GVU Trojaner

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-06-2013 03
Ran by Marco (administrator) on 11-06-2013 20:11:17
Running from F:\
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Safe Mode (minimal)
 
==================== Processes (Whitelisted) =================
 
(Microsoft Corporation) C:\Windows\system32\cmd.exe
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324608 2010-02-05] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated)
HKLM\...\Run: [CNAP2 Launcher] C:\Windows\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE [226784 2010-10-14] (CANON INC.)
HKCU\...\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-21] (Microsoft Corporation)
HKCU\...\Run: [KiesPreload] D:\Kies\Kies.exe /preload [x]
HKCU\...\Run: [KiesAirMessage] D:\Kies\KiesAirMessage.exe -startup [x]
HKCU\...\Run: [KiesPDLR] D:\Kies\External\FirmwareUpdate\KiesPDLR.exe [x]
HKCU\...\Run: [Spotify Web Helper] "C:\Users\Marco\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1105408 2013-05-04] (Spotify Ltd)
HKCU\...\Run: [] D:\Kies\External\FirmwareUpdate\KiesPDLR.exe [x]
HKCU\...\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-01-15] ()
HKCU\...\Run: [CNAP2 Launcher] C:\Windows\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE [226784 2010-10-14] (CANON INC.)
HKCU\...\Run: [Spotify] "C:\Users\Marco\AppData\Roaming\Spotify\spotify.exe" /uri spotify:autostart [4573184 2013-05-04] (Spotify Ltd)
HKCU\...\Run: [Google Update] "C:\Users\Marco\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2012-02-17] (Google Inc.)
HKCU\...\Run: [PlayNC Launcher] [x]
HKCU\...\Run: [NCsoft Launcher] C:\Program Files (x86)\NCSoft\Launcher\NCLauncher.exe /Minimized [43304 2013-06-11] (NCSOFT)
HKCU\...\Winlogon: [Shell] explorer.exe,C:\Users\Marco\AppData\Roaming\skype.dat [138240 2011-11-17] () <==== ATTENTION 
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [343168 2011-12-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] D:\Kies\KiesTrayAgent.exe [x]
HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [3147384 2012-12-11] (AVG Technologies CZ, s.r.o.)
Startup: C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Marco\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
URLSearchHook: (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 
Chrome: 
=======
CHR HomePage: hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=48&sspv=CHSB9
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Marco\AppData\Local\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Marco\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Marco\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Nexon Game Controller) - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
CHR Plugin: (Google Update) - C:\Users\Marco\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Extension: (DVDVideoSoftTB DE) - C:\Users\Marco\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhphemoobgnikcoofkgackkaimpfmenm\2.3.19.11_0
CHR Extension: (YouTube) - C:\Users\Marco\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Marco\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Marco\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Marco\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\Marco\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
 
==================== Services (Whitelisted) =================
 
S2 4game-service; C:\Program Files (x86)\4game\4game-service.exe [1133056 2013-05-23] (Innova Co S.a r.l.)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [5814904 2012-11-16] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [196664 2012-10-22] (AVG Technologies CZ, s.r.o.)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [4702568 2012-10-24] (INCA Internet Co., Ltd.)
S2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
 
==================== Drivers (Whitelisted) ====================
 
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [154464 2012-10-22] (AVG Technologies CZ, s.r.o. )
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [63328 2012-10-15] (AVG Technologies CZ, s.r.o. )
S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [185696 2012-10-02] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [225120 2012-09-21] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [111968 2012-11-16] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40800 2012-09-14] (AVG Technologies CZ, s.r.o.)
S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [200032 2012-09-21] (AVG Technologies CZ, s.r.o.)
S3 athr; system32\DRIVERS\athrx.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2013-06-11 20:11 - 2013-06-11 20:11 - 00000000 ____D C:\FRST
2013-06-11 14:54 - 2013-06-11 19:29 - 00000004 ____A C:\Users\Marco\AppData\Roaming\skype.ini
2013-06-11 14:50 - 2013-06-11 14:50 - 00138240 ____A C:\Users\Marco\Downloads\video_720p (1).exe
2013-06-11 14:49 - 2013-06-11 14:49 - 00138240 ____A C:\Users\Marco\Downloads\video_720p.exe
2013-06-11 02:59 - 2012-10-24 10:16 - 04702568 ____A (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\GameMon.des
2013-06-11 02:59 - 2005-01-02 23:43 - 00004682 ____A (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\npptNT2.sys
2013-06-11 02:59 - 2003-07-19 08:17 - 00005174 ____A C:\Windows\SysWOW64\nppt9x.vxd
2013-06-11 02:58 - 2013-06-11 02:58 - 00000000 ____D C:\Program Files\Common Files\INCA Shared
2013-06-11 02:27 - 2013-06-11 02:27 - 00002094 ____A C:\Users\Marco\Desktop\Lineage II.lnk
2013-06-11 00:39 - 2013-06-11 02:27 - 00000000 ____D C:\Program Files (x86)\NCSoft
2013-06-11 00:39 - 2013-06-11 00:39 - 00002028 ____A C:\Users\Public\Desktop\NCsoft Launcher.lnk
2013-06-11 00:36 - 2013-06-11 00:37 - 06523640 ____A (Macrovision Corporation) C:\Users\Marco\Downloads\NCsoftLauncherSetup.exe
2013-06-11 00:10 - 2013-06-11 00:10 - 00000000 ____D C:\Users\Marco\AppData\Local\{1C0CF29B-EAEC-403C-A5BB-779E17310447}
2013-06-10 22:14 - 2013-06-10 23:43 - 00000000 ____D C:\Program Files (x86)\4game
2013-06-10 22:13 - 2013-06-10 22:13 - 04711472 ____A (Innova Co S.a r.l.) C:\Users\Marco\Downloads\lineage2de_setup-de.exe
2013-06-03 22:55 - 2013-06-03 22:55 - 01376768 ____A C:\Users\Marco\Downloads\7z920-x64 (2).msi
2013-06-03 22:51 - 2013-06-03 22:51 - 75895944 ____A C:\Users\Marco\Downloads\obli.xvid.part13.rar
2013-06-03 22:51 - 2013-06-03 22:51 - 00000000 ____D C:\Users\Marco\AppData\Roaming\WinRAR
2013-06-03 22:50 - 2013-06-03 22:51 - 104857603 ____A C:\Users\Marco\Downloads\obli.xvid.part12.rar
2013-06-03 22:50 - 2013-06-03 22:51 - 104857603 ____A C:\Users\Marco\Downloads\obli.xvid.part11.rar
2013-06-03 22:50 - 2013-06-03 22:50 - 104857603 ____A C:\Users\Marco\Downloads\obli.xvid.part10.rar
2013-06-03 22:49 - 2013-06-03 22:50 - 104857603 ____A C:\Users\Marco\Downloads\obli.xvid.part09.rar
2013-06-03 22:49 - 2013-06-03 22:50 - 104857603 ____A C:\Users\Marco\Downloads\obli.xvid.part08.rar
2013-06-03 22:49 - 2013-06-03 22:49 - 104857615 ____A C:\Users\Marco\Downloads\obli.xvid.part07.rar
2013-06-03 22:48 - 2013-06-03 22:49 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part06.rar
2013-06-03 22:48 - 2013-06-03 22:49 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part05.rar
2013-06-03 22:48 - 2013-06-03 22:48 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part04.rar
2013-06-03 22:47 - 2013-06-03 22:48 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part03.rar
2013-06-03 22:47 - 2013-06-03 22:47 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part02.rar
2013-06-03 22:47 - 2013-06-03 22:47 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part01.rar
2013-06-03 22:43 - 2013-06-03 22:43 - 00003160 ____A C:\Users\Marco\Downloads\relink.us__obli.xvid_2a5e7637e57f95f803dedb089627a7.dlc
2013-06-03 22:36 - 2013-06-03 22:36 - 00077236 ____A (AppWork UG (haftungsbeschränkt)) C:\Users\Marco\Downloads\jDownloaderWebInstaller09581.exe
2013-06-03 22:36 - 2013-06-03 22:36 - 00077236 ____A (AppWork UG (haftungsbeschränkt)) C:\Users\Marco\Downloads\jDownloaderWebInstaller09581 (1).exe
2013-05-23 23:44 - 2013-05-24 01:42 - 00000000 ____D C:\Users\Marco\AppData\Roaming\TS3Client
2013-05-23 23:43 - 2013-05-23 23:43 - 00000000 ____D C:\Program Files (x86)\TeamSpeak 3 Client
2013-05-23 23:41 - 2013-05-23 23:42 - 32698840 ____A (TeamSpeak Systems GmbH) C:\Users\Marco\Downloads\TeamSpeak3-Client-win32-3.0.10.1.exe
2013-05-16 03:17 - 2013-05-16 03:17 - 00000000 ____D C:\Users\Marco\Documents\PDF Architect Files
2013-05-16 03:17 - 2013-05-16 03:17 - 00000000 ____D C:\Program Files (x86)\PDF Architect
2013-05-16 03:16 - 2013-05-16 03:16 - 00000000 ____D C:\Users\Marco\AppData\Roaming\pdfforge
2013-05-16 03:16 - 2013-04-09 15:13 - 00110264 ____A (pdfforge GmbH) C:\Windows\System32\pdfcmon.dll
2013-05-16 03:16 - 2013-01-09 15:52 - 01070152 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCTL.OCX
2013-05-16 03:16 - 2012-05-05 11:54 - 00662288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2013-05-16 03:16 - 2012-05-05 11:54 - 00137000 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSMAPI32.OCX
2013-05-16 03:16 - 2012-05-05 11:54 - 00023552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSMPIDE.DLL
2013-05-16 03:16 - 1998-07-06 18:56 - 00125712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\VB6DE.DLL
2013-05-16 03:16 - 1998-07-06 18:55 - 00158208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCDE.DLL
2013-05-16 03:16 - 1998-07-06 18:55 - 00064512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSCC2DE.DLL
2013-05-16 03:13 - 2013-05-16 03:13 - 17502040 ____A (pdfforge GbR) C:\Users\Marco\Downloads\PDFCreator-1_7_0_setup.exe
2013-05-16 03:01 - 2013-04-05 08:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-16 03:01 - 2013-04-05 08:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-16 03:01 - 2013-04-05 08:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-16 03:01 - 2013-04-05 08:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-16 03:01 - 2013-04-05 08:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-16 03:01 - 2013-04-05 08:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-16 03:01 - 2013-04-05 08:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-16 03:01 - 2013-04-05 08:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-16 03:01 - 2013-04-05 08:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-16 03:01 - 2013-04-05 08:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-16 03:01 - 2013-04-05 08:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-16 03:01 - 2013-04-05 08:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-16 03:01 - 2013-04-05 08:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-16 03:01 - 2013-04-05 08:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-16 03:01 - 2013-04-05 07:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-16 03:01 - 2013-04-05 07:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-16 03:01 - 2013-04-05 07:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-16 03:01 - 2013-04-05 06:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-16 03:01 - 2013-04-05 06:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-16 03:01 - 2013-04-05 05:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-16 03:01 - 2013-04-05 05:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-15 15:56 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 15:56 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-15 15:56 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-15 15:55 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-15 15:55 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-15 15:55 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-15 15:55 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-15 15:55 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-15 15:55 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-15 15:55 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-15 15:55 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-15 15:55 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-15 15:55 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-15 15:55 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
 
==================== One Month Modified Files and Folders =======
 
2013-06-11 20:11 - 2013-06-11 20:11 - 00000000 ____D C:\FRST
2013-06-11 19:52 - 2011-04-12 09:43 - 03506656 ____A C:\Windows\System32\perfh007.dat
2013-06-11 19:52 - 2011-04-12 09:43 - 01041720 ____A C:\Windows\System32\perfc007.dat
2013-06-11 19:52 - 2009-07-14 07:13 - 00005194 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-11 19:37 - 2012-02-17 02:00 - 01621112 ____A C:\Windows\WindowsUpdate.log
2013-06-11 19:32 - 2012-01-10 21:14 - 00075448 ____A C:\Windows\setupact.log
2013-06-11 19:32 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-11 19:29 - 2013-06-11 14:54 - 00000004 ____A C:\Users\Marco\AppData\Roaming\skype.ini
2013-06-11 19:29 - 2013-01-15 22:31 - 00000000 ____D C:\Users\Marco\AppData\Local\PMB Files
2013-06-11 19:28 - 2009-07-14 06:45 - 00021072 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-11 19:28 - 2009-07-14 06:45 - 00021072 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-11 19:23 - 2013-02-18 16:10 - 00000000 ____D C:\Users\Marco\AppData\Roaming\Dropbox
2013-06-11 19:23 - 2012-09-20 12:10 - 00000000 ____D C:\Users\Marco\AppData\Local\Spotify
2013-06-11 19:23 - 2012-09-20 12:09 - 00000000 ____D C:\Users\Marco\AppData\Roaming\Spotify
2013-06-11 19:23 - 2012-02-17 02:35 - 00000000 ____D C:\ProgramData\MFAData
2013-06-11 18:58 - 2012-02-17 02:37 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1894934171-1551603685-868937202-1000UA.job
2013-06-11 14:50 - 2013-06-11 14:50 - 00138240 ____A C:\Users\Marco\Downloads\video_720p (1).exe
2013-06-11 14:49 - 2013-06-11 14:49 - 00138240 ____A C:\Users\Marco\Downloads\video_720p.exe
2013-06-11 02:58 - 2013-06-11 02:58 - 00000000 ____D C:\Program Files\Common Files\INCA Shared
2013-06-11 02:27 - 2013-06-11 02:27 - 00002094 ____A C:\Users\Marco\Desktop\Lineage II.lnk
2013-06-11 02:27 - 2013-06-11 00:39 - 00000000 ____D C:\Program Files (x86)\NCSoft
2013-06-11 02:27 - 2013-01-15 22:31 - 00000000 ____D C:\ProgramData\PMB Files
2013-06-11 00:39 - 2013-06-11 00:39 - 00002028 ____A C:\Users\Public\Desktop\NCsoft Launcher.lnk
2013-06-11 00:39 - 2012-02-17 02:22 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-11 00:37 - 2013-06-11 00:36 - 06523640 ____A (Macrovision Corporation) C:\Users\Marco\Downloads\NCsoftLauncherSetup.exe
2013-06-11 00:10 - 2013-06-11 00:10 - 00000000 ____D C:\Users\Marco\AppData\Local\{1C0CF29B-EAEC-403C-A5BB-779E17310447}
2013-06-11 00:09 - 2012-03-09 19:26 - 00000000 ____D C:\Users\Marco\Tracing
2013-06-10 23:59 - 2012-02-17 02:42 - 00000000 ____D C:\Users\Marco\AppData\Local\Windows Live
2013-06-10 23:43 - 2013-06-10 22:14 - 00000000 ____D C:\Program Files (x86)\4game
2013-06-10 22:13 - 2013-06-10 22:13 - 04711472 ____A (Innova Co S.a r.l.) C:\Users\Marco\Downloads\lineage2de_setup-de.exe
2013-06-09 22:07 - 2012-02-17 02:37 - 00001068 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1894934171-1551603685-868937202-1000Core.job
2013-06-06 12:10 - 2012-02-17 02:38 - 00002363 ____A C:\Users\Marco\Desktop\Google Chrome.lnk
2013-06-05 21:22 - 2013-03-01 18:04 - 00000000 ____D C:\Users\Marco\Desktop\Woq2 Bilder
2013-06-03 22:55 - 2013-06-03 22:55 - 01376768 ____A C:\Users\Marco\Downloads\7z920-x64 (2).msi
2013-06-03 22:51 - 2013-06-03 22:51 - 75895944 ____A C:\Users\Marco\Downloads\obli.xvid.part13.rar
2013-06-03 22:51 - 2013-06-03 22:51 - 00000000 ____D C:\Users\Marco\AppData\Roaming\WinRAR
2013-06-03 22:51 - 2013-06-03 22:50 - 104857603 ____A C:\Users\Marco\Downloads\obli.xvid.part12.rar
2013-06-03 22:51 - 2013-06-03 22:50 - 104857603 ____A C:\Users\Marco\Downloads\obli.xvid.part11.rar
2013-06-03 22:50 - 2013-06-03 22:50 - 104857603 ____A C:\Users\Marco\Downloads\obli.xvid.part10.rar
2013-06-03 22:50 - 2013-06-03 22:49 - 104857603 ____A C:\Users\Marco\Downloads\obli.xvid.part09.rar
2013-06-03 22:50 - 2013-06-03 22:49 - 104857603 ____A C:\Users\Marco\Downloads\obli.xvid.part08.rar
2013-06-03 22:49 - 2013-06-03 22:49 - 104857615 ____A C:\Users\Marco\Downloads\obli.xvid.part07.rar
2013-06-03 22:49 - 2013-06-03 22:48 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part06.rar
2013-06-03 22:49 - 2013-06-03 22:48 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part05.rar
2013-06-03 22:48 - 2013-06-03 22:48 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part04.rar
2013-06-03 22:48 - 2013-06-03 22:47 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part03.rar
2013-06-03 22:47 - 2013-06-03 22:47 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part02.rar
2013-06-03 22:47 - 2013-06-03 22:47 - 104857624 ____A C:\Users\Marco\Downloads\obli.xvid.part01.rar
2013-06-03 22:43 - 2013-06-03 22:43 - 00003160 ____A C:\Users\Marco\Downloads\relink.us__obli.xvid_2a5e7637e57f95f803dedb089627a7.dlc
2013-06-03 22:36 - 2013-06-03 22:36 - 00077236 ____A (AppWork UG (haftungsbeschränkt)) C:\Users\Marco\Downloads\jDownloaderWebInstaller09581.exe
2013-06-03 22:36 - 2013-06-03 22:36 - 00077236 ____A (AppWork UG (haftungsbeschränkt)) C:\Users\Marco\Downloads\jDownloaderWebInstaller09581 (1).exe
2013-06-01 22:12 - 2013-02-18 16:12 - 00001016 ____A C:\Users\Marco\Desktop\Dropbox.lnk
2013-05-24 01:42 - 2013-05-23 23:44 - 00000000 ____D C:\Users\Marco\AppData\Roaming\TS3Client
2013-05-23 23:43 - 2013-05-23 23:43 - 00000000 ____D C:\Program Files (x86)\TeamSpeak 3 Client
2013-05-23 23:43 - 2012-04-26 20:53 - 00001162 ____A C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-05-23 23:42 - 2013-05-23 23:41 - 32698840 ____A (TeamSpeak Systems GmbH) C:\Users\Marco\Downloads\TeamSpeak3-Client-win32-3.0.10.1.exe
2013-05-17 15:21 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-05-16 06:19 - 2012-08-03 19:54 - 00000000 ____D C:\Users\Marco\Documents\Bewerbung
2013-05-16 06:13 - 2009-07-14 06:45 - 00294344 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-16 06:12 - 2010-11-21 05:47 - 00031932 ____A C:\Windows\PFRO.log
2013-05-16 03:17 - 2013-05-16 03:17 - 00000000 ____D C:\Users\Marco\Documents\PDF Architect Files
2013-05-16 03:17 - 2013-05-16 03:17 - 00000000 ____D C:\Program Files (x86)\PDF Architect
2013-05-16 03:16 - 2013-05-16 03:16 - 00000000 ____D C:\Users\Marco\AppData\Roaming\pdfforge
2013-05-16 03:13 - 2013-05-16 03:13 - 17502040 ____A (pdfforge GbR) C:\Users\Marco\Downloads\PDFCreator-1_7_0_setup.exe
2013-05-16 03:11 - 2012-01-10 20:35 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 15:48 - 2009-07-14 07:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
 
Files to move or delete:
====================
C:\Users\Marco\AppData\Roaming\skype.dat
C:\Users\Marco\AppData\Roaming\skype.ini
C:\ProgramData\dsgsdgdsgdsgw.pad
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 
LastRegBack: 2013-06-03 02:00
 
==================== End Of Log ============================