Trojaner-Board - adw cleaner schlägt jedes mal alarm betroffen google chrome

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-05-2014

Ran by nazghul (administrator) on NAZGHUL-PC on 14-05-2014 22:27:12

Running from C:\Users\nazghul\Downloads\FRST-OlderVersion

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATILFE.EXE

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6962400 2012-12-28] (Realtek Semiconductor)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1179576 2014-01-21] (NVIDIA Corporation)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-21] (NVIDIA Corporation)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-10-16] (Intel Corporation)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737360 2014-04-29] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058880 2013-03-28] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1131039330-627903920-4108510760-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1825984 2014-04-24] (Valve Corporation)

HKU\S-1-5-21-1131039330-627903920-4108510760-1002\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATILFE.EXE [297024 2013-01-24] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1131039330-627903920-4108510760-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3D3244ED345BCF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR StartupUrls: "hxxp://www.google.com/"

CHR Extension: (ProxFlow) - C:\Users\nazghul\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-05-09]

CHR Extension: (Google Docs) - C:\Users\nazghul\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-07]

CHR Extension: (Google Drive) - C:\Users\nazghul\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-07]

CHR Extension: (Web Developer) - C:\Users\nazghul\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbameneiokkgbdmiekhjnmfkcnldhhm [2014-05-07]

CHR Extension: (YouTube) - C:\Users\nazghul\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-07]

CHR Extension: (Adblock Plus) - C:\Users\nazghul\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-07]

CHR Extension: (Google-Suche) - C:\Users\nazghul\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-07]

CHR Extension: (AdBlock) - C:\Users\nazghul\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-05-07]

CHR Extension: (Google Wallet) - C:\Users\nazghul\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-07]

CHR Extension: (Google Mail) - C:\Users\nazghul\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-07]
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-04-29] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-04-29] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1040464 2014-04-29] (Avira Operations GmbH & Co. KG)

R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)

R2 EPSON_PM_RPCV4_06; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE [152640 2013-04-15] (SEIKO EPSON CORPORATION)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [164736 2012-11-07] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)

U2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-21] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-21] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2013-07-22] ()

S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-04-29] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-04-29] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-14] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)

S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 SIVDriver; C:\Windows\system32\Drivers\SIVX64.sys [135928 2013-05-14] (Ray Hinchliffe)

S3 MSICDSetup; \??\E:\CDriver64.sys [X]

S3 NTIOLib_1_0_C; \??\E:\NTIOLib_X64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-05-09 12:08 - 2014-05-14 22:27 - 00000000 ____D () C:\Users\nazghul\Downloads\FRST-OlderVersion

2014-05-08 12:08 - 2014-05-08 12:08 - 00033851 _____ () C:\Users\nazghul\Downloads\FRST.txt

2014-05-08 12:07 - 2014-05-09 12:08 - 02064384 _____ (Farbar) C:\Users\nazghul\Downloads\FRST64.exe

2014-05-08 01:11 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-08 01:11 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-08 01:11 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-08 01:11 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-07 13:55 - 2014-05-07 13:55 - 00002256 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-05-07 13:55 - 2014-05-07 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-05-07 13:52 - 2014-05-14 22:18 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-07 13:52 - 2014-05-14 11:57 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-07 13:52 - 2014-05-07 13:52 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-07 13:52 - 2014-05-07 13:52 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-07 13:47 - 2014-05-07 13:47 - 00000000 __SHD () C:\Users\nazghul\AppData\Local\EmieUserList

2014-05-07 13:47 - 2014-05-07 13:47 - 00000000 __SHD () C:\Users\nazghul\AppData\Local\EmieSiteList

2014-05-06 17:49 - 2014-05-06 17:49 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-05-06 17:49 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-05-06 17:49 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-05-06 17:49 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-05-06 17:49 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-05-06 17:49 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-05-06 17:49 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-05-06 17:49 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-05-06 17:49 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-05-06 17:49 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-05-06 17:49 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-05-06 17:49 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-05-06 17:49 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-05-06 17:49 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-05-06 17:49 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-05-06 17:49 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-05-06 17:49 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-05-06 17:49 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-05-06 17:49 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-05-06 17:49 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-05-06 17:49 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-05-06 17:49 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-05-06 17:49 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-05-06 17:49 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-05-06 17:49 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-05-06 17:49 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-05-06 17:49 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-05-06 17:49 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-05-06 17:49 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-05-06 17:49 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-05-06 17:49 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-05-06 17:49 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-05-06 17:49 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-05-06 17:49 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-05-06 17:49 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-05-06 17:49 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-05-06 17:49 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-05-06 17:49 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-05-06 17:49 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-05-06 17:49 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-05-06 17:49 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-05-06 17:49 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-05-06 17:49 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-05-06 17:49 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-05-06 17:49 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-05-06 17:10 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-05-06 17:10 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-05-05 22:28 - 2014-05-07 14:05 - 00001147 _____ () C:\Users\nazghul\Desktop\mba.txt

2014-05-03 18:48 - 2014-05-03 18:48 - 00000000 ____D () C:\Windows\ERUNT

2014-05-03 18:36 - 2014-05-03 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-05-03 18:36 - 2014-05-03 18:36 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-05-03 18:36 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-05-03 18:36 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-05-03 18:36 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-05-02 12:16 - 2014-05-14 22:27 - 00000000 ____D () C:\FRST

2014-04-29 23:43 - 2014-05-03 18:06 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-29 23:42 - 2014-04-29 23:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\nazghul\Downloads\Revo Uninstaller - CHIP-Downloader.exe

2014-04-29 16:47 - 2014-05-01 15:16 - 00000000 ____D () C:\AdwCleaner

2014-04-29 16:41 - 2014-05-07 13:55 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-29 16:37 - 2014-05-07 13:52 - 00000000 ____D () C:\Users\nazghul\AppData\Local\Deployment

2014-04-29 16:37 - 2014-04-29 16:37 - 00000000 ____D () C:\Users\nazghul\AppData\Local\Apps\2.0

2014-04-29 16:16 - 2014-05-14 22:21 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-29 16:16 - 2014-04-29 16:16 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-04-29 16:01 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-04-28 13:16 - 2014-04-28 13:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
 

==================== One Month Modified Files and Folders =======
 

2014-05-14 22:27 - 2014-05-09 12:08 - 00000000 ____D () C:\Users\nazghul\Downloads\FRST-OlderVersion

2014-05-14 22:27 - 2014-05-02 12:16 - 00000000 ____D () C:\FRST

2014-05-14 22:24 - 2013-07-20 10:41 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-05-14 22:24 - 2011-04-12 09:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat

2014-05-14 22:24 - 2011-04-12 09:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat

2014-05-14 22:24 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-05-14 22:21 - 2014-04-29 16:16 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-05-14 22:19 - 2013-07-20 10:20 - 00000000 ____D () C:\Users\nazghul\AppData\Roaming\Skype

2014-05-14 22:18 - 2014-05-07 13:52 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-14 22:18 - 2013-06-05 11:05 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-05-14 22:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-14 22:18 - 2009-07-14 06:51 - 00111124 _____ () C:\Windows\setupact.log

2014-05-14 12:56 - 2013-07-20 09:17 - 01371362 _____ () C:\Windows\WindowsUpdate.log

2014-05-14 12:50 - 2013-07-20 09:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-14 12:11 - 2014-03-11 20:11 - 00000911 _____ () C:\Windows\Tasks\EPSON XP-312 313 315 Series Update {3A2D50F8-E329-4E07-B5C8-3249A4C18E49}.job

2014-05-14 12:11 - 2014-03-11 20:11 - 00000725 _____ () C:\Windows\Tasks\EPSON XP-312 313 315 Series Invitation {3A2D50F8-E329-4E07-B5C8-3249A4C18E49}.job

2014-05-14 12:11 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

2014-05-14 11:57 - 2014-05-07 13:52 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-14 11:56 - 2013-12-25 13:07 - 00000000 ____D () C:\Users\nazghul\AppData\Local\Battle.net

2014-05-14 10:47 - 2009-07-14 06:45 - 00025392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-14 10:47 - 2009-07-14 06:45 - 00025392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-14 00:51 - 2013-07-20 09:35 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-05-14 00:51 - 2013-07-20 09:35 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-05-14 00:51 - 2013-07-20 09:35 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-05-13 12:25 - 2013-12-25 13:10 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-05-13 11:03 - 2014-02-06 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software

2014-05-13 11:03 - 2014-02-06 18:55 - 00000000 ____D () C:\Program Files (x86)\EPSON Software

2014-05-09 12:08 - 2014-05-08 12:07 - 02064384 _____ (Farbar) C:\Users\nazghul\Downloads\FRST64.exe

2014-05-08 12:08 - 2014-05-08 12:08 - 00033851 _____ () C:\Users\nazghul\Downloads\FRST.txt

2014-05-08 12:02 - 2010-11-21 05:47 - 00283312 _____ () C:\Windows\PFRO.log

2014-05-07 21:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-05-07 14:05 - 2014-05-05 22:28 - 00001147 _____ () C:\Users\nazghul\Desktop\mba.txt

2014-05-07 13:55 - 2014-05-07 13:55 - 00002256 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-05-07 13:55 - 2014-05-07 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-05-07 13:55 - 2014-04-29 16:41 - 00000000 ____D () C:\Program Files (x86)\Google

2014-05-07 13:55 - 2013-07-20 09:36 - 00000000 ____D () C:\Users\nazghul\AppData\Local\Google

2014-05-07 13:52 - 2014-05-07 13:52 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-07 13:52 - 2014-05-07 13:52 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-07 13:52 - 2014-04-29 16:37 - 00000000 ____D () C:\Users\nazghul\AppData\Local\Deployment

2014-05-07 13:47 - 2014-05-07 13:47 - 00000000 __SHD () C:\Users\nazghul\AppData\Local\EmieUserList

2014-05-07 13:47 - 2014-05-07 13:47 - 00000000 __SHD () C:\Users\nazghul\AppData\Local\EmieSiteList

2014-05-07 13:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-05-06 17:49 - 2014-05-06 17:49 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-05-03 18:48 - 2014-05-03 18:48 - 00000000 ____D () C:\Windows\ERUNT

2014-05-03 18:36 - 2014-05-03 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-05-03 18:36 - 2014-05-03 18:36 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-05-03 18:28 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-05-03 18:06 - 2014-04-29 23:43 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-05-02 12:32 - 2013-12-25 13:07 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-05-01 15:16 - 2014-04-29 16:47 - 00000000 ____D () C:\AdwCleaner

2014-05-01 12:30 - 2014-03-31 14:58 - 00000000 ____D () C:\Users\nazghul\Documents\My Games

2014-05-01 12:27 - 2013-04-23 10:05 - 00296451 _____ () C:\Windows\DirectX.log

2014-04-30 20:57 - 2013-08-09 16:03 - 00000000 ____D () C:\Users\nazghul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-04-30 18:18 - 2014-02-06 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON

2014-04-30 18:18 - 2014-02-06 18:55 - 00000000 ____D () C:\Program Files (x86)\epson

2014-04-30 18:18 - 2014-02-06 18:51 - 00000000 ____D () C:\ProgramData\Epson

2014-04-29 23:42 - 2014-04-29 23:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\nazghul\Downloads\Revo Uninstaller - CHIP-Downloader.exe

2014-04-29 17:11 - 2013-07-20 09:19 - 00000000 ____D () C:\Users\nazghul

2014-04-29 16:37 - 2014-04-29 16:37 - 00000000 ____D () C:\Users\nazghul\AppData\Local\Apps\2.0

2014-04-29 16:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Vss

2014-04-29 16:22 - 2013-08-12 16:33 - 00000000 ____D () C:\Users\nazghul\AppData\Roaming\DVDVideoSoft

2014-04-29 16:16 - 2014-04-29 16:16 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-04-29 16:06 - 2013-07-20 09:21 - 00001008 _____ () C:\Users\nazghul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-04-29 16:06 - 2013-07-20 09:21 - 00000000 ___RD () C:\Users\nazghul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-04-29 16:01 - 2014-05-08 01:11 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-29 15:40 - 2014-05-08 01:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-29 14:48 - 2014-05-08 01:11 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-29 14:34 - 2014-05-08 01:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-29 10:47 - 2014-02-12 13:36 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-04-29 10:47 - 2014-02-12 13:36 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-04-28 13:16 - 2014-04-28 13:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com

2014-04-28 13:16 - 2013-07-20 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-04-28 13:14 - 2013-12-25 13:01 - 00000000 ____D () C:\Users\nazghul\Desktop\Neuer Ordner

2014-04-20 13:16 - 2013-07-20 09:34 - 00000000 ____D () C:\Users\nazghul\AppData\Local\Adobe

2014-04-18 17:41 - 2013-07-22 22:36 - 00000000 ____D () C:\Users\nazghul\AppData\Local\CrashDumps

2014-04-14 04:24 - 2014-05-06 17:10 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-14 04:19 - 2014-05-06 17:10 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
 

Some content of TEMP:

====================

C:\Users\nazghul\AppData\Local\Temp\avgnt.exe

C:\Users\nazghul\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-05-09 13:38
 

==================== End Of Log ============================
--- --- ---