Hallo, habe die Trojaner 1.) TR/Crypt.EPACK.Gen8 und 2.) TR/Winwebsec.A.1888 in Quarantäne. War unter 1.) c:\user\kontoname\Appdata\Roaming\ratib.dll und 2.) ...\eoaxmrwcns.exe Im Forum habe ich gelesen: "Nichts machen, Thema eröffnen", das ich hiermit tue. Habe 4 Benutzerkonten auf dem PC, Problem tritt nur in einem Konto auf. Habe gelesen, ich soll den per mail schicken, weiß aber nicht, wie ich das .eml Format erzeuge.
Was tun?

Ich habe einen FRST-Scan gemacht, wie von Forenteilnehmer empfohlen.
Wichtig für andere: Wenn Ihr ein 64-but Windows habt, müßt Ihr den Rechner mit der 32-bit DVD des Windows booten, um FRSt-32 bit Scan zu nutzen. Klingt logisch, aber ist eine Falle, in die auch ich getappt bin.

So, hier der Scan. Habe einen "Polizeibericht" aus der Schweiz bekommen...

Hinter diesen Hyoglyphen versteckt sich der Trojaner, swoeit habe ich das identifizieren können:

C:\Users\Edgar\AppData\Local\¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ

Wer kann mir jetzt weiterhelfen?

Vielen Dank


Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-09-2012
Ran by SYSTEM at 22-09-2012 18:15:57
Running from H:\
Windows 7 Professional (X86) OS Language: English(US)
The current controlset is ControlSet001

ATTENTION!:=====> THE OPERATING SYSTEM IS A X64 SYSTEM BUT THE BOOT DISK THAT IS USED TO BOOT TO RECOVERY ENVIRONMENT IS A X86 SYSTEM DISK.
==================== Registry (Whitelisted) ===================

HKLM\...\Run: [HPPowerAssistant] C:\Program Files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe /hidden [2941496 2011-03-17] (Hewlett-Packard Company)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2828072 2011-09-15] (Synaptics Incorporated)
HKLM\...\Run: [MfeEpePcMonitor] "C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe" [200704 2011-03-29] ()
HKLM\...\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-11-21] (IDT, Inc.)
HKLM\...\Run: [IntelliType Pro] "c:\Program Files\Microsoft Device Center\itype.exe" [1464928 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] "c:\Program Files\Microsoft Device Center\ipoint.exe" [2004584 2012-06-26] (Microsoft Corporation)
HKU\Admin\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-10-17] (Google Inc.)
HKU\avant\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-10-17] (Google Inc.)
HKU\Edgar\...\Run: [PC Suite Tray] "C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray [x]
HKU\Edgar\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-10-17] (Google Inc.)
HKU\Edgar\...\Run: [ratib] rundll32.exe "C:\Users\Edgar\AppData\Roaming\ratib.dll",Idle [x]
HKU\Edgar\...\Run: [bysdm] "C:\Windows\System32\rundll32.exe" "C:\Users\Edgar\AppData\Roaming\bysdm.dll",GetFrame [1616896 2012-09-04] ()
HKU\Edgar\...\Winlogon: [Shell] explorer.exe,C:\Users\Edgar\AppData\Roaming\msconfig.dat [108544 2011-11-16] (Ringer)
HKU\edgar.bernardi\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-10-17] (Google Inc.)
HKU\vinemotion\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-10-17] (Google Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Lsa: [Notification Packages] DPPassFilter EpePcNp64 scecli
Startup: C:\Users\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Services (Whitelisted) ===================

2 AdobeARMservice; "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" [63960 2012-07-27] (Adobe Systems Incorporated)
3 AdobeFlashPlayerUpdateSvc; C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [250568 2012-08-26] (Adobe Systems Incorporated)
2 AESTFilters; C:\Program Files\IDT\WDM\AESTSr64.exe [89600 2011-11-21] (Andrea Electronics Corporation)
2 AntiVirSchedulerService; "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" [86224 2012-05-11] (Avira Operations GmbH & Co. KG)
2 AntiVirService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" [110032 2012-05-11] (Avira Operations GmbH & Co. KG)
2 Apple Mobile Device; "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" [55184 2012-05-24] (Apple Inc.)
3 aspnet_state; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [44376 2010-03-18] (Microsoft Corporation)
4 clr_optimization_v2.0.50727_64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [89920 2009-06-10] (Microsoft Corporation)
2 clr_optimization_v4.0.30319_64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [138576 2010-03-18] (Microsoft Corporation)
2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [486224 2011-08-04] (DigitalPersona, Inc.)
3 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-04] (Microsoft Corporation)
2 FTRTSVC; "C:\PROGRA~2\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe" [90112 2009-11-12] (France Telecom SA)
2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [136176 2011-07-22] (Google Inc.)
3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [136176 2011-07-22] (Google Inc.)
3 gusvc; "C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe" [194032 2012-08-17] (Google)
2 HP Power Assistant Service; "C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe" [132152 2011-03-17] (Hewlett-Packard Company)
2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [85560 2011-06-21] (Hewlett-Packard Company)
3 hpCMSrv; "C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe" [1098296 2011-05-23] (Hewlett-Packard Development Company L.P.)
2 HPDrvMntSvc.exe; "C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe" [227384 2011-07-05] (Hewlett-Packard Company)
2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [320512 2011-05-09] (Hewlett-Packard)
2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [1698360 2011-07-06] (Hewlett-Packard Company)
3 hpqwmiex; "C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe" [988216 2011-07-05] (Hewlett-Packard Company)
2 IAStorDataMgrSvc; "C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe" [13336 2011-01-26] (Intel Corporation)
3 IDriverT; "C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" [69632 2005-04-03] (Macrovision Corporation)
3 idsvc; "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe" [856400 2010-11-04] (Microsoft Corporation)
2 IFXSpMgtSrv; C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe [1126264 2011-10-07] (Infineon Technologies AG)
2 IFXTCS; C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxtcs.exe [980856 2011-10-07] (Infineon Technologies AG)
2 jhi_service; C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [212944 2011-02-23] (Intel Corporation)
2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [326168 2011-01-17] (Intel Corporation)
2 McAfee Endpoint Encryption Agent; "C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe" [1318912 2011-03-29] ()
4 NetMsmqActivator; "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator [124240 2010-03-18] (Microsoft Corporation)
4 NetPipeActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
4 NetTcpActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
3 odserv; "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" [440696 2011-07-19] (Microsoft Corporation)
3 ose; "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE" [145184 2006-10-26] (Microsoft Corporation)
2 PdiService; C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [113264 2011-03-16] (Portrait Displays, Inc.)
3 PerfHost; C:\Windows\SysWow64\perfhost.exe [20992 2009-07-13] (Microsoft Corporation)
2 PersonalSecureDriveService; "C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe" [203640 2011-10-07] (Infineon Technologies AG)
3 RoxMediaDB12OEM; "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe" [1116656 2011-02-15] (Sonic Solutions)
2 SageDB 5.0; C:\Program Files (x86)\Sage\SageDB 5.0\bin\mysqld-nt.exe "--defaults-file=C:\Program Files (x86)\Sage\SageDB 5.0\server.ini" "SageDB 5.0" [1671 2011-08-28] ()
2 SkypeUpdate; "C:\Program Files (x86)\Skype\Updater\Updater.exe" [160944 2012-07-03] (Skype Technologies)
2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [301568 2011-11-21] (IDT, Inc.)
3 stllssvr; "C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe" [74392 2010-11-08] (MicroVision Development, Inc.)
2 SWGVCSvc; "C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe" -regserver [284696 2009-03-05] (SonicWALL, Inc.)
2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-10] (ArcSoft, Inc.)
2 UNS; "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe" [2656280 2011-01-17] (Intel Corporation)
2 vcsFPService; C:\windows\system32\vcsFPService.exe [3175728 2011-08-22] (Validity Sensors, Inc.)
3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [x]
2 HPDayStarterService; "c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe" [x]

==================== Drivers (Whitelisted) ====================

3 AgereSoftModem; C:\Windows\System32\DRIVERS\agrsm64.sys [1146880 2009-06-10] (LSI Corp)
3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-10] (ArcSoft, Inc.)
2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-11] (Avira GmbH)
1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-11] (Avira GmbH)
1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-09-15] (Avira GmbH)
3 b06bdrv; C:\Windows\system32\DRIVERS\bxvbda.sys [468480 2009-06-10] (Broadcom Corporation)
3 b57nd60a; C:\Windows\System32\DRIVERS\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation)
3 btwampfl; C:\Windows\System32\drivers\btwampfl.sys [344616 2010-07-14] (Broadcom Corporation.)
3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [63336 2011-03-03] (Hewlett-Packard Company)
3 DNE; C:\Windows\System32\DRIVERS\dne64x.sys [157968 2008-11-16] (Deterministic Networks, Inc.)
3 e1cexpress; C:\Windows\System32\DRIVERS\e1c62x64.sys [316080 2010-12-21] (Intel Corporation)
3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [88576 2009-08-04] (Option N.V.)
3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [129536 2009-08-04] (Option N.V.)
3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [10496 2009-08-04] (Option N.V.)
3 igfx; C:\Windows\System32\DRIVERS\igdkmd64.sys [12262336 2011-03-25] (Intel Corporation)
3 ksthunk; C:\Windows\system32\drivers\ksthunk.sys [20992 2009-07-13] (Microsoft Corporation)
3 MEIx64; C:\Windows\System32\DRIVERS\HECIx64.sys [56344 2010-10-19] (Intel Corporation)
0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [168008 2011-03-29] (McAfee, Inc.)
3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2011-05-09] (Apple Inc.)
3 NETwNs64; C:\Windows\System32\DRIVERS\NETwNs64.sys [8507392 2011-01-04] (Intel Corporation)
1 PersonalSecureDrive; C:\Windows\System32\drivers\psd.sys [44576 2011-10-07] (Infineon Technologies AG)
3 Point64; C:\Windows\System32\DRIVERS\point64.sys [46176 2012-06-26] (Microsoft Corporation)
0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [55856 2010-03-19] (Sonic Solutions)
3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1863720 2012-05-31] ()
3 STHDA; C:\Windows\System32\DRIVERS\stwrt64.sys [528384 2011-11-21] (IDT, Inc.)
1 SWIPsec; \??\C:\windows\system32\Drivers\SWIPsec.sys [99352 2009-03-05] (SonicWALL, Inc.)
3 SWVNIC; C:\Windows\System32\DRIVERS\swvnic.sys [24600 2009-03-04] (SonicWALL, Inc.)
3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-02-15] (Apple, Inc.)
3 vpcbus; C:\Windows\System32\DRIVERS\vpchbus.sys [194944 2010-11-20] (Microsoft Corporation)
3 vpcusb; C:\Windows\System32\DRIVERS\vpcusb.sys [95232 2010-11-20] (Microsoft Corporation)
3 pccsmcfd; C:\Windows\System32\DRIVERS\pccsmcfdx64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2012-09-22 07:50 - 2012-09-22 07:50 - 00000000 ____D C:\eeepcfr
2012-09-22 07:49 - 2012-09-22 07:49 - 00515892 ____A C:\Users\Admin\Downloads\eeepcfr.zip
2012-09-22 07:45 - 2012-09-22 07:47 - 00000000 ____D C:\Users\Admin\Desktop\OTLPEStd
2012-09-22 07:45 - 2012-09-22 07:45 - 00000000 ____D C:\Program Files\7-Zip
2012-09-22 07:43 - 2012-09-22 07:43 - 01376768 ____A C:\Users\Admin\Downloads\7z920-x64.msi
2012-09-22 07:39 - 2012-09-22 07:31 - 98077435 ____A (Igor Pavlov) C:\Users\Admin\Desktop\OTLPEStd.exe
2012-09-22 05:18 - 2012-09-22 06:40 - 00000000 ____A C:\Users\Edgar\AppData\Local\¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ
2012-09-22 05:07 - 2012-09-22 07:36 - 00000004 ___AH C:\Users\Edgar\AppData\Roaming\msconfig.ini
2012-09-14 02:27 - 2012-09-14 02:27 - 00000000 ____D C:\Program Files (x86)\Citrix
2012-09-14 02:26 - 2012-09-14 02:26 - 00060304 ____A C:\Users\edgar.bernardi\g2mdlhlpx.exe
2012-09-13 22:47 - 2012-08-22 10:12 - 01913200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2012-09-13 22:47 - 2012-08-22 10:12 - 00950128 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys
2012-09-13 22:47 - 2012-08-22 10:12 - 00376688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys
2012-09-13 22:47 - 2012-08-22 10:12 - 00288624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS
2012-09-13 22:47 - 2012-08-02 09:58 - 00574464 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2012-09-13 22:47 - 2012-08-02 08:57 - 00490496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2012-09-13 22:47 - 2012-07-04 12:26 - 00041472 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\RNDISMP.sys
2012-09-07 10:56 - 2012-09-07 10:56 - 00246760 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2012-09-07 10:56 - 2012-09-07 10:56 - 00174056 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2012-09-07 10:56 - 2012-09-07 10:56 - 00174056 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2012-09-07 10:56 - 2012-09-07 10:56 - 00095208 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2012-09-07 10:56 - 2012-09-07 10:56 - 00000000 ____D C:\Program Files (x86)\Java
2012-09-07 08:52 - 2012-09-07 08:52 - 00000000 ____D C:\Program Files\Microsoft Device Center
2012-09-05 07:07 - 2012-09-05 07:07 - 00000000 ___HD C:\Users\Edgar\AppData\Roaming\pdfforge
2012-09-05 05:59 - 2012-09-05 05:59 - 00479737 ____A 2012-09-04 20:11 - 2012-09-05 06:52 - 00000000 ____D C:\Users\All Users\7531CCA90049767300078AF7F875EF60
2012-09-04 20:10 - 2012-09-04 20:10 - 01616896 ___AH C:\Users\Edgar\AppData\Roaming\bysdm.dll
2012-09-04 10:59 - 2012-09-04 10:59 - 00259214 ____A 2012-09-03 05:49 - 2012-09-22 08:07 - 00002971 ____A C:\Windows\setupact.log
2012-09-03 05:49 - 2012-09-03 05:49 - 00000000 ____A C:\Windows\setuperr.log
2012-09-03 04:56 - 2012-09-03 04:56 - 00001204 ____A C:\Users\Public\Desktop\PDFArchitect.lnk
2012-09-03 04:56 - 2012-09-03 04:56 - 00001035 ____A C:\Users\Public\Desktop\PDFCreator.lnk
2012-09-03 04:56 - 2012-07-29 03:59 - 00096768 ____A (pdfforge GbR) C:\Windows\System32\pdfcmon.dll
2012-09-03 04:56 - 2012-05-05 01:54 - 00137000 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSMAPI32.OCX
2012-09-03 04:56 - 2012-05-05 01:54 - 00023552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSMPIDE.DLL
2012-09-03 04:56 - 1998-07-06 08:56 - 00125712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\VB6DE.DLL
2012-09-03 04:56 - 1998-07-06 08:55 - 00158208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCDE.DLL
2012-09-03 04:56 - 1998-07-06 08:55 - 00064512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSCC2DE.DLL
2012-09-03 04:55 - 2012-09-03 04:55 - 28968784 ____A (pdfforge GbR) C:\Users\Admin\Downloads\PDFCreator-1_5_0_setup.exe
2012-09-01 13:41 - 2012-09-01 13:41 - 00001439 ____A
==================== 3 Months Modified Files ==================

2012-09-22 08:07 - 2012-09-03 05:49 - 00002971 ____A C:\Windows\setupact.log
2012-09-22 08:07 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-09-22 08:06 - 2011-06-24 19:26 - 01492646 ____A C:\Windows\WindowsUpdate.log
2012-09-22 08:00 - 2012-06-10 00:50 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-09-22 07:49 - 2012-09-22 07:49 - 00515892 ____A C:\Users\Admin\Downloads\eeepcfr.zip
2012-09-22 07:45 - 2009-07-13 20:45 - 00020944 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-09-22 07:45 - 2009-07-13 20:45 - 00020944 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-09-22 07:43 - 2012-09-22 07:43 - 01376768 ____A C:\Users\Admin\Downloads\7z920-x64.msi
2012-09-22 07:38 - 2011-07-22 05:12 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-09-22 07:36 - 2012-09-22 05:07 - 00000004 ___AH C:\Users\Edgar\AppData\Roaming\msconfig.ini
2012-09-22 07:31 - 2012-09-22 07:39 - 98077435 ____A (Igor Pavlov) C:\Users\Admin\Desktop\OTLPEStd.exe
2012-09-22 06:52 - 2009-07-13 21:13 - 01613340 ____A C:\Windows\System32\PerfStringBackup.INI
2012-09-22 06:40 - 2012-09-22 05:18 - 00000000 ____A C:\Users\Edgar\AppData\Local\¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ
2012-09-22 06:29 - 2011-07-22 05:12 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-09-21 08:53 - 2012-08-07 07:41 - 00000240 ____A C:\Windows\System32\config\netlogon.ftl
2012-09-21 03:46 - 2012-08-28 13:26 - 00000368 ____A C:\Windows\Tasks\HPCeeScheduleForedgar.bernardi.job
2012-09-15 21:40 - 2011-10-07 08:41 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log
2012-09-14 02:22 - 2012-08-07 07:49 - 00001014 _RASH C:\Windows\System32\MRT.exe
2012-09-07 10:56 - 2012-09-07 10:56 - 00246760 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2012-09-07 10:56 - 2012-09-07 10:56 - 00174056 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2012-09-07 10:56 - 2012-09-07 10:56 - 00174056 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2012-09-07 10:56 - 2012-09-07 10:56 - 00095208 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2012-09-07 10:56 - 2012-05-26 08:31 - 00821736 ____A (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2012-09-05 07:09 - 2012-04-23 11:42 - 00000072 ____A C:\Windows\System32\ricdb.ini
2012-09-05 05:59 - 2012-09-05 05:59 - 00479737 ____A C:\Users\Edgar\AppData\Roaming\bysdm.dll
2012-09-04 10:59 - 2012-09-04 10:59 - 00259214 ____A C:\Users\edgar.bernardi\Documents\SCRA_Architecture_20120904_v1.0.pptx
2012-09-03 17:11 - 2009-07-13 21:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-09-03 14:02 - 2012-09-03 14:02 - 00479909 ____A
C:\Windows\setuperr.log
2012-09-03 04:56 - 2012-09-03 04:56 - 00001204 ____A C:\Users\Public\Desktop\PDFArchitect.lnk
2012-09-03 04:56 - 2012-09-03 04:56 - 00001035 ____A C:\Users\Public\Desktop\PDFCreator.lnk
2012-09-03 04:55 - 2012-09-03 04:55 - 28968784 ____A (pdfforge GbR) C:\Users\Admin\Downloads\PDFCreator-1_5_0_setup.exe
2012-09-01 13:41 - 2012-09-01 13:41 - 00001439 ____A 2012-08-28 15:29 - 2012-08-07 07:44 - 00008886 _RASH C:\Users\All Users\ntuser.pol
2012-08-27 16:29 - 2012-08-27 16:27 - 00003826 ____A C:\Windows\IE9_main.log
2012-08-27 06:49 - 2011-07-10 04:07 - 00002517 ____A C:\Users\Public\Desktop\Skype.lnk
2012-08-26 16:06 - 2012-04-14 06:20 - 00696520 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-08-26 16:06 - 2011-05-10 15:02 - 00073416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-08-24 23:10 - 2011-08-03 11:01 - 00000000 ____A C:\ctapi_out_gr.txt
2012-08-22 10:12 - 2012-09-13 22:47 - 01913200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2012-08-22 10:12 - 2012-09-13 22:47 - 00950128 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys
2012-08-22 10:12 - 2012-09-13 22:47 - 00376688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys
2012-08-22 10:12 - 2012-09-13 22:47 - 00288624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS
2012-08-17 09:43 - 2009-07-13 20:45 - 00480752 ____A C:\Windows\System32\FNTCACHE.DAT
2012-08-17 09:42 - 2011-06-24 19:49 - 00283386 ____A C:\Windows\PFRO.log
2012-08-17 08:03 - 2012-08-17 08:03 - 00955888 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
2012-08-17 08:03 - 2012-08-17 08:03 - 00839152 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2012-08-17 08:03 - 2012-08-17 08:03 - 00268784 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2012-08-17 08:03 - 2012-08-17 08:03 - 00189424 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2012-08-17 08:03 - 2012-08-17 08:03 - 00188912 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2012-08-17 08:01 - 2012-08-17 08:01 - 21869552 ____A (Oracle Corporation) C:\Users\Admin\Downloads\jre-7u5-windows-x64.exe
2012-08-12 05:27 - 2012-08-09 17:43 - 00029292 ____A
C:\Users\Edgar\Thumbs.db
2012-08-10 06:05 - 2012-08-10 06:05 - 00002723 ____A C:\Windows\System32\d3d10level9.dll
2012-08-02 08:57 - 2012-09-13 22:47 - 00490496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2012-07-29 07:34 - 2011-07-24 00:51 - 00264004 ____A C:\BankCom.log
2012-07-29 07:34 - 2011-07-24 00:51 - 00223692 ____A C:\BankContacts.log
2012-07-29 03:59 - 2012-09-03 04:56 - 00096768 ____A (pdfforge GbR) C:\Windows\System32\pdfcmon.dll
2012-07-27 14:24 - 2012-07-27 14:24 - 00001002 ____A C:\Users\Public\Desktop\Personal Backup 5.lnk
2012-07-27 14:24 - 2012-07-27 14:23 - 06959510 ____A (J. Rathlev ) C:\Users\Admin\Downloads\pb-setup-5.3.0100.exe
2012-07-25 05:29 - 2011-07-26 08:18 - 00000020 ____H C:\Users\All Users\PKP_DLet.DAT
2012-07-18 10:15 - 2012-08-17 08:06 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-07-13 12:54 - 2009-07-13 18:34 - 00000478 ____A C:\Windows\win.ini
2012-07-12 00:46 - 2011-07-26 08:18 - 00000020 ____H C:\Users\All Users\PKP_DLev.DAT
2012-07-06 12:07 - 2012-08-17 08:15 - 00552960 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\bthport.sys
2012-07-04 14:16 - 2012-08-17 08:06 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\netapi32.dll
2012-07-04 14:13 - 2012-08-17 08:06 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\browser.dll
2012-07-04 14:13 - 2012-08-17 08:06 - 00059392 ____A (Microsoft Corporation) C:\Windows\System32\browcli.dll
2012-07-04 13:16 - 2012-08-17 08:06 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
2012-07-04 13:14 - 2012-08-17 08:06 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
2012-07-04 12:26 - 2012-09-13 22:47 - 00041472 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\RNDISMP.sys
2012-06-26 23:06 - 2012-08-17 08:06 - 01494016 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-26 23:06 - 2012-08-17 08:06 - 01188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-26 23:06 - 2012-08-17 08:06 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-26 23:03 - 2012-08-17 08:07 - 09059840 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-26 23:03 - 2012-08-17 08:06 - 00735744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-06-26 23:03 - 2012-08-17 08:06 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-26 23:02 - 2012-08-17 08:06 - 12297216 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-26 23:02 - 2012-08-17 08:06 - 02453504 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-26 23:02 - 2012-08-17 08:06 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-26 23:02 - 2012-08-17 08:06 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-26 21:53 - 2012-08-17 08:06 - 01231360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-06-26 21:53 - 2012-08-17 08:06 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-06-26 21:53 - 2012-08-17 08:06 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-26 21:51 - 2012-08-17 08:07 - 06027776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-06-26 21:51 - 2012-08-17 08:06 - 00627712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-06-26 21:51 - 2012-08-17 08:06 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-06-26 21:50 - 2012-08-17 08:07 - 11020800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-06-26 21:50 - 2012-08-17 08:06 - 02073600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-06-26 21:50 - 2012-08-17 08:06 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-06-26 21:50 - 2012-08-17 08:06 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-06-26 20:53 - 2012-08-17 08:06 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-26 20:10 - 2012-08-17 08:06 - 01638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-06-26 11:38 - 2012-06-26 11:38 - 00046176 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\point64.sys

==================== Known DLLs (Whitelisted) =================


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-07-09 03:03] - [2011-02-24 22:19] - 2871808 ____A (Microsoft Corporation) 332FEAB1435662FC6C672E25BEB37BE3

C:\Windows\System32\winlogon.exe
[2011-07-25 08:41] - [2010-11-20 05:25] - 0390656 ____A (Microsoft Corporation) 1151B1BAA6F350B1DB6598E0FEA7C457

C:\Windows\System32\wininit.exe
[2009-07-13 15:52] - [2009-07-13 17:39] - 0129024 ____A (Microsoft Corporation) 94355C28C1970635A31B3FE52EB7CEBA

C:\Windows\System32\svchost.exe
[2009-07-13 15:31] - [2009-07-13 17:39] - 0027136 ____A (Microsoft Corporation) C78655BC80301D76ED4FEF1C1EA40A7D

C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\User32.dll
[2011-07-25 08:42] - [2010-11-20 05:27] - 1008128 ____A (Microsoft Corporation) FE70103391A64039A921DBFFF9C7AB1B

C:\Windows\System32\userinit.exe
[2011-07-25 08:40] - [2010-11-20 05:25] - 0030720 ____A (Microsoft Corporation) BAFE84E637BF7388C96EF48D4D3FDD53

C:\Windows\System32\Drivers\volsnap.sys
[2011-07-25 08:41] - [2010-11-20 05:34] - 0295808 ____A (Microsoft Corporation) 0D08D2F3B3FF84E433346669B5E0F639


==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-09-04 20:11:28
Restore point made on: 2012-09-04 20:20:25
Restore point made on: 2012-09-04 20:24:45
Restore point made on: 2012-09-04 20:26:03
Restore point made on: 2012-09-04 21:01:08
Restore point made on: 2012-09-04 21:03:57
Restore point made on: 2012-09-04 22:46:17
Restore point made on: 2012-09-07 08:46:45
Restore point made on: 2012-09-07 08:52:36
Restore point made on: 2012-09-07 10:55:58
Restore point made on: 2012-09-12 06:43:26
Restore point made on: 2012-09-12 06:46:55
Restore point made on: 2012-09-13 22:47:39
Restore point made on: 2012-09-21 05:28:39
Restore point made on: 2012-09-22 04:30:37
Restore point made on: 2012-09-22 04:49:10
Restore point made on: 2012-09-22 06:36:04
Restore point made on: 2012-09-22 07:44:51

==================== Memory info ===========================

Percentage of memory in use: 16%
Total physical RAM: 4006.36 MB
Available physical RAM: 3333.88 MB
Total Pagefile: 4004.64 MB
Available Pagefile: 3346.06 MB
Total Virtual: 2047.88 MB
Available Virtual: 1968.73 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:278.16 GB) (Free:121.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive e: (HP_RECOVERY) (Fixed) (Total:14.63 GB) (Free:2.18 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive f: (HP_TOOLS) (Fixed) (Total:4.98 GB) (Free:2.12 GB) FAT32
4 Drive g: (CD_ROM) (CDROM) (Total:4.17 GB) (Free:0 GB) CDFS
5 Drive h: () (Removable) (Total:1.96 GB) (Free:1.96 GB) FAT
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
7 Drive y: (SYSTEM) (Fixed) (Total:0.29 GB) (Free:0.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 298 GB 0 B
Datentr„ger 1 Online 2008 MB 0 B

Partitions of Disk 0:
===============

Datentr„ger 0 ist jetzt der gew„hlte Datentr„ger.

Partition ### Typ GrӇe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 300 MB 1024 KB
Partition 2 Prim„r 278 GB 301 MB
Partition 3 Prim„r 14 GB 278 GB
Partition 4 Prim„r 5115 MB 293 GB

=========================================================

Disk: 0
Datentr„ger 0 ist jetzt der gew„hlte Datentr„ger.

Partition 1
Typ : 07
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y SYSTEM NTFS Partition 300 MB Fehlerfre

=========================================================

Disk: 0
Datentr„ger 0 ist jetzt der gew„hlte Datentr„ger.

Partition 2
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 278 GB Fehlerfre

=========================================================

Disk: 0
Datentr„ger 0 ist jetzt der gew„hlte Datentr„ger.

Partition 3
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E HP_RECOVERY NTFS Partition 14 GB Fehlerfre

=========================================================

Disk: 0
Datentr„ger 0 ist jetzt der gew„hlte Datentr„ger.

Partition 4
Typ : 0C
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 F HP_TOOLS FAT32 Partition 5115 MB Fehlerfre

=========================================================

Disk: 0
Datentr„ger 0 ist jetzt der gew„hlte Datentr„ger.

Partition 4
Typ : 0C
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 F HP_TOOLS FAT32 Partition 5115 MB Fehlerfre

=========================================================

Partitions of Disk 1:
===============

Datentr„ger 1 ist jetzt der gew„hlte Datentr„ger.

Partition ### Typ GrӇe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 2008 MB 16 KB

=========================================================

Disk: 1
Datentr„ger 1 ist jetzt der gew„hlte Datentr„ger.

Partition 1
Typ : 06
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H FAT Wechselmed 2008 MB Fehlerfre

=========================================================

Disk: 1
Datentr„ger 1 ist jetzt der gew„hlte Datentr„ger.

Partition 1
Typ : 06
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ GrӇe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H FAT Wechselmed 2008 MB Fehlerfre

=========================================================

Last Boot: 2012-09-15 14:29

==================== End Of Log ===========================

Den Hinweis mi dem FRST.Scan habe ich von Forenteilnehmer Larusso, vielen Dank.
Wollte das ergänzen, weiß aber nicht, wie ich meinen Beitrag nachträglich ergänzen kann.

Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log