bin
2013-12-16 20:42 - 2013-12-16 20:42 - 00000295 _____ C:\Users\Yogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Papierkorb.lnk
2013-12-16 04:42 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\rescache

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-13 03:37

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-14 21:29:08
Windows 6.2.9200  x64 \Device\Harddisk1\DR1 -> \Device\0000002e Samsung_SSD_840_EVO_120GB rev.EXT0BB0Q 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Yogi\AppData\Local\Temp\kwtdrpod.sys


---- Kernel code sections - GMER 2.1 ----

.text    C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                              fffff96000214700 15 bytes [00, EA, 0F, 02, 00, 7F, 6F, ...]
.text    C:\Windows\System32\win32k.sys!W32pServiceTable + 16                                                                                         fffff96000214710 11 bytes [00, 1F, FC, FF, 80, 52, DE, ...]

---- User code sections - GMER 2.1 ----

.text    C:\Windows\system32\dwm.exe[10428] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                    00007ffa835a169a 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\system32\dwm.exe[10428] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                    00007ffa835a16a2 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\system32\dwm.exe[10428] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                                                       00007ffa835a181a 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\system32\dwm.exe[10428] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                                                       00007ffa835a1832 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\system32\nvvsvc.exe[18872] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                 00007ffa835a169a 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\system32\nvvsvc.exe[18872] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                 00007ffa835a16a2 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\system32\nvvsvc.exe[18872] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                                                    00007ffa835a181a 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\system32\nvvsvc.exe[18872] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                                                    00007ffa835a1832 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\Explorer.EXE[26988] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                        00007ffa835a169a 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\Explorer.EXE[26988] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                        00007ffa835a16a2 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\Explorer.EXE[26988] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                                                           00007ffa835a181a 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\Explorer.EXE[26988] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                                                           00007ffa835a1832 4 bytes [5A, 83, FA, 7F]
.text    C:\Windows\Explorer.EXE[26988] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 194                                                              00007ffa7d8a1f6a 4 bytes [8A, 7D, FA, 7F]
.text    C:\Windows\Explorer.EXE[26988] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 218                                                              00007ffa7d8a1f82 4 bytes [8A, 7D, FA, 7F]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\csrss.exe [15248:20608]                                                                                                  fffff960009ad4d0

---- Services - GMER 2.1 ----

Service  C:\Program Files (x86)\Windows Defender\MsMpEng.exe (*** hidden *** )                                                                        [AUTO] WinDefend                                              <-- ROOTKIT !!!

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{52810C43-BE01-46F6-9543-72397385B1D4}\Connection@Name  isatap.{FEA4FEBC-63B0-40D0-87C5-FF7C5B6E9140}
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                            2010293244
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{52810C43-BE01-46F6-9543-72397385B1D4}@InterfaceName                       isatap.{FEA4FEBC-63B0-40D0-87C5-FF7C5B6E9140}
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{52810C43-BE01-46F6-9543-72397385B1D4}@ReusableType                        0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{52810C43-BE01-46F6-9543-72397385B1D4}@DefunctTimestamp                    0x55 0x8C 0xD5 0x52 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                              1349
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                             295
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WdBoot@Group                                                                                          Early-Launch
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WdBoot@ImagePath                                                                                      system32\drivers\WdBoot.sys
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WdBoot@Start                                                                                          0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WdBoot                                                                                                
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WdFilter@ImagePath                                                                                    system32\drivers\WdFilter.sys
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WdFilter@Start                                                                                        0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WdFilter                                                                                              
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv@Start                                                                                        2
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv                                                                                              
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WinDefend@Start                                                                                       2
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WinDefend                                                                                             
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\UnreadMail\a.malsam@gmx.de@MessageCount                                                       166
Reg      HKCU\Software\Microsoft\Windows Live Mail@Running                                                                                            1
Reg      HKCU\Software\Microsoft\Windows Live Mail@Compact Check Count                                                                                59
Reg      HKCU\Software\Microsoft\Windows Live Mail@Last Search Index                                                                                  5
Reg      HKCU\Software\Microsoft\Windows Live Mail@SqmSrvSuccessCount POP3                                                                            1580553
Reg      HKCU\Software\Microsoft\Windows Live Mail@TotalUpTime                                                                                        151795
Reg      HKCU\Software\Microsoft\Windows Live Mail@UpTimeCanary                                                                                       1

---- EOF - GMER 2.1 ----
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-01-2014 02
Ran by Yogi at 2014-01-14 21:21:08
Running from C:\Users\Yogi\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Tools for .Net 3.5 (x32 Version: 3.11.50727 - Microsoft Corporation) Hidden
Adobe Creative Cloud (x32 Version: 2.3.0.322 - Adobe Systems Incorporated)
Adobe Premiere Pro CC (x32 Version: 7.2.1 - Adobe Systems Incorporated)
AzureTools.Notifications.VwdExpress (x32 Version: 2.1.10731.1602 - Microsoft Corporation) Hidden
Battlefield 4™ (x32 Version: 1.0.0.1 - Electronic Arts)
Battlelog Web Plugins (x32 Version: 2.3.2 - EA Digital Illusions CE AB)
BF4 Settings Editor (Version: 1.1 - Realmware)
Build Tools - amd64 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Build Tools - x86 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Build Tools Language Resources - amd64 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Build Tools Language Resources - x86 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2013 (KB2760587) 64-Bit Edition (Version:  - Microsoft)
Entity Framework Tools for Visual Studio 2013 (x32 Version: 12.0.20912.0 - Microsoft Corporation)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)
f.lux (HKCU Version:  - )
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
gnuplot 4.6.3 (x32 Version: 4.6.3 - gnuplot development team)
Google Chrome (x32 Version: 32.0.1700.72 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
IIS 8.0 Express (Version: 8.0.1557 - Microsoft Corporation)
IIS Express Application Compatibility Database for x64 (Version:  - )
IIS Express Application Compatibility Database for x86 (Version:  - )
Intel(R) Management Engine Components (x32 Version: 7.1.50.1172 - Intel Corporation)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Live Update 5 (x32 Version: 5.0.109 - MSI)
Logitech Gaming Software (Version: 8.45.88 - Logitech Inc.) Hidden
Logitech Gaming Software 8.50 (Version: 8.50.281 - Logitech Inc.)
Logitech SetPoint 6.61 (Version: 6.61.15 - Logitech)
MetaTrader - Alpari UK (x32 Version: 4.00 - MetaQuotes Software Corp.)
Microsoft .NET Framework 4 Multi-Targeting Pack (x32 Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 Multi-Targeting Pack (x32 Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK (x32 Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (x32 Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (x32 Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (x32 Version: 4.5.51641 - Microsoft Corporation)
Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft ASP.NET MVC 4 - Visual Studio Express 2013 for Web - ENU (x32 Version: 4.1.21001.0 - Microsoft Corporation) Hidden
Microsoft ASP.NET MVC 4 Runtime (x32 Version: 4.0.20716.0 - Microsoft Corporation) Hidden
Microsoft ASP.NET Web Frameworks and Tools - Visual Studio Express 2013 for Web - ENU (x32 Version: 5.0.11001.0 - Microsoft Corporation) Hidden
Microsoft ASP.NET Web Pages 2 - Visual Studio Express 2013 for Web - ENU (x32 Version: 4.1.21001.0 - Microsoft Corporation) Hidden
Microsoft ASP.NET Web Pages 2 Runtime (x32 Version: 2.0.20716.0 - Microsoft Corporation) Hidden
Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Help Viewer 2.1 (x32 Version: 2.1.21005 - Microsoft Corporation)
Microsoft Help Viewer 2.1 (x32 Version: 2.1.21005 - Microsoft Corporation) Hidden
Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft NuGet - Visual Studio Express 2013 for Web (x32 Version: 2.7.40911.287 - Microsoft Corporation) Hidden
Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (x32 Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (x64) (Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects  (x32 Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects  (x64) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 T-SQL Language Service  (x32 Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 ENU (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - enu (12.0.30919.1) (x32 Version: 12.0.30919.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools Build Utilities - enu (12.0.30919.1) (x32 Version: 12.0.30919.1 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (x32 Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (x64) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2012 (x32 Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2012 (x64) (Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft Team Foundation Server 2013 Object Model (x64) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Team Foundation Server 2013 Object Model Language Pack (x64) - ENU (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Debug Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Debug Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2013 Express Prerequisites x64 - ENU (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2013 Preparation (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2013 Shell (Minimum) (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2013 Shell (Minimum) Interop Assemblies (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2013 Shell (Minimum) Resources (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2013 Team Explorer Language Pack - ENU (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio Express 2013 for Web - ENU (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio Express 2013 for Web - ENU (x32 Version: 12.0.21005.13 - Microsoft Corporation)
Microsoft Visual Studio Ultimate 2013 XAML UI Designer Core (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual Studio Ultimate 2013 XAML UI Designer enu Resources (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Web Deploy 3.5 (Version: 3.1237.1762 - Microsoft Corporation)
Microsoft Web Developer Tools 2013 - Visual Studio Express 2013 for Web (x32 Version: 2.0.40926.0 - Microsoft Corporation) Hidden
Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Notepad++ (x32 Version: 6.5.1 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3221 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation)
Origin (x32 Version: 9.3.10.4710 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Prerequisites for SSDT  (x32 Version: 11.1.3000.0 - Microsoft Corporation)
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
Razer Game Booster (x32 Version: 4.1.59.0 - Razer Inc.)
Realtek Ethernet Controller Driver (x32 Version: 8.19.726.2013 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.7037 - Realtek Semiconductor Corp.)
Samsung Magician (x32 Version: 4.2.1 - Samsung Electronics)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Team Explorer for Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
TeamSpeak 3 Client (HKCU Version: 3.0.13 - TeamSpeak Systems GmbH)
Tick Data Suite (x32 Version: 1.2.11 - eareview.net)
TigerVNC v1.3.0 (20130704) (x32 Version: 1.3.0 - TigerVNC project)
Update for  (KB2504637) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2013 (KB2768008) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Access 2013 (KB2827233) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft InfoPath 2013 (KB2837648) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Lync 2013 (KB2817678) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2726954) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2726996) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2738038) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760224) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760242) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760267) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760539) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760553) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760610) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2767845) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2768016) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817314) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817316) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817490) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817626) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2826004) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827225) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827227) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827230) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2827239) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2837626) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2837637) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2837638) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2837655) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2850066) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft OneNote 2013 (KB2850063) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft PowerPoint 2013 (KB2767850) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Project 2013 (KB2727085) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Publisher 2013 (KB2837635) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft SkyDrive Pro (KB2817495) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft SkyDrive Pro (KB2837652) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Visio 2013 (KB2817306) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2768338) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Word 2013 (KB2837647) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Word 2013 (KB2850060) 64-Bit Edition (Version:  - Microsoft)
UseNeXT by Tangysoft (x32 Version:  - Tangysoft Ltd.)
VLC media player 2.1.1 (x32 Version: 2.1.1 - VideoLAN)
Walk Forward Analyzer (x32 Version: 1.3.2 - Easy Expert Forex)
Windows Azure Shared Components for Microsoft Visual Studio 2013 - v1.0 (x32 Version: 1.0.10829.1601 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
WinPcap 4.1.3 (x32 Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.01 (64-Bit) (Version: 5.01.0 - win.rar GmbH)
Wireshark 1.10.5 (64-bit) (x32 Version: 1.10.5 - The Wireshark developer community, hxxp://www.wireshark.org)

==================== Restore Points  =========================

29-12-2013 03:43:02 Geplanter Prüfpunkt
05-01-2014 13:58:22 Geplanter Prüfpunkt
13-01-2014 02:55:34 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {08C8A8C8-FB6B-4E15-8130-FB5E0D4B7948} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {09A92ED8-6C6C-4165-8FAC-9B1C4DA6053B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2013-12-14] (Microsoft Corporation)
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {14908674-644B-431B-9AD9-1402201BA13B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73A748F3-44ED-4D68-8B97-F5FF0EB5505D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-05] (Google Inc.)
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CB398E7-0D7A-4381-9CAC-5BA6959E92BC} - System32\Tasks\AdobeAAMUpdater-1.0-Yogi-PC-Yogi => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-12-10] (Adobe Systems Incorporated)
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {954C00BF-AC51-4765-9517-8753F2C192FD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-05] (Google Inc.)
Task: {9D4BA381-5421-44CA-828D-2A8FE831EEB7} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-12-13 12:20 - 2013-12-13 12:20 - 03359600 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
2012-06-18 16:24 - 2012-06-18 16:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2014-01-08 01:05 - 2014-01-07 05:04 - 00715544 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.72\libglesv2.dll
2014-01-08 01:05 - 2014-01-07 05:04 - 00100120 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.72\libegl.dll
2014-01-08 01:05 - 2014-01-07 05:05 - 04055320 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.72\pdf.dll
2014-01-08 01:05 - 2014-01-07 05:05 - 00399640 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.72\ppGoogleNaClPluginChrome.dll
2014-01-08 01:05 - 2014-01-07 05:04 - 01634584 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.72\ffmpegsumo.dll
2014-01-08 01:05 - 2014-01-07 05:05 - 13615896 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.72\PepperFlash\pepflashplayer.dll

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Could not start eventlog service, could not read events.

Der angeforderte Dienst wurde bereits gestartet.

Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 2182 eingeben.


==================== Memory info =========================== 

Percentage of memory in use: 21%
Total physical RAM: 16354.04 MB
Available physical RAM: 12911.06 MB
Total Pagefile: 18786.04 MB
Available Pagefile: 14613.9 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: (Volume) (Fixed) (Total:100.61 GB) (Free:42.07 GB) NTFS
Drive d: (Windows) (Fixed) (Total:465.76 GB) (Free:131.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Volume) (Fixed) (Total:209.59 GB) (Free:172.37 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 0468037F)
Partition 1: (Not Active) - (Size=210 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=350 MB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 939DD534)
Partition 1: (Not Active) - (Size=101 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 4D54A5A6)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================