Hallo,

seit mehreren Tagen arbeitet mein Laptop sehr langsam, dh Programm werden mit erheblicher zeitlicher Verzögerung geöffnet, das Hochfahren des Laptops dauert ca. 8 Minuten und beim Anschließen einer externen Speicherkarte mit Bildern reagiert er gar nicht mehr.
Seit gestern erhalte ich die Fehlermeldung:"windows hostprozess (Rundll32) funktioniert nicht mehr." Zudem ist der Windows Sicherheitscenter ausgeschaltet. Beim Klicken von der Taste "Einschalten" erscheint die Fehlermeldung:"Der Sicherheitscenterdienst konnte nicht gestartet werden."

GDATA Internet Secuirity (Firewall + Wächter) erkennt keine Virenbefall.
Windows Vista
ich nutze überwiegend Firefox

Veränderungen am System wurden von mir keine vorgenommen.

Die Anleitungen habe ich durchgelesen und folgende logs erstellt:
Schritt 1:
Laufwerksemulationen abschalten mit Defogger
Schritt 2:
Systemscan mit FRST
Schritt 3:
Scan mit GMER

Bei GMER erhielt ich folgende Fehlermeldung:
"GMER1957.exe - kein Datenträger Es befindet sich kein Datenträger im Laufwerk. Legen sie ein Datenträger in Laufwerk \Device\Harddisk1\DR2 ein



FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:17-05-2014
Ran by Andreas Wagner (administrator) on ANDREASWAGNER on 21-05-2014 11:16:24
Running from C:\Users\Andreas Wagner\Desktop
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(G Data Software AG) C:\Program Files\Common Files\G DATA\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files\G DATA\InternetSecurity\AVK\AVKWCtl.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files\G DATA\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc.exe
() C:\ProgramData\DatacardService\HWDeviceService.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(SEIKO EPSON CORPORATION) C:\Program Files\epson\MyEPSON Connect\mepService.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
() C:\Windows\System32\PSIService.exe
() C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.3\bin\postgres.exe
() C:\Program Files\Cyberlink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\8.3\bin\postgres.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(G Data Software AG) C:\Program Files\G DATA\InternetSecurity\Firewall\GDFwSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\epson\MyEPSON Connect\mep.exe
(G Data Software AG) C:\Program Files\G DATA\InternetSecurity\AVKTray\AVKTray.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(G Data Software AG) C:\Program Files\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe
() C:\Windows\tsnp2uvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Samsung Electronics.) C:\Program Files\Samsung Connection Manager\ModemPnPService.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(SEIKO EPSON CORPORATION) C:\Program Files\EPSON Software\Event Manager\EEventManager.exe
(G Data Software AG) C:\Program Files\G DATA\InternetSecurity\Firewall\GDFirewallTray.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\System32\WerFault.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files\MOZILLA FIREFOX\firefox.exe
(Dropbox, Inc.) C:\Users\Andreas Wagner\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Mozilla Corporation) C:\Program Files\MOZILLA FIREFOX\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [tsnp2uvc] => C:\Windows\tsnp2uvc.exe [233472 2008-08-28] ()
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [13605408 2009-02-10] (NVIDIA Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [1406024 2008-06-10] (Microsoft Corporation)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [55824 2009-06-17] (Logitech, Inc.)
HKLM\...\Run: [Blackcomb] => C:\Program Files\Samsung Connection Manager\ModemPnPService.exe [131072 2011-02-11] (Samsung Electronics.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM\...\Run: [EEventManager] => C:\Program Files\Epson Software\Event Manager\EEventManager.exe [1058880 2013-03-28] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files\G Data\InternetSecurity\AVKTray\AVKTray.exe
HKU\.DEFAULT\...\Run: [Bitdefender-Geldbörse-Agent] => "C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe"
HKU\.DEFAULT\...\Run: [Bitdefender-Geldbörse] => "C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe" --hidden --nowizard
HKU\.DEFAULT\...\Run: [Bitdefender-Geldbörse-Anwendungs-Agent] => "C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe"
HKU\S-1-5-21-1340235693-356929383-2439854242-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-1340235693-356929383-2439854242-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-1340235693-356929383-2439854242-1000\...\Run: [DataMgr] => C:\Users\Andreas Wagner\AppData\Roaming\DataMgr\DataMgr.exe [168824 2013-07-21] (HTTO Group, Ltd.)
HKU\S-1-5-21-1340235693-356929383-2439854242-1000\...\Run: [EPLTarget\P0000000000000002] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATILEE.EXE [260160 2013-01-24] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1340235693-356929383-2439854242-1000\...\Run: [CPN Notifier] => C:\Program Files\Cake Poker 2.0\PokerNotifier.exe
HKU\S-1-5-21-1340235693-356929383-2439854242-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-1340235693-356929383-2439854242-1001\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1340235693-356929383-2439854242-1001\...\RunOnce: [SetScreenSaver] - C:\Windows\System32\oobe\info\SetScreenSaver.lnk [772 2008-07-20] ()
Startup: C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Andreas Wagner\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA089FE85CE11CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope value is missing.
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Andreas Wagner\AppData\Roaming\Mozilla\Firefox\Profiles\f5ru44qx.default-1395400580471
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Andreas Wagner\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\Andreas Wagner\AppData\Roaming\Mozilla\Firefox\Profiles\f5ru44qx.default-1395400580471\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-24]
FF Extension: PrivacyChoice TrackerBlock - C:\Users\Andreas Wagner\AppData\Roaming\Mozilla\Firefox\Profiles\f5ru44qx.default-1395400580471\Extensions\trackerblock@privacychoice.org.xpi [2014-04-18]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [ffpwdman@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender\ffpwdman\

Chrome: 
=======
CHR HomePage: hxxp://search.fbdownloader.com/?channel=sfde203fbdgy21
CHR StartupUrls: "hxxp://search.fbdownloader.com/?channel=sfde203fbdgy21"
CHR DefaultSearchKeyword: search_the_web
CHR DefaultSearchProvider: Search the web
CHR DefaultSearchURL: hxxp://search.fbdownloader.com/search.php?channel=sfde203fbdgy21&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\33.0.1750.154\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.124\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Google Drive) - C:\Users\Andreas Wagner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-11-19]
CHR Extension: (YouTube) - C:\Users\Andreas Wagner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-19]
CHR Extension: (Google-Suche) - C:\Users\Andreas Wagner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-19]
CHR Extension: (OfferMosquito) - C:\Users\Andreas Wagner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbmdkmlcnbapgegninelmjbfibaghdmk [2013-07-30]
CHR Extension: (Google Wallet) - C:\Users\Andreas Wagner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-07]
CHR Extension: (Google Mail) - C:\Users\Andreas Wagner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-11-19]
CHR HKCU\...\Chrome\Extension: [gbmdkmlcnbapgegninelmjbfibaghdmk] - C:\Users\Andreas Wagner\AppData\Local\Google\Chrome\User Data\Default\ext_offermosquito\ext_offermosquito.crx [2013-07-19]

========================== Services (Whitelisted) =================

R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files\G Data\InternetSecurity\AVK\AVKWCtl.exe [2159472 2014-03-25] (G Data Software AG)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc.exe [126128 2012-05-17] (Seiko Epson Corporation)
R2 GDFwSvc; C:\Program Files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [2409280 2014-01-30] (G Data Software AG)
R2 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] ()
S2 Mobile Partner. RunOuc; C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [239968 2014-01-18] ()
S4 MSSQLServerADHelper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
R2 MyEPSON Connect Service; C:\Program Files\EPSON\MyEPSON Connect\mepService.exe [703616 2012-10-01] (SEIKO EPSON CORPORATION)
R2 pgsql-8.3; C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe [65536 2008-09-19] (PostgreSQL Global Development Group)
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
R2 resetWinService; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [70656 2008-10-29] ()
R2 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [247152 2009-02-25] ()

==================== Drivers (Whitelisted) ====================

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-12-22] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-26] (AVM Berlin)
S3 C2XXCOM; C:\Windows\System32\DRIVERS\C2XXCOMV3.sys [38784 2010-08-09] (Samsung Electronics)
S3 C2xxUSB; C:\Windows\System32\DRIVERS\C2xxUSBV3.sys [36352 2010-11-04] (Samsung Electronics)
S3 C2xxUsbStorage; C:\Windows\System32\DRIVERS\C2xSTRV3.sys [6656 2010-06-10] (Samsung Electronics)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [44544 2014-04-04] (G Data Software AG)
R3 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt32.sys [20736 2014-04-04] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [101504 2014-04-04] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [56832 2014-04-04] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [53248 2014-04-04] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [29528 2014-04-04] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [50176 2014-04-04] (G Data Software AG)
R3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [40720 2009-06-17] (Logitech, Inc.)
R3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [10384 2009-06-17] (Logitech, Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-12-22] ()
S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [552448 2007-08-15] (Ralink Technology Corp.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799808 2008-12-29] ()
S3 WINIO; C:\Windows\system32\WinIo.sys [0 2009-09-03] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\ANDREA~1\AppData\Local\Temp\catchme.sys [X]
S3 Fadpu16E; \??\C:\Users\ADMINI~1\AppData\Local\Temp\Fadpu16E.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 uxddrv; \??\G:\uxddrv86.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-21 11:04 - 2014-05-21 11:16 - 00021771 _____ () C:\Users\Andreas Wagner\Desktop\FRST.txt
2014-05-21 11:02 - 2014-05-21 11:02 - 01056768 _____ (Farbar) C:\Users\Andreas Wagner\Desktop\FRST.exe
2014-05-21 11:00 - 2014-05-21 11:01 - 00000490 _____ () C:\Users\Andreas Wagner\Desktop\defogger_disable.log
2014-05-21 11:00 - 2014-05-21 11:00 - 00000000 _____ () C:\Users\Andreas Wagner\defogger_reenable
2014-05-21 10:58 - 2014-05-21 10:58 - 00050477 _____ () C:\Users\Andreas Wagner\Desktop\Defogger.exe
2014-05-19 16:41 - 2014-05-19 16:41 - 00000898 _____ () C:\Users\Andreas Wagner\Desktop\Win Cake.lnk
2014-05-19 16:41 - 2014-05-19 16:41 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Win Cake
2014-05-17 16:21 - 2014-05-17 16:21 - 00000000 ____D () C:\Users\Andreas Wagner\Desktop\Sophia
2014-05-17 08:27 - 2014-05-17 08:29 - 00000344 _____ () C:\Users\Andreas Wagner\Documents\pgadmin.log
2014-05-16 07:35 - 2014-05-16 07:35 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-16 07:31 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-16 07:31 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-16 07:31 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 06:49 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 06:18 - 2014-05-17 16:33 - 00003980 _____ () C:\Windows\setupact.log
2014-05-15 06:18 - 2014-05-15 06:18 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-12 22:11 - 2014-05-12 22:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\partypoker
2014-05-10 10:21 - 2014-05-10 10:23 - 00000000 ____D () C:\Program Files\MOZILLA FIREFOX
2014-05-09 15:22 - 2014-05-09 16:30 - 00000000 ____D () C:\Users\Andreas Wagner\Top B
2014-05-09 15:21 - 2014-05-09 15:21 - 00000000 ____D () C:\Users\Andreas Wagner\Neuer Ordner
2014-05-06 15:17 - 2014-05-06 15:17 - 00001686 _____ () C:\Users\Andreas Wagner\Documents\cc_20140506_151651.reg
2014-05-01 16:22 - 2014-05-01 16:23 - 00009158 _____ () C:\Users\Andreas Wagner\Documents\Mai 2014.xlsx
2014-05-01 00:04 - 2014-05-01 00:04 - 00000774 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ladbrokes Poker.lnk
2014-05-01 00:04 - 2014-05-01 00:04 - 00000744 _____ () C:\Users\Andreas Wagner\Desktop\Ladbrokes Poker.lnk
2014-05-01 00:03 - 2014-05-01 00:03 - 00457528 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\PokerSetup_3f9ece.exe
2014-04-30 23:40 - 2014-04-30 23:40 - 00000792 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Betfair.com Poker.lnk
2014-04-30 23:40 - 2014-04-30 23:40 - 00000762 _____ () C:\Users\Andreas Wagner\Desktop\Betfair.com Poker.lnk
2014-04-30 23:38 - 2014-04-30 23:38 - 00286520 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\SetupPoker_b8e1fb.exe
2014-04-30 22:58 - 2014-04-30 22:58 - 00501048 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\SetupPoker_48c40.exe
2014-04-29 23:11 - 2014-04-29 23:11 - 00001663 _____ () C:\Users\Andreas Wagner\Desktop\Titan Poker.lnk
2014-04-29 23:09 - 2014-04-30 21:41 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Local\Titan Poker
2014-04-29 18:36 - 2014-04-29 18:41 - 00001814 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Betway Poker.lnk
2014-04-29 18:36 - 2014-04-29 18:41 - 00001808 _____ () C:\Users\Public\Desktop\Betway Poker.lnk
2014-04-29 18:36 - 2014-04-29 18:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Betway Poker
2014-04-29 18:34 - 2014-04-29 18:34 - 00983134 _____ () C:\Users\Andreas Wagner\Downloads\betwaypoker.exe
2014-04-29 11:57 - 2014-04-29 11:57 - 00000755 _____ () C:\Users\Andreas Wagner\Desktop\EverestPoker.com.lnk
2014-04-29 10:59 - 2014-04-29 11:00 - 00616760 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\WinnerPSetup_73acf1.exe
2014-04-28 22:45 - 2014-04-28 22:45 - 00000728 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\myBet Poker.lnk
2014-04-28 22:45 - 2014-04-28 22:45 - 00000716 _____ () C:\Users\Public\Desktop\myBet Poker.lnk
2014-04-28 22:43 - 2014-04-28 22:43 - 00271160 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\SetupCasino_a21255.exe
2014-04-25 11:32 - 2014-04-25 11:32 - 00009324 _____ () C:\Users\Andreas Wagner\Documents\cc_20140425_113149.reg
2014-04-24 15:28 - 2014-04-29 11:51 - 00332128 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\SetupPoker.exe
2014-04-24 12:18 - 2014-04-25 15:23 - 00012503 _____ () C:\Users\Andreas Wagner\Documents\Kaderförderung geändert.xlsx
2014-04-24 09:08 - 2014-04-24 12:17 - 00013910 _____ () C:\Users\Andreas Wagner\Documents\Kaderförderung.xlsx

==================== One Month Modified Files and Folders =======

2014-05-21 11:16 - 2014-05-21 11:04 - 00021771 _____ () C:\Users\Andreas Wagner\Desktop\FRST.txt
2014-05-21 11:16 - 2013-10-07 13:00 - 00000000 ____D () C:\FRST
2014-05-21 11:11 - 2014-02-26 09:11 - 00000731 _____ () C:\Windows\Tasks\EPSON XP-412 413 415 Series Invitation {1974A753-ABB1-427D-B6C8-1D09A1EB9BDD}.job
2014-05-21 11:11 - 2010-05-30 11:19 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Roaming\Skype
2014-05-21 11:10 - 2014-02-26 09:10 - 00000917 _____ () C:\Windows\Tasks\EPSON XP-412 413 415 Series Update {1974A753-ABB1-427D-B6C8-1D09A1EB9BDD}.job
2014-05-21 11:04 - 2014-02-26 12:04 - 00000917 _____ () C:\Windows\Tasks\EPSON XP-412 413 415 Series Update {F6506E58-0381-4259-B6C1-A7EF74CA41C9}.job
2014-05-21 11:04 - 2014-02-26 12:04 - 00000731 _____ () C:\Windows\Tasks\EPSON XP-412 413 415 Series Invitation {F6506E58-0381-4259-B6C1-A7EF74CA41C9}.job
2014-05-21 11:02 - 2014-05-21 11:02 - 01056768 _____ (Farbar) C:\Users\Andreas Wagner\Desktop\FRST.exe
2014-05-21 11:02 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-21 11:02 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-21 11:01 - 2014-05-21 11:00 - 00000490 _____ () C:\Users\Andreas Wagner\Desktop\defogger_disable.log
2014-05-21 11:00 - 2014-05-21 11:00 - 00000000 _____ () C:\Users\Andreas Wagner\defogger_reenable
2014-05-21 11:00 - 2009-06-27 20:35 - 00000000 ____D () C:\Users\Andreas Wagner
2014-05-21 10:58 - 2014-05-21 10:58 - 00050477 _____ () C:\Users\Andreas Wagner\Desktop\Defogger.exe
2014-05-21 10:58 - 2013-03-18 15:48 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Roaming\HoldemManager
2014-05-21 10:44 - 2012-10-07 10:37 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-21 10:21 - 2014-03-12 16:21 - 00000731 _____ () C:\Windows\Tasks\EPSON XP-412 413 415 Series Invitation {CADB9165-D1C7-46CC-93BF-A8A4DEB93ED3}.job
2014-05-21 10:20 - 2014-03-12 16:21 - 00000917 _____ () C:\Windows\Tasks\EPSON XP-412 413 415 Series Update {CADB9165-D1C7-46CC-93BF-A8A4DEB93ED3}.job
2014-05-21 09:13 - 2011-01-10 20:37 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Roaming\Microgaming
2014-05-21 09:10 - 2009-06-27 20:31 - 01172743 _____ () C:\Windows\WindowsUpdate.log
2014-05-21 08:59 - 2009-03-02 15:15 - 00131216 _____ () C:\ProgramData\nvModes.dat
2014-05-21 08:59 - 2009-03-02 15:15 - 00131216 _____ () C:\ProgramData\nvModes.001
2014-05-21 07:26 - 2014-02-04 22:46 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Roaming\Dropbox
2014-05-21 07:25 - 2014-02-04 22:52 - 00000000 ___RD () C:\Users\Andreas Wagner\Dropbox
2014-05-21 07:02 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-20 23:01 - 2006-11-02 15:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-20 22:14 - 2010-09-22 22:32 - 00000000 ____D () C:\Users\Andreas Wagner\dwhelper
2014-05-20 14:29 - 2012-11-13 23:48 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Local\PokerStars.EU
2014-05-20 14:29 - 2012-08-14 20:56 - 02727271 _____ () C:\blitzerr.txt
2014-05-19 16:41 - 2014-05-19 16:41 - 00000898 _____ () C:\Users\Andreas Wagner\Desktop\Win Cake.lnk
2014-05-19 16:41 - 2014-05-19 16:41 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Win Cake
2014-05-19 16:41 - 2012-11-13 09:38 - 00000000 ____D () C:\Program Files\Cake Poker 2.0
2014-05-17 23:48 - 2013-03-18 17:24 - 00015800 _____ () C:\speederr.txt
2014-05-17 16:33 - 2014-05-15 06:18 - 00003980 _____ () C:\Windows\setupact.log
2014-05-17 16:21 - 2014-05-17 16:21 - 00000000 ____D () C:\Users\Andreas Wagner\Desktop\Sophia
2014-05-17 08:29 - 2014-05-17 08:27 - 00000344 _____ () C:\Users\Andreas Wagner\Documents\pgadmin.log
2014-05-16 09:11 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-16 07:46 - 2009-02-26 21:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-16 07:45 - 2014-01-16 09:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-16 07:37 - 2006-11-02 12:24 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-05-16 07:35 - 2014-05-16 07:35 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-15 17:24 - 2011-11-24 23:01 - 00000000 ____D () C:\Users\Andreas Wagner\Documents\LuckyAcePoker
2014-05-15 06:30 - 2014-02-04 22:52 - 00001003 _____ () C:\Users\Andreas Wagner\Desktop\Dropbox.lnk
2014-05-15 06:30 - 2014-02-04 22:49 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-15 06:18 - 2014-05-15 06:18 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-14 08:46 - 2012-07-16 21:51 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-14 08:46 - 2011-10-07 08:55 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-13 14:55 - 2013-02-25 22:56 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Local\FullTiltPoker.eu
2014-05-13 14:31 - 2013-07-17 22:55 - 02120848 _____ () C:\rusherr.txt
2014-05-13 14:31 - 2013-02-25 22:53 - 00000000 ____D () C:\Program Files\Full Tilt Poker.Eu
2014-05-12 22:11 - 2014-05-12 22:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\partypoker
2014-05-12 22:11 - 2014-04-15 18:50 - 00001485 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\partypoker.lnk
2014-05-12 22:11 - 2014-04-15 18:50 - 00001479 _____ () C:\Users\Andreas Wagner\Desktop\partypoker.lnk
2014-05-12 22:11 - 2006-11-02 14:37 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-05-11 18:34 - 2012-08-16 11:22 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-10 10:23 - 2014-05-10 10:21 - 00000000 ____D () C:\Program Files\MOZILLA FIREFOX
2014-05-09 16:30 - 2014-05-09 15:22 - 00000000 ____D () C:\Users\Andreas Wagner\Top B
2014-05-09 15:21 - 2014-05-09 15:21 - 00000000 ____D () C:\Users\Andreas Wagner\Neuer Ordner
2014-05-07 20:14 - 2012-11-19 22:24 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-07 20:14 - 2012-11-19 22:24 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-07 08:54 - 2014-01-07 01:24 - 00000930 _____ () C:\Users\Public\Desktop\HoldemManager2.lnk
2014-05-07 08:54 - 2013-03-18 15:43 - 00000000 ____D () C:\Program Files\Holdem Manager 2
2014-05-06 18:32 - 2012-10-01 10:14 - 02437984 _____ () C:\Users\Andreas Wagner\Documents\Poker Konten11.xlsx
2014-05-06 15:17 - 2014-05-06 15:17 - 00001686 _____ () C:\Users\Andreas Wagner\Documents\cc_20140506_151651.reg
2014-05-06 01:32 - 2014-05-16 07:31 - 12347392 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 01:14 - 2014-05-16 07:31 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 01:14 - 2014-05-16 07:31 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-01 16:23 - 2014-05-01 16:22 - 00009158 _____ () C:\Users\Andreas Wagner\Documents\Mai 2014.xlsx
2014-05-01 00:04 - 2014-05-01 00:04 - 00000774 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ladbrokes Poker.lnk
2014-05-01 00:04 - 2014-05-01 00:04 - 00000744 _____ () C:\Users\Andreas Wagner\Desktop\Ladbrokes Poker.lnk
2014-05-01 00:04 - 2009-06-27 22:13 - 00000000 ____D () C:\Poker
2014-05-01 00:03 - 2014-05-01 00:03 - 00457528 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\PokerSetup_3f9ece.exe
2014-04-30 23:40 - 2014-04-30 23:40 - 00000792 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Betfair.com Poker.lnk
2014-04-30 23:40 - 2014-04-30 23:40 - 00000762 _____ () C:\Users\Andreas Wagner\Desktop\Betfair.com Poker.lnk
2014-04-30 23:38 - 2014-04-30 23:38 - 00286520 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\SetupPoker_b8e1fb.exe
2014-04-30 23:23 - 2011-08-21 10:39 - 00000760 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Betfred Poker.lnk
2014-04-30 23:23 - 2011-08-21 10:39 - 00000730 _____ () C:\Users\Andreas Wagner\Desktop\Betfred Poker.lnk
2014-04-30 23:17 - 2013-07-18 10:55 - 00289080 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\SetupPoker_25ed.exe
2014-04-30 23:00 - 2013-11-06 01:06 - 00000795 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\William Hill Poker.lnk
2014-04-30 23:00 - 2013-11-06 01:06 - 00000765 _____ () C:\Users\Andreas Wagner\Desktop\William Hill Poker.lnk
2014-04-30 22:58 - 2014-04-30 22:58 - 00501048 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\SetupPoker_48c40.exe
2014-04-30 21:41 - 2014-04-29 23:09 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Local\Titan Poker
2014-04-29 23:11 - 2014-04-29 23:11 - 00001663 _____ () C:\Users\Andreas Wagner\Desktop\Titan Poker.lnk
2014-04-29 23:11 - 2012-08-31 08:14 - 00001665 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Titan Poker.lnk
2014-04-29 19:30 - 2010-09-20 08:07 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Roaming\vlc
2014-04-29 18:41 - 2014-04-29 18:36 - 00001814 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Betway Poker.lnk
2014-04-29 18:41 - 2014-04-29 18:36 - 00001808 _____ () C:\Users\Public\Desktop\Betway Poker.lnk
2014-04-29 18:41 - 2014-04-29 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Betway Poker
2014-04-29 18:34 - 2014-04-29 18:34 - 00983134 _____ () C:\Users\Andreas Wagner\Downloads\betwaypoker.exe
2014-04-29 11:57 - 2014-04-29 11:57 - 00000755 _____ () C:\Users\Andreas Wagner\Desktop\EverestPoker.com.lnk
2014-04-29 11:57 - 2013-11-28 17:26 - 00000785 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EverestPoker.com.lnk
2014-04-29 11:51 - 2014-04-24 15:28 - 00332128 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\SetupPoker.exe
2014-04-29 11:04 - 2012-09-02 12:27 - 00000753 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winner Poker.lnk
2014-04-29 11:04 - 2012-09-02 12:27 - 00000723 _____ () C:\Users\Andreas Wagner\Desktop\Winner Poker.lnk
2014-04-29 11:00 - 2014-04-29 10:59 - 00616760 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\WinnerPSetup_73acf1.exe
2014-04-28 22:55 - 2013-12-05 22:41 - 00002353 _____ () C:\Users\Andreas Wagner\AppData\Roaming\fotobuch.xml
2014-04-28 22:53 - 2013-12-05 22:32 - 00549384 _____ () C:\Users\Andreas Wagner\AppData\Roaming\fotobuch-tcache.xml
2014-04-28 22:45 - 2014-04-28 22:45 - 00000728 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\myBet Poker.lnk
2014-04-28 22:45 - 2014-04-28 22:45 - 00000716 _____ () C:\Users\Public\Desktop\myBet Poker.lnk
2014-04-28 22:43 - 2014-04-28 22:43 - 00271160 _____ (Playtech) C:\Users\Andreas Wagner\Downloads\SetupCasino_a21255.exe
2014-04-28 14:27 - 2014-02-04 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2014-04-28 13:03 - 2014-02-06 13:59 - 00111551 _____ () C:\Users\Andreas Wagner\Documents\Reisekosten RHH 2014 I.xlsx
2014-04-25 15:23 - 2014-04-24 12:18 - 00012503 _____ () C:\Users\Andreas Wagner\Documents\Kaderförderung geändert.xlsx
2014-04-25 11:32 - 2014-04-25 11:32 - 00009324 _____ () C:\Users\Andreas Wagner\Documents\cc_20140425_113149.reg
2014-04-25 10:36 - 2014-02-15 01:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Poker Heaven by Microgaming
2014-04-25 10:36 - 2012-11-22 11:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RedKings Poker
2014-04-25 10:36 - 2012-08-21 16:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Heypoker
2014-04-24 15:31 - 2013-07-06 10:28 - 00000732 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Poker 770.lnk
2014-04-24 15:31 - 2013-07-06 10:28 - 00000702 _____ () C:\Users\Andreas Wagner\Desktop\Poker 770.lnk
2014-04-24 12:17 - 2014-04-24 09:08 - 00013910 _____ () C:\Users\Andreas Wagner\Documents\Kaderförderung.xlsx
2014-04-24 08:59 - 2010-03-15 12:04 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Local\Microsoft Help
2014-04-23 08:20 - 2009-06-30 12:49 - 00000000 ____D () C:\Users\Andreas Wagner\AppData\Local\Adobe
2014-04-22 15:18 - 2013-04-01 08:24 - 00000746 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Coral Poker.lnk
2014-04-22 15:18 - 2013-04-01 08:24 - 00000716 _____ () C:\Users\Andreas Wagner\Desktop\Coral Poker.lnk

Some content of TEMP:
====================
C:\Users\Andreas Wagner\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphgfkms.dll
C:\Users\Andreas Wagner\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-20 18:27

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x86) Version:17-05-2014
Ran by Andreas Wagner at 2014-05-21 11:17:32
Running from C:\Users\Andreas Wagner\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================


==================== Installed Programs ======================

24hPoker (HKLM\...\1180-6883-2514-0226-24hPoker-PROD) (Version: 54.0.31226-30520-7 - IGT Interactive AB)
24hPoker (HKLM\...\24hPoker (Poker)) (Version: 16.6.2.11243 - )
7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
888poker (HKLM\...\888poker) (Version:  - )
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.7.0.1860 - Adobe Systems Incorporated)
Adobe AIR (Version: 3.7.0.1860 - Adobe Systems Incorporated) Hidden
Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.6 - Adobe Systems Incorporated)
Adobe Download Assistant (Version: 1.2.6 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.8) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.8 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM\...\Adobe Shockwave Player) (Version: 11.6.7.637 - Adobe Systems, Inc.)
Amazon MP3-Downloader 1.0.18 (HKCU\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
Apple Application Support (HKLM\...\{A922C4B7-50E0-4787-A94C-59DBF3C65DBE}) (Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{10E3A6DD-84D8-4D8A-BB11-5E5314BCA7FD}) (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Badaboom 1.1.1.194 (HKLM\...\Badaboom) (Version: 1.1.1.194 - Elemental Technologies)
Betfair.com Poker (HKCU\...\Betfair.com Poker) (Version:  - )
Betfred Poker (HKCU\...\Betfred Poker) (Version:  - )
BetMost Poker (HKCU\...\BetMost Poker) (Version:  - )
Betway Poker (HKLM\...\Betwaypoker (Poker)) (Version: 16.6.2.11243 - )
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
bwin Poker (HKLM\...\bwincomPoker) (Version:  - bwincom)
Cake Poker 2.0 (HKLM\...\Cake Poker 2.0) (Version: 2.0.1.6506 - Cake Poker N.V.)
Canon Camera Window DC_DV 6 for ZoomBrowser EX (HKLM\...\CameraWindowDVC6) (Version: 6.4.0.9 - )
Canon Camera Window MC 6 for ZoomBrowser EX (HKLM\...\CameraWindowMC) (Version: 6.3.0.8 - )
Canon G.726 WMP-Decoder (HKLM\...\Canon G.726 WMP-Decoder) (Version: 1.1.0.4 - )
CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM\...\CANON iMAGE GATEWAY Task) (Version: 1.3.1.5 - )
Canon Internet Library for ZoomBrowser EX (HKLM\...\Canon Internet Library for ZoomBrowser EX) (Version: 1.5.1.4 - )
Canon MovieEdit Task for ZoomBrowser EX (HKLM\...\MovieEditTask) (Version: 2.4.0.14 - )
Canon RAW Image Task for ZoomBrowser EX (HKLM\...\RAW Image Task) (Version: 2.6.0.13 - )
Canon RemoteCapture Task for ZoomBrowser EX (HKLM\...\RemoteCaptureTask) (Version: 1.7.0.8 - )
Canon Utilities PhotoStitch (HKLM\...\PhotoStitch) (Version: 3.1.19.43 - )
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 5.8.0.74 - )
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
CDDRV_Installer (Version: 4.60 - Logitech) Hidden
Choice Guard (Version: 1.2.87.0 - Microsoft Corporation) Hidden
Comeon Poker 2.0 (HKLM\...\Comeon Poker 2.0) (Version: 2.0.1.6587 - Comeon Poker)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Coral Poker (HKCU\...\Coral Poker) (Version:  - )
Corel MediaOne (HKLM\...\{A062A15F-9CAC-4B88-98DF-87628A0BD721}) (Version: 2.00.0000 - Corel Corporation)
CorelDRAW Essential Edition 3 (Version: 3.0 - Corel Corporation) Hidden
CyberLink MediaShow (HKLM\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 4.1.2325 - CyberLink Corp.)
CyberLink MediaShow (Version: 4.1.2325 - CyberLink Corp.) Hidden
CyberLink PhotoNow (HKLM\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.5615 - CyberLink Corp.)
CyberLink PhotoNow (Version: 1.1.5615 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2625 - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.2625 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2606a - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2606a - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1412 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.1.1412 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.2521 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.2521 - CyberLink Corp.) Hidden
DE (Version: 3.0 - Corel Corporation) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.6.33 - Dropbox, Inc.)
Epson Connect Printer Setup (HKLM\...\{D9B1D51B-EB56-410D-AEB5-1CCFAC4B6C8C}) (Version: 1.1.1 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM\...\{2970697F-2A11-4588-8B7F-97322D1CCF3C}) (Version: 3.10.0017 - Seiko Epson Corporation)
EPSON Scan (HKLM\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON XP-412 413 415 Series Printer Uninstall (HKLM\...\EPSON XP-412 413 415 Series) (Version:  - SEIKO EPSON Corporation)
EPSON-Handbücher (HKLM\...\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 1.0.1.0 - SEIKO EPSON CORPORATION)
EpsonNet Print (HKLM\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
erLT (Version: 1.20.0137 - Logitech, Inc.) Hidden
EverestPoker.com (HKCU\...\EverestPoker.com) (Version:  - )
fotokasten comfort (HKLM\...\FKC22153088_is1) (Version:  - )
Full Tilt Poker.Eu (HKLM\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 4.55.4.WIN.FullTilt.EU - )
FUSSBALL MANAGER 06 (HKLM\...\{DFB5612F-AF7E-4CB3-00AB-3C0CD2520B29}) (Version:  - )
G Data InternetSecurity (HKLM\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.1.2 - G Data Software AG)
Gala Casino Poker (HKCU\...\Gala Casino Poker) (Version:  - )
GKFX FX - CFDs (HKLM\...\GKFX FX - CFDs) (Version: 4.00 - MetaQuotes Software Corp.)
Google Chrome (HKLM\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
Hama Wireless LAN Adapter (HKLM\...\{E91E8912-769D-42F0-8408-0E329443BABC}) (Version: 1.00.0000 - Hama)
HM Cloud HUD (HKLM\...\HM Cloud HUD) (Version:  - )
Holdem Manager (HKLM\...\{42DE940E-8037-4266-9FBF-5A3AEDA39E96}) (Version: 1.07 - RVG Software)
Holdem Manager (HKLM\...\HoldemManager) (Version:  - )
Holdem Manager 2 (HKLM\...\HoldemManager2) (Version:  - )
HoldemResources Calculator (HKLM\...\HoldemResources Calculator) (Version: release - HoldemResources)
InterPoker 1.0.0 (HKLM\...\InterPoker_is1) (Version: 1.0.0 - Interpoker)
iTunes (HKLM\...\{616445AF-BBCF-41C1-A4D6-8CFF171C182D}) (Version: 11.1.4.62 - Apple Inc.)
Java 7 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.450 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (HKLM\...\7289-1030-5602-7421) (Version: 0.9 - AppWork GmbH)
join.me (HKCU\...\JoinMe) (Version: 1.9.0.133 - LogMeIn, Inc.)
Junk Mail filter update (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
KeePass Password Safe 1.23 (HKLM\...\KeePass Password Safe_is1) (Version: 1.23 - Dominik Reichl)
KhalInstallWrapper (Version: 2.00.0000 - Logitech) Hidden
Ladbrokes Poker (HKCU\...\Ladbrokes Poker) (Version:  - )
Ladbrokes Poker (HKLM\...\ladbrokes (Poker)) (Version: 16.3.2.9976 - )
Logitech SetPoint (HKLM\...\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}) (Version: 4.80 - Logitech)
LuckyAcePoker.com (HKLM\...\LuckyAcePoker.com) (Version:  - )
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft IntelliPoint 6.3 (HKLM\...\{66A9D30D-1464-4C7F-B2F3-507DADAF2595}) (Version: 6.30.191.0 - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook 2007 (HKLM\...\OUTLOOKR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (HKLM\...\{95140000-0081-0407-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS) (Version: 9.4.5000.00 - Microsoft Corporation) Hidden
Microsoft SQL Server Native Client (HKLM\...\{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{FDE96E86-7780-431C-92F7-679C6A7CEC51}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mobile Partner (HKLM\...\Mobile Partner) (Version: 21.005.15.02.382 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
my moments (HKCU\...\mymoments) (Version: 2.6.5.0 - my moments Fotobuch Verlag GmbH & Co. KG)
myBet Poker (HKLM\...\myBet Poker) (Version:  - )
MyEPSON Portal (HKLM\...\MyEPSON Connect) (Version:  - SEIKO EPSON Corporation)
MyEPSON Portal (Version: 1.0.4.0 - SEIKO EPSON CORPORATION) Hidden
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
neroxml (Version: 1.0.0 - Nero AG) Hidden
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
Paf Spade Poker 1.0.0 (HKLM\...\Paf Spade Poker_is1) (Version: 1.0.0 - Paf)
partypoker (HKLM\...\PartyPoker) (Version:  - PartyGaming)
pgAdmin III 1.10 (HKLM\...\{30DE52AF-3186-4396-883B-E3AFC7E522BB}) (Version: 1.10 - The pgAdmin Development Team)
PKR (HKLM\...\PKR) (Version:  - PKR Ltd)
Poker (HKCU\...\Poker) (Version:  - )
Poker 770 (HKCU\...\Poker 770) (Version:  - )
Poker Heaven (HKLM\...\Poker Heaven) (Version:  - )
Poker Heaven by Microgaming (HKLM\...\pokerheaven (Poker)) (Version: 16.6.2.11243 - )
PokerHeaven by Ongame 1.0.0 (HKLM\...\PokerHeaven by Ongame_is1) (Version: 1.0.0 - Heaven Bet)
PokerStars (HKLM\...\PokerStars) (Version:  - PokerStars)
PokerStars.fr (HKLM\...\PokerStars.fr) (Version:  - PokerStars.fr)
PokerStrategy.com Equilab (HKLM\...\{86D09F48-CDAB-4B4C-8806-F6C16F17935A}) (Version: 1.2.8.0 - PokerStrategy.com)
PokerTracker 4 (remove only) (HKLM\...\PokerTracker4) (Version:  - )
PostgreSQL 8.3 (HKLM\...\{B823632F-3B72-4514-8861-B961CE263224}) (Version: 8.3 - PostgreSQL Global Development Group)
QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5730 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 6.0.6000.20111 - Realtek Semiconductor Corp.)
Redmark Vereinsverwaltung easy (HKLM\...\{06A75F9F-BB8B-4548-93F8-621A183536D2}) (Version: 8.0 - Ihr Firmenname)
Samsung Connection Manager (HKLM\...\{F3F95061-0427-4386-AB03-1556CBE52927}) (Version: 112 - Samsung Electronics)
SENSUS MT4 Client Terminal (HKLM\...\SENSUS MT4 Client Terminal) (Version: 4.00 - MetaQuotes Software Corp.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartFTP Client (HKLM\...\{D48175EA-1AA1-436C-B0AC-BC36CB6FE9FA}) (Version: 4.1.1321.0 - SmartSoft Ltd.)
Software Updater (HKLM\...\{C09D747A-BD47-42A9-915E-CEB6B1BB7C11}) (Version: 4.2.7 - SEIKO EPSON CORPORATION)
StarMoney (Version: 1.0 - StarFinanz) Hidden
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamViewer 8 (HKLM\...\TeamViewer 8) (Version: 8.0.16447 - TeamViewer)
Titan Poker (HKCU\...\Titan Poker) (Version:  - )
Unibet (HKLM\...\unibetpoker (Poker)) (Version: 16.6.2.11243 - )
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.5000.00 - Microsoft Corporation)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_OUTLOOKR_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_OUTLOOKR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update Manager (Version: 4.60 - Corel Corporation) Hidden
USB Video Device (HKLM\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.51000.200_WHQL - Sonix)
VCRedistSetup (Version: 1.0.0 - Nero AG) Hidden
VLC media player 2.0.7 (HKLM\...\VLC media player) (Version: 2.0.7 - VideoLAN)
William Hill Poker (HKCU\...\William Hill Poker) (Version:  - )
Win Cake (HKLM\...\Win Cake) (Version: 2.0.1.7462 - Cake Entertainment N.V.)
Windows Live Anmelde-Assistent (HKLM\...\{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}) (Version: 5.000.818.6 - Microsoft Corporation)
Windows Live Call (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8051.1204 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{8C1E2925-14F8-45AA-B999-1E2A74BF5607}) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Winner Poker (HKCU\...\winnerpoker) (Version:  - )
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
WPT Poker (HKLM\...\WPTPoker) (Version:  - WPT)

==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

2006-11-02 12:23 - 2013-10-08 16:56 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0A6798D4-9AA2-4276-9EC5-9E326A7D95DC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {1C51E2C6-42A7-4F44-B61B-A59329087C8F} - System32\Tasks\{C5DA12E5-BDA2-4A49-9374-B15DC81F84F6} => Firefox.exe hxxp://ui.skype.com/ui/0/5.3.0.111.217/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;alreadyoffered
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1E05D7F5-5D2B-4E57-B247-11FE620505BA} - System32\Tasks\{F49FD84B-8610-4C34-99CF-1D17EC9B25FC} => Firefox.exe hxxp://ui.skype.com/ui/0/5.3.0.111.217/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:offered-installed;madedefault
Task: {1F6323AC-502E-413A-8FE1-BCF9B8898DE5} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {333A1D92-0F60-45DF-82A3-F8CEE41CA1C0} - System32\Tasks\EPSON XP-412 413 415 Series Update {CADB9165-D1C7-46CC-93BF-A8A4DEB93ED3} => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {3F8BEF76-D230-469C-BE3F-9C95BB224114} - System32\Tasks\EPSON XP-412 413 415 Series Invitation {1974A753-ABB1-427D-B6C8-1D09A1EB9BDD} => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {4B6A5E64-650F-46A9-B963-17F7B2E9D8A3} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {565DA20E-2649-4709-BAEF-AAD3F2D74376} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-11-19] (Google Inc.)
Task: {5DCC4E13-F343-4E75-BD83-62684ACE28E7} - System32\Tasks\EPSON XP-412 413 415 Series Update {1974A753-ABB1-427D-B6C8-1D09A1EB9BDD} => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {5E362009-664B-4BBC-87D5-77B07297D0BC} - System32\Tasks\{ECDCB764-0038-4EE4-8CC3-E7DE5604C198} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {687F1C5C-B797-4256-8351-5AAB8CAC6B69} - System32\Tasks\EPSON XP-412 413 415 Series Invitation {F6506E58-0381-4259-B6C1-A7EF74CA41C9} => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {861C78C5-3712-4FFC-BF95-D742A81DF44A} - System32\Tasks\EPSON XP-412 413 415 Series Update {F6506E58-0381-4259-B6C1-A7EF74CA41C9} => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {A3EB9CB5-4D36-492D-85AF-4015136DB9D0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {A8E398C2-8F99-457D-8A1B-C0430325A176} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-11-19] (Google Inc.)
Task: {E495A3B7-53AF-48D7-B366-8801021932BC} - System32\Tasks\EPSON XP-412 413 415 Series Invitation {CADB9165-D1C7-46CC-93BF-A8A4DEB93ED3} => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {EA2C60FF-7B09-4697-BB92-BE9F118F8C4D} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2008-06-10] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\EPSON XP-412 413 415 Series Invitation {1974A753-ABB1-427D-B6C8-1D09A1EB9BDD}.job => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE
Task: C:\Windows\Tasks\EPSON XP-412 413 415 Series Invitation {CADB9165-D1C7-46CC-93BF-A8A4DEB93ED3}.job => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE
Task: C:\Windows\Tasks\EPSON XP-412 413 415 Series Invitation {F6506E58-0381-4259-B6C1-A7EF74CA41C9}.job => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE
Task: C:\Windows\Tasks\EPSON XP-412 413 415 Series Update {1974A753-ABB1-427D-B6C8-1D09A1EB9BDD}.job => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE
Task: C:\Windows\Tasks\EPSON XP-412 413 415 Series Update {CADB9165-D1C7-46CC-93BF-A8A4DEB93ED3}.job => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE
Task: C:\Windows\Tasks\EPSON XP-412 413 415 Series Update {F6506E58-0381-4259-B6C1-A7EF74CA41C9}.job => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FTSLEE.EXE
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-03-14 17:27 - 2011-03-14 17:27 - 00271712 _____ () C:\ProgramData\DatacardService\HWDeviceService.exe
2014-01-18 16:51 - 2014-01-18 16:48 - 00239968 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
2014-01-18 16:51 - 2014-01-18 16:48 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll
2014-01-18 16:51 - 2014-01-18 16:48 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll
2014-01-18 16:51 - 2014-01-18 16:48 - 02415104 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll
2014-01-18 16:51 - 2014-01-18 16:48 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll
2014-01-18 16:51 - 2014-01-18 16:48 - 00383488 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll
2014-01-18 16:51 - 2014-01-18 16:48 - 00398336 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll
2008-09-19 03:03 - 2008-09-19 03:03 - 00167936 _____ () C:\Program Files\PostgreSQL\8.3\bin\LIBPQ.dll
2007-06-05 14:20 - 2007-06-05 14:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe
2009-02-26 21:03 - 2008-10-29 17:20 - 00070656 _____ () C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe
2006-11-06 18:18 - 2006-11-06 18:18 - 00963584 _____ () C:\Program Files\PostgreSQL\8.3\bin\libxml2.dll
2005-07-20 06:48 - 2005-07-20 06:48 - 00059904 _____ () C:\Program Files\PostgreSQL\8.3\bin\zlib1.dll
2008-02-04 22:43 - 2008-02-04 22:43 - 00027136 _____ () C:\Program Files\PostgreSQL\8.3\lib\plugins\plugin_debugger.dll
2009-03-04 07:36 - 2009-02-25 10:13 - 00247152 _____ () C:\Program Files\Cyberlink\Shared files\RichVideo.exe
2013-12-19 04:42 - 2013-12-19 04:42 - 00287864 ____N () C:\Program Files\Common Files\G Data\AVKProxy\PktIcpt2.dll
2010-04-30 15:57 - 2010-03-15 11:28 - 00141824 _____ () C:\Program Files\WinRAR\rarext.dll
2009-12-13 19:34 - 2009-12-13 19:34 - 00043520 _____ () C:\Windows\system32\CmdLineExt03.dll
2009-02-27 19:17 - 2008-08-28 16:03 - 00233472 _____ () C:\Windows\tsnp2uvc.exe
2014-05-10 10:23 - 2014-05-10 10:23 - 03839088 _____ () C:\PROGRAM FILES\MOZILLA FIREFOX\mozjs.dll
2014-05-21 07:17 - 2014-05-21 07:17 - 00041984 _____ () C:\Users\Andreas Wagner\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphgfkms.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Andreas Wagner\AppData\Roaming\Dropbox\bin\libcef.dll
2014-05-14 08:46 - 2014-05-14 08:46 - 16361136 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Program Files\Cake Poker 2.0:MID
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\7961_Hm2AutoUpdate.exe:BDU
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\avg_isct_x86_all_2014_4259a6848_huawei.exe:BDU
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\BitDefenderQS_EN.exe:BDU
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\BitDefender_Uninstall_Tool.exe:BDU
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\ccsetup409.exe:BDU
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\Dropbox 2.6.2.exe:BDU
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\ECPS1_1_1.exe:BDU
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\gkfx4setup.exe:BDU
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\iTunesSetup.exe:BDU
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\PokerHeaven(1).exe:BDU
AlternateDataStreams: C:\Users\Andreas Wagner\Downloads\The_New_Bitdefender_UninstallTool.exe:BDU

==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: Winmgmt => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Hama Wireless LAN Utility.lnk => C:\Windows\pss\Hama Wireless LAN Utility.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk => C:\Windows\pss\Logitech SetPoint.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Andreas Wagner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupreg: AmazonMP3DownloaderHelper => C:\Users\Andreas Wagner\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Bitdefender-Geldbörse-Agent => "C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe"
MSCONFIG\startupreg: Bitdefender-Geldbörse-Anwendungs-Agent => "C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe"
MSCONFIG\startupreg: DU Meter => C:\Program Files\DU Meter\DUMeter.exe
MSCONFIG\startupreg: MDS_Menu => "C:\Program Files\HomeCinema\MediaShow4\MUITransfer\MUIStartMenu.exe" "C:\Program Files\HomeCinema\MediaShow4" UpdateWithCreateOnce "Software\CyberLink\MediaShow\4.1"
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: PDVD8LanguageShortcut => "C:\Program Files\HomeCinema\PowerDVD8\Language\Language.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: SSync => "C:\Users\Andreas Wagner\AppData\Roaming\SSync\SSync.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: UCam_Menu => "C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\HomeCinema\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"

==================== Faulty Device Manager Devices =============

Could not list Devices. Check "winmgmt" service or repair WMI.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/21/2014 07:28:39 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15616

Error: (05/21/2014 07:28:39 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15616

Error: (05/21/2014 07:28:39 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/21/2014 07:28:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 14618

Error: (05/21/2014 07:28:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 14618

Error: (05/21/2014 07:28:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/21/2014 07:28:37 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 13604

Error: (05/21/2014 07:28:37 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 13604

Error: (05/21/2014 07:28:37 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/21/2014 07:28:36 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 12481


System errors:
=============
Error: (05/21/2014 09:07:48 AM) (Source: Dhcp) (EventID: 1002) (User: )
Description: Die IP-Adresslease 192.168.1.3 für die Netzwerkkarte mit der Netzwerkadresse 0022FA04C192 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).

Error: (05/20/2014 08:58:34 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 20.05.2014 um 08:56:48 unerwartet heruntergefahren.

Error: (05/20/2014 08:53:17 AM) (Source: Dhcp) (EventID: 1002) (User: )
Description: Die IP-Adresslease 192.168.1.3 für die Netzwerkkarte mit der Netzwerkadresse 0022FA04C192 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).

Error: (05/20/2014 00:03:40 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053GDFwSvc-Service{1DED95CA-C567-464A-B405-087EDDF0B095}

Error: (05/19/2014 06:52:13 AM) (Source: Dhcp) (EventID: 1002) (User: )
Description: Die IP-Adresslease 192.168.1.3 für die Netzwerkkarte mit der Netzwerkadresse 0022FA04C192 wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).

Error: (05/18/2014 07:26:59 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 18.05.2014 um 19:24:19 unerwartet heruntergefahren.

Error: (05/18/2014 07:01:03 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {BCB3CC02-761B-4C74-8B04-891A31034D19}

Error: (05/18/2014 06:58:29 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 18.05.2014 um 18:56:29 unerwartet heruntergefahren.

Error: (05/18/2014 06:07:49 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {BCB3CC02-761B-4C74-8B04-891A31034D19}

Error: (05/18/2014 06:51:05 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {BCB3CC02-761B-4C74-8B04-891A31034D19}


Microsoft Office Sessions:
=========================
Error: (07/11/2013 03:55:11 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 63 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (07/10/2013 09:25:07 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 38 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (07/10/2013 09:24:14 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 35 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (05/24/2013 10:38:10 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 38 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (05/24/2013 09:22:55 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 17 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (05/24/2013 09:22:26 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 14 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (05/24/2013 09:21:59 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 40 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (05/24/2013 09:20:00 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 31 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (03/21/2013 00:21:19 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 79 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (03/21/2013 10:22:54 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 41 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-05-21 11:16:37.742
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-21 11:16:37.292
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-21 11:16:36.852
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-21 11:16:36.419
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-21 11:15:38.195
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-21 11:15:37.756
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-21 11:15:37.338
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-21 11:15:36.923
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-21 11:06:17.557
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-05-21 11:06:17.126
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\HookCentre.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 48%
Total physical RAM: 3065.95 MB
Available physical RAM: 1567.96 MB
Total Pagefile: 6334.17 MB
Available Pagefile: 3077.27 MB
Total Virtual: 2047.88 MB
Available Virtual: 1908.54 MB

==================== Drives ================================

Drive c: (BOOT) (Fixed) (Total:440.37 GB) (Free:60.55 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:25.38 GB) (Free:10.76 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 806E6361)
Partition 1: (Active) - (Size=440 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=25 GB) - (Type=0C)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-21 12:20:52
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-1 Hitachi_HTS545050B9A300 rev.PB4OC60G 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\ANDREA~1\AppData\Local\Temp\uwtorkob.sys


---- System - GMER 2.1 ----

INT 0x61  ?                                                                                              90212050
INT 0x71  ?                                                                                              902122D0
INT 0x82  ?                                                                                              90212CD0
INT 0xA2  ?                                                                                              902127D0

---- Kernel code sections - GMER 2.1 ----

.text     C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                       section is writeable [0x8F20C320, 0x3EEAF7, 0xE8000020]
.text     C:\Windows\system32\DRIVERS\atksgt.sys                                                         section is writeable [0xA7C68300, 0x3B6D8, 0xE8000020]
.text     C:\Windows\system32\DRIVERS\lirsgt.sys                                                         section is writeable [0xA7CAB300, 0x1BEE, 0xE8000020]

---- Registry - GMER 2.1 ----

Reg       HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Devices\00-00-00-00-00-00@IsControlPoint  1

---- EOF - GMER 2.1 ----
         

Danke

Viele Grüße

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.