Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Ständig wird in Chrome bei geöffneten Seiten Werbung angezeigt ? (https://www.trojaner-board.de/147439-staendig-chrome-geoeffneten-seiten-werbung-angezeigt.html)

sunny2311 06.01.2014 14:21
Ständig wird in Chrome bei geöffneten Seiten Werbung angezeigt ?
 
Hallo an Alle .
Bin neu hier und hab nicht wirklich viel Ahnung von Rechnern also bitte etwas Nachsicht :)

Ich hatte Nationzoom auf dem Rechner . nachdem meine Tochter im Netz unterwegs war und musste mich dann erst einmal durch googlen .
Hatte dann hier mehrere Posts gelesen und mehrere Programme drüber laufen lassen und einiges behoben .
Keine Ahnung ob diese Werbung noch Reste von dem sind oder etwas anderes vorhanden ist .

Da wird halt ständig Werbung auf Seiten angezeigt und gehe mal nicht davon aus das es normal ist .
Weiß Jemand Rat ?

LG Sandra

cosinus 06.01.2014 14:33
Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

sunny2311 06.01.2014 15:04
Das ist von FRST
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-01-2014
Ran by nich (administrator) on SANDRAS on 06-01-2014 14:42:11
Running from C:\Users\nich\Downloads
Windows 8.1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20315_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Spotify Ltd) C:\Users\nich\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\Ymsgr_tray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteUser.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BeatsOSDApp] - C:\Program Files\IDT\WDM\Beats64.exe [41664 2013-06-29] (Hewlett-Packard )
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1702912 2013-06-29] (IDT, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2013-12-12] (Hewlett-Packard)
HKCU\...\Run: [Spotify] - C:\Users\nich\AppData\Roaming\Spotify\spotify.exe [4640768 2013-07-10] (Spotify Ltd)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\nich\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-10] (Spotify Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
HKCU\...\Run: [Facebook Update] - C:\Users\nich\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-07-31] (Facebook Inc.)
HKCU\...\Run: [icq] - C:\Users\nich\AppData\Roaming\ICQM\icq.exe [28698984 2013-08-28] (ICQ)
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKCU\...\Run: [Sony PC Companion] - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449248 2013-05-29] (Sony)
HKCU\...\Run: [Messenger (Yahoo!)] - C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
MountPoints2: {e50959d2-dbf0-11e2-be73-10604b86bcd8} - "G:\PMCsetup.exe"
AppInit_DLLs:  [ ] ()
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

URLSearchHook: HKCU - YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {20C8CF33-6684-4894-B0B3-765772345B37} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - {20C8CF33-6684-4894-B0B3-765772345B37} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Plus-HD-1.3 - {11111111-1111-1111-1111-110311121157} - C:\Program Files (x86)\Plus-HD-1.3\Plus-HD-1.3-bho64.dll No File
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Intel Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Extension: (Google Docs) - C:\Users\nich\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\nich\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\nich\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\nich\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Plus-HD-1.3) - C:\Users\nich\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhlmghjmomaoodfgjeikphfdljhpcpkl\1.26.131_0
CHR Extension: (Norton Identity Protection) - C:\Users\nich\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.4.0.10_1
CHR Extension: (Google Wallet) - C:\Users\nich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0
CHR Extension: (Gmail) - C:\Users\nich\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [emlhcngcihhbhffejfoebpgepknlobhb] - C:\Users\nich\AppData\Local\CRE\emlhcngcihhbhffejfoebpgepknlobhb.crx
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 HPConnectedRemote; c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35744 2012-10-12] (Hewlett-Packard)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2013-11-19] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-17] (Avira Operations GmbH & Co. KG)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-06-14] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-06-14] (Symantec Corporation)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S2 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\IPSDefs\20130810.001\IDSvia64.sys [513184 2013-06-13] (Symantec Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20130813.002\ENG64.SYS [126040 2013-08-13] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20130813.002\EX64.SYS [2098776 2013-08-13] (Symantec Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-19] (Microsoft Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
S4 SymELAM; C:\Windows\system32\drivers\NISx64\1404000.028\SymELAM.sys [23448 2012-06-20] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [230912 2013-08-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-06 11:46 - 2014-01-06 11:57 - 00000000 ____D C:\Users\nich\Desktop\mbar
2014-01-06 11:46 - 2014-01-06 11:57 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-06 11:46 - 2014-01-06 11:46 - 00117464 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-01-06 11:46 - 2014-01-06 11:46 - 00089304 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-01-06 11:45 - 2014-01-06 11:46 - 12582688 _____ (Malwarebytes Corp.) C:\Users\nich\Downloads\mbar-1.07.0.1008.exe
2014-01-05 17:16 - 2014-01-05 17:16 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2014-01-05 17:15 - 2014-01-05 17:20 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-05 17:15 - 2014-01-05 17:16 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-05 17:15 - 2014-01-05 17:15 - 00001397 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-01-05 17:15 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe
2014-01-05 17:14 - 2014-01-05 17:15 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\nich\Downloads\spybot-2.2.25.exe
2014-01-05 16:48 - 2014-01-05 16:48 - 00000000 _____ C:\autoexec.bat
2014-01-05 16:47 - 2014-01-05 16:47 - 00002274 _____ C:\Users\nich\Desktop\SpyHunter.lnk
2014-01-05 16:47 - 2014-01-05 16:47 - 00000000 ____D C:\WINDOWS\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-05 16:47 - 2014-01-05 16:47 - 00000000 ____D C:\Users\nich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-05 16:47 - 2014-01-05 16:47 - 00000000 ____D C:\sh4ldr
2014-01-05 16:47 - 2014-01-05 16:47 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-05 16:47 - 2012-06-22 11:01 - 00022704 _____ C:\WINDOWS\system32\Drivers\EsgScanner.sys
2014-01-05 16:46 - 2014-01-05 16:46 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\nich\Downloads\SpyHunter-Installer.exe
2014-01-05 16:40 - 2014-01-05 16:40 - 00000266 _____ C:\Users\nich\Downloads\Search.txt
2014-01-03 21:41 - 2014-01-03 21:41 - 02347384 _____ (ESET) C:\Users\nich\Downloads\esetsmartinstaller_deu (2).exe
2014-01-03 21:41 - 2014-01-03 21:41 - 02347384 _____ (ESET) C:\Users\nich\Downloads\esetsmartinstaller_deu (1).exe
2014-01-03 21:40 - 2014-01-03 21:40 - 02347384 _____ (ESET) C:\Users\nich\Downloads\esetsmartinstaller_deu.exe
2013-12-31 17:35 - 2013-12-31 17:35 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2013-12-28 19:38 - 2013-12-28 19:48 - 00000000 ____D C:\Users\nich\AppData\Local\Sony
2013-12-28 19:38 - 2013-12-28 19:38 - 00001903 _____ C:\Users\Public\Desktop\Media Go.lnk
2013-12-28 19:38 - 2013-12-28 19:38 - 00000000 ____D C:\Users\nich\Podcasts
2013-12-28 19:38 - 2013-12-28 19:38 - 00000000 ____D C:\Users\nich\Documents\Media Go
2013-12-28 19:38 - 2013-12-28 19:38 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-12-28 19:37 - 2013-12-28 19:37 - 00000000 ____D C:\Users\nich\AppData\Local\Downloaded Installations
2013-12-28 19:36 - 2013-12-28 19:48 - 00000000 ____D C:\Users\nich\AppData\Roaming\Sony
2013-12-28 19:36 - 2013-12-28 19:37 - 00000000 ____D C:\Program Files (x86)\Sony Media Go Install
2013-12-28 10:34 - 2013-12-28 10:34 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\nich\Downloads\sc-cleaner (1).exe
2013-12-28 10:18 - 2014-01-06 12:07 - 00000000 ____D C:\Users\nich\Downloads\FRST-OlderVersion
2013-12-24 21:57 - 2013-12-24 21:57 - 00001760 _____ C:\Users\nich\Desktop\JRT.txt
2013-12-24 21:54 - 2013-12-24 21:54 - 00000000 ____D C:\WINDOWS\ERUNT
2013-12-24 21:53 - 2013-12-24 21:53 - 01034531 _____ (Thisisu) C:\Users\nich\Downloads\JRT.exe
2013-12-24 21:18 - 2014-01-06 12:10 - 00001740 _____ C:\sc-cleaner.txt
2013-12-24 21:17 - 2013-12-24 21:18 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\nich\Downloads\sc-cleaner.exe
2013-12-23 10:35 - 2014-01-06 12:13 - 00000000 ____D C:\AdwCleaner
2013-12-23 10:35 - 2013-12-23 10:35 - 01233962 _____ C:\Users\nich\Downloads\adwcleaner.exe
2013-12-22 22:38 - 2014-01-06 14:42 - 00019358 _____ C:\Users\nich\Downloads\FRST.txt
2013-12-22 22:38 - 2013-12-22 22:39 - 00031027 _____ C:\Users\nich\Downloads\Addition.txt
2013-12-22 22:37 - 2014-01-06 12:07 - 00000000 ____D C:\FRST
2013-12-22 22:35 - 2014-01-06 12:07 - 01931762 _____ (Farbar) C:\Users\nich\Downloads\FRST64.exe
2013-12-15 04:59 - 2013-11-04 11:32 - 02570240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2013-12-15 04:58 - 2013-11-12 00:41 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2013-12-15 04:58 - 2013-11-12 00:40 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2013-12-15 04:58 - 2013-11-12 00:27 - 00701440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2013-12-15 04:58 - 2013-11-12 00:24 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2013-12-15 04:58 - 2013-11-11 03:48 - 00039768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2013-12-15 04:58 - 2013-11-09 12:55 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2013-12-15 04:58 - 2013-11-09 07:37 - 01756160 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe
2013-12-15 04:58 - 2013-11-09 06:56 - 01391104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe
2013-12-15 04:58 - 2013-11-08 11:26 - 00358896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2013-12-15 04:58 - 2013-11-08 05:43 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2013-12-15 04:58 - 2013-11-08 05:28 - 13177344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2013-12-15 04:58 - 2013-11-08 05:26 - 11674624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2013-12-15 04:58 - 2013-11-08 05:16 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2013-12-15 04:58 - 2013-11-08 05:15 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2013-12-15 04:58 - 2013-11-08 05:07 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2013-12-15 04:58 - 2013-11-08 04:41 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2013-12-15 04:58 - 2013-11-08 04:14 - 00922624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2013-12-15 04:58 - 2013-11-05 15:19 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2013-12-15 04:58 - 2013-11-05 15:03 - 00637952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2013-12-15 04:58 - 2013-11-05 14:57 - 00479744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2013-12-15 04:58 - 2013-11-05 14:33 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2013-12-15 04:58 - 2013-11-05 14:32 - 00744448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2013-12-15 04:58 - 2013-11-04 18:13 - 01530200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2013-12-15 04:58 - 2013-11-04 18:13 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2013-12-15 04:58 - 2013-11-04 14:07 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2013-12-15 04:58 - 2013-11-04 12:50 - 02143744 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2013-12-15 04:58 - 2013-11-04 03:28 - 01816576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll
2013-12-15 04:58 - 2013-11-04 02:30 - 01765376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2013-12-15 04:58 - 2013-11-01 12:39 - 00086872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2013-12-15 04:58 - 2013-11-01 07:08 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidcli.dll
2013-12-15 04:58 - 2013-11-01 06:57 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcli.dll
2013-12-15 04:58 - 2013-10-31 01:58 - 00372568 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2013-12-15 04:58 - 2013-10-31 01:42 - 07399256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2013-12-15 04:58 - 2013-10-31 01:33 - 01642016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2013-12-15 04:58 - 2013-10-31 01:33 - 01506680 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2013-12-15 04:58 - 2013-10-31 01:33 - 01476184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2013-12-15 04:58 - 2013-10-31 01:33 - 01345536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2013-12-15 04:58 - 2013-10-26 02:54 - 00146776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\SerCx2.sys
2013-12-15 04:58 - 2013-10-24 10:31 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll
2013-12-15 04:58 - 2013-10-24 10:12 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll
2013-12-15 04:58 - 2013-10-17 12:21 - 02896896 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2013-12-15 04:58 - 2013-10-17 11:36 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2013-12-15 04:58 - 2013-10-05 15:21 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2013-12-15 04:58 - 2013-10-05 15:21 - 00516496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2013-12-15 04:58 - 2013-10-05 13:05 - 01765384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2013-12-15 04:58 - 2013-10-05 13:05 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2013-12-12 01:50 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-12-12 01:50 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2013-12-12 01:50 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-12-12 01:50 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2013-12-12 01:50 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2013-12-12 01:50 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2013-12-12 01:50 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2013-12-12 01:50 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2013-12-12 01:50 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-12-12 01:50 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2013-12-12 01:50 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2013-12-12 01:50 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2013-12-12 01:50 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2013-12-12 01:50 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2013-12-12 01:50 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2013-12-12 01:50 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2013-12-12 01:50 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2013-12-12 01:50 - 2013-11-23 05:34 - 00393216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
2013-12-12 01:50 - 2013-11-23 05:13 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
2013-12-12 01:50 - 2013-11-23 04:32 - 04105728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2013-12-12 01:50 - 2013-11-23 04:10 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2013-12-12 01:50 - 2013-11-09 07:34 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2013-12-12 01:50 - 2013-11-09 07:34 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2013-12-12 01:50 - 2013-11-09 06:52 - 00240128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2013-12-12 01:50 - 2013-11-08 08:21 - 04191744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2013-12-12 01:50 - 2013-10-19 09:53 - 00075360 _____ (Microsoft Corporation) C:\WINDOWS\system32\imagehlp.dll
2013-12-12 01:50 - 2013-10-19 08:14 - 00070680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imagehlp.dll
2013-12-12 01:50 - 2013-10-15 09:54 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2013-12-12 01:50 - 2013-10-15 09:03 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll

==================== One Month Modified Files and Folders =======

2014-01-06 14:42 - 2013-12-22 22:38 - 00019358 _____ C:\Users\nich\Downloads\FRST.txt
2014-01-06 14:27 - 2013-06-14 19:02 - 00001122 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-06 14:26 - 2013-06-14 18:54 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2723301674-3827438562-2782304355-1001
2014-01-06 14:02 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\sru
2014-01-06 13:53 - 2013-07-31 09:48 - 00000940 _____ C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2723301674-3827438562-2782304355-1001UA.job
2014-01-06 13:50 - 2013-07-03 14:56 - 00000000 ____D C:\Users\nich\AppData\Roaming\Spotify
2014-01-06 13:50 - 2013-06-21 12:45 - 00000000 ____D C:\Users\nich\AppData\Roaming\Skype
2014-01-06 13:49 - 2013-11-19 19:43 - 00000000 __RDO C:\Users\nich\SkyDrive
2014-01-06 13:49 - 2013-06-14 19:03 - 00002197 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-06 13:49 - 2013-06-14 19:02 - 00001118 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-06 12:21 - 2013-09-30 05:14 - 01980934 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2014-01-06 12:21 - 2013-09-30 04:56 - 00841326 _____ C:\WINDOWS\system32\perfh007.dat
2014-01-06 12:21 - 2013-09-30 04:56 - 00191558 _____ C:\WINDOWS\system32\perfc007.dat
2014-01-06 12:14 - 2013-06-15 19:07 - 00000344 _____ C:\WINDOWS\Tasks\HPCeeScheduleFornich.job
2014-01-06 12:13 - 2013-12-23 10:35 - 00000000 ____D C:\AdwCleaner
2014-01-06 12:13 - 2013-11-19 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-06 12:13 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2014-01-06 12:13 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2014-01-06 12:10 - 2013-12-24 21:18 - 00001740 _____ C:\sc-cleaner.txt
2014-01-06 12:07 - 2013-12-28 10:18 - 00000000 ____D C:\Users\nich\Downloads\FRST-OlderVersion
2014-01-06 12:07 - 2013-12-22 22:37 - 00000000 ____D C:\FRST
2014-01-06 12:07 - 2013-12-22 22:35 - 01931762 _____ (Farbar) C:\Users\nich\Downloads\FRST64.exe
2014-01-06 12:06 - 2013-11-20 17:47 - 00003922 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{CE4C9CFA-A334-4439-8D4C-AF770B6B9D68}
2014-01-06 11:57 - 2014-01-06 11:46 - 00000000 ____D C:\Users\nich\Desktop\mbar
2014-01-06 11:57 - 2014-01-06 11:46 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-06 11:46 - 2014-01-06 11:46 - 00117464 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-01-06 11:46 - 2014-01-06 11:46 - 00089304 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-01-06 11:46 - 2014-01-06 11:45 - 12582688 _____ (Malwarebytes Corp.) C:\Users\nich\Downloads\mbar-1.07.0.1008.exe
2014-01-06 10:53 - 2013-07-31 09:48 - 00000918 _____ C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2723301674-3827438562-2782304355-1001Core.job
2014-01-05 21:48 - 2013-11-19 19:07 - 01799024 _____ C:\WINDOWS\WindowsUpdate.log
2014-01-05 21:38 - 2013-06-21 19:57 - 00101899 _____ C:\WINDOWS\system32\lvcoinst.log
2014-01-05 17:20 - 2014-01-05 17:15 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-05 17:16 - 2014-01-05 17:16 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2014-01-05 17:16 - 2014-01-05 17:15 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-05 17:15 - 2014-01-05 17:15 - 00001397 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-01-05 17:15 - 2014-01-05 17:14 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\nich\Downloads\spybot-2.2.25.exe
2014-01-05 16:48 - 2014-01-05 16:48 - 00000000 _____ C:\autoexec.bat
2014-01-05 16:47 - 2014-01-05 16:47 - 00002274 _____ C:\Users\nich\Desktop\SpyHunter.lnk
2014-01-05 16:47 - 2014-01-05 16:47 - 00000000 ____D C:\WINDOWS\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-05 16:47 - 2014-01-05 16:47 - 00000000 ____D C:\Users\nich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-05 16:47 - 2014-01-05 16:47 - 00000000 ____D C:\sh4ldr
2014-01-05 16:47 - 2014-01-05 16:47 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-05 16:46 - 2014-01-05 16:46 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\nich\Downloads\SpyHunter-Installer.exe
2014-01-05 16:40 - 2014-01-05 16:40 - 00000266 _____ C:\Users\nich\Downloads\Search.txt
2014-01-04 18:03 - 2013-06-15 19:07 - 00003156 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleFornich
2014-01-04 18:03 - 2013-06-15 19:06 - 00000052 _____ C:\WINDOWS\SysWOW64\DOErrors.log
2014-01-04 18:02 - 2013-06-15 19:06 - 00000000 _____ C:\WINDOWS\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-01-04 12:03 - 2013-11-20 10:40 - 00049664 ___SH C:\Users\nich\Desktop\Thumbs.db
2014-01-04 09:34 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2014-01-03 21:41 - 2014-01-03 21:41 - 02347384 _____ (ESET) C:\Users\nich\Downloads\esetsmartinstaller_deu (2).exe
2014-01-03 21:41 - 2014-01-03 21:41 - 02347384 _____ (ESET) C:\Users\nich\Downloads\esetsmartinstaller_deu (1).exe
2014-01-03 21:40 - 2014-01-03 21:40 - 02347384 _____ (ESET) C:\Users\nich\Downloads\esetsmartinstaller_deu.exe
2014-01-01 18:32 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2013-12-31 22:13 - 2013-08-22 15:46 - 00298368 _____ C:\WINDOWS\setupact.log
2013-12-31 22:04 - 2013-06-21 19:57 - 00000000 ____D C:\Program Files\Common Files\logishrd
2013-12-31 17:35 - 2013-12-31 17:35 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2013-12-30 21:06 - 2013-09-29 20:04 - 00020380 _____ C:\WINDOWS\PFRO.log
2013-12-30 20:27 - 2013-11-19 19:11 - 00000000 ____D C:\Users\nich
2013-12-28 19:48 - 2013-12-28 19:38 - 00000000 ____D C:\Users\nich\AppData\Local\Sony
2013-12-28 19:48 - 2013-12-28 19:36 - 00000000 ____D C:\Users\nich\AppData\Roaming\Sony
2013-12-28 19:38 - 2013-12-28 19:38 - 00001903 _____ C:\Users\Public\Desktop\Media Go.lnk
2013-12-28 19:38 - 2013-12-28 19:38 - 00000000 ____D C:\Users\nich\Podcasts
2013-12-28 19:38 - 2013-12-28 19:38 - 00000000 ____D C:\Users\nich\Documents\Media Go
2013-12-28 19:38 - 2013-12-28 19:38 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-12-28 19:38 - 2013-09-07 14:10 - 00000000 ____D C:\Program Files (x86)\Sony
2013-12-28 19:37 - 2013-12-28 19:37 - 00000000 ____D C:\Users\nich\AppData\Local\Downloaded Installations
2013-12-28 19:37 - 2013-12-28 19:36 - 00000000 ____D C:\Program Files (x86)\Sony Media Go Install
2013-12-28 10:34 - 2013-12-28 10:34 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\nich\Downloads\sc-cleaner (1).exe
2013-12-24 21:57 - 2013-12-24 21:57 - 00001760 _____ C:\Users\nich\Desktop\JRT.txt
2013-12-24 21:54 - 2013-12-24 21:54 - 00000000 ____D C:\WINDOWS\ERUNT
2013-12-24 21:53 - 2013-12-24 21:53 - 01034531 _____ (Thisisu) C:\Users\nich\Downloads\JRT.exe
2013-12-24 21:18 - 2013-12-24 21:17 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\nich\Downloads\sc-cleaner.exe
2013-12-23 10:41 - 2013-11-19 19:39 - 00001007 _____ C:\Users\nich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-23 10:35 - 2013-12-23 10:35 - 01233962 _____ C:\Users\nich\Downloads\adwcleaner.exe
2013-12-22 22:39 - 2013-12-22 22:38 - 00031027 _____ C:\Users\nich\Downloads\Addition.txt
2013-12-22 22:32 - 2013-06-14 18:48 - 00000000 ___RD C:\Users\nich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-17 14:44 - 2013-09-27 18:19 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-12-17 14:44 - 2013-09-27 18:19 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2013-12-17 14:44 - 2013-09-27 18:19 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys
2013-12-15 09:28 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache
2013-12-15 08:33 - 2013-08-22 15:44 - 00488976 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-12-15 08:32 - 2013-08-22 16:36 - 00000000 ___RD C:\WINDOWS\ToastData
2013-12-15 08:32 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\WinStore
2013-12-15 08:32 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\MediaViewer
2013-12-15 08:32 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\FileManager
2013-12-15 08:32 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\Camera
2013-12-15 05:47 - 2013-07-23 06:40 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-12-15 05:45 - 2013-06-15 21:57 - 90708896 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-12-11 15:27 - 2013-06-14 19:02 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-07 15:19 - 2013-11-12 17:17 - 00000000 ____D C:\Users\nich\Desktop\musik jamie

Files to move or delete:
====================
C:\Users\nich\jagex_cl_runescape_LIVE.dat
C:\Users\nich\random.dat


Some content of TEMP:
====================
C:\Users\nich\AppData\Local\Temp\avgnt.exe
C:\Users\nich\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\nich\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-06 12:24

==================== End Of Log ============================
--- --- ---

cosinus 06.01.2014 16:07
Was ist mit meiner Frage nach bisherigen Funden?
Wo ist das andere Log von FRST?

sunny2311 06.01.2014 16:35
Welches andere Log ?
Bei mir kam nur das eine .

Hatte vor ein paar Tagen Malwarebytes drüber laufen lassen
und alles in die Quarantäne gepackt .

Avira hatte nichts gefunden .

Junkware Removal Tool hatte ein paar Dinge nicht löschen können , waren Hkey ´s

cosinus 06.01.2014 21:24
Zitat:
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)
Warum wurde die addition.txt bei dir nicht erstellt?
Haken rausgenommen? Schonmal vorher mit FRST gescannt obwohl du hier erst seit heute angemeldet bist? Ich weiß es nicht, jedenfalls muss der Haken bei FRST nicht gesetzt gewesen sein sonst wär das Log auch erstellt worden

Zitat:
Hatte vor ein paar Tagen Malwarebytes drüber laufen lassen
und alles in die Quarantäne gepackt .
Und wo ist das Log dazu? Ich hab doch extra gesagt du sollst die Logs mit Funden posten

Zitat:
Junkware Removal Tool hatte ein paar Dinge nicht löschen können , waren Hkey ´s
JRT solltest du noch garnicht ausführen. Welche Anweisungen befolgst du eigentlich, meine oder irgendwelche anderen?
Ist nicht böse gemeint, ich kann sowas nur nicht nachvollziehen, du hast doch anfangs behauptet du hast nicht soviel Ahnung davon und dann machst du doch alles auf eigene Faust


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:18 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131