GUV Trojaner Laptop VISTA

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-06-2013
Ran by Niccolò (administrator) on 16-06-2013 10:39:19
Running from G:\
Windows Vista (TM) Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Safe Mode (minimal)

==================== Could not list processes ===============

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [61440 2009-03-12] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6814240 2009-02-13] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1049896 2008-08-28] (Synaptics, Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM\...\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [500208 2011-04-05] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM\...\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-09] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM\...\Run: []  [x]
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [31072 2008-10-25] (Microsoft Corporation)
HKCU\...\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1233920 2009-04-11] (Microsoft Corporation)
HKCU\...\Run: [Google Update] "C:\Users\Niccolò\AppData\Local\Google\Update\GoogleUpdate.exe" /c [135664 2009-12-24] (Google Inc.)
HKCU\...\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe [2937528 2010-12-25] ()
HKCU\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [4E3E0230AEBB4E96] C:\Recycle.Bin\Recycle.Bin.exe [x]
HKCU\...\Run: [Paesexrau] C:\Users\Niccolò\AppData\Roaming\Viraqi\kutye.exe [x]
HKCU\...\Run: [IExplorer Util] C:\Users\Niccolò\AppData\Roaming\ie_util.exe [x]
HKCU\...\Run: [EPLTarget\P0000000000000001] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_TATIIVE.EXE /EPT "EPLTarget\P0000000000000001" /M "WF-2530 Series" [249440 2012-02-27] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [ctfmon.exe] C:\PROGRA~2\rundll32.exe C:\PROGRA~2\ri473.dat,FG00 [176128 2013-06-14] (?????????? ??????????)
HKCU\...\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-2236149280-2537161501-2249316146-1000\$e06f4385b66e4122870bd95753823b5c\n. ATTENTION! ====> ZeroAccess
Startup: C:\Users\Niccolò\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Niccolò\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Niccolò\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
ShortcutTarget: msconfig.lnk -> C:\PROGRA~2\ri473.dat (?????????? ??????????)
Startup: C:\Users\Niccolò\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Niccolò\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
ShortcutTarget: runctf.lnk -> C:\Users\NICCOL~1\3270382.dll (No File)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
URLSearchHook: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof0.dll (Conduit Ltd.)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
HKCU SearchScopes: DefaultScope {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll No File
BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
BHO: QipLI Class - {6B5863A0-C43F-4C0A-982B-CC0E9125783F} - C:\Users\Niccolò\AppData\Roaming\Microsoft\Internet Explorer\qstatsrv.dll (TODO: <Company name>)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll No File
BHO: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof0.dll (Conduit Ltd.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll No File
Toolbar: HKLM - softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files\softonic-de3\tbsof0.dll (Conduit Ltd.)
Toolbar: HKLM - Gutscheinmieze - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Niccolò\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)
Toolbar: HKLM - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL (TerraTec Electronic GmbH)
Toolbar: HKCU -softonic-de3 Toolbar - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files\softonic-de3\tbsof0.dll (Conduit Ltd.)
Toolbar: HKCU -Gutscheinmieze - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Niccolò\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Niccolò\AppData\Roaming\Mozilla\Firefox\Profiles\8xqnkkih.default
FF SearchEngine: foxsearch
FF Homepage: hxxp://start.icq.com/
FF Keyword.URL: hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @gamersfirst.com/LiveLauncher - C:\Program Files\GamersFirst\LIVE!\nplivelauncher.dll No File
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Gutscheinmieze - C:\Users\Niccolò\AppData\Roaming\Mozilla\Firefox\Profiles\8xqnkkih.default\Extensions\gutscheinmieze@synatix-gmbh.de
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Niccolò\AppData\Roaming\Mozilla\Firefox\Profiles\8xqnkkih.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: No Name - C:\Users\Niccolò\AppData\Roaming\Mozilla\Firefox\Profiles\8xqnkkih.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF Extension: No Name - C:\Users\Niccolò\AppData\Roaming\Mozilla\Firefox\Profiles\8xqnkkih.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF Extension: softonic-de3 Toolbar - C:\Users\Niccolò\AppData\Roaming\Mozilla\Firefox\Profiles\8xqnkkih.default\Extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}

Chrome: 
=======
CHR HomePage: hxxp://www.google.de/
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Niccol\u00F2\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Niccol\u00F2\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\Niccol\u00F2\AppData\Local\Google\Chrome\Application\27.0.1453.110\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\Niccol\u00F2\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7280_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.230.5) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U23) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Adobe Contribute CS5 ) - C:\Program Files\Mozilla Firefox\plugins\npContribute.dll (Adobe Systems, Inc.)
CHR Plugin: (Gutscheinmieze-Plugin) - C:\Program Files\Mozilla Firefox\plugins\npmieze.dll (Synatix GmbH)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Pando Web Installer) - C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll (Pando Networks)
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Skype Extension) - C:\Users\Niccolò\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0

========================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86224 2012-06-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110032 2012-06-01] (Avira Operations GmbH & Co. KG)
S2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] ()
S3 MSSQL$MSSMLBIZ; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [28933976 2006-04-14] (Microsoft Corporation)
S2 Rezip; C:\Windows\SYSTEM32\Rezip.exe [311296 2009-03-05] ()
S2 Winmgmt; C:\PROGRA~2\ri473.dat [176128 2013-06-14] (?????????? ??????????)
S2 yksvc; C:\Windows\System32\ykx32mpcoinst.dll [282624 2009-01-30] (Marvell)
S2 McAfee SiteAdvisor Service; "C:\Program Files\McAfee\SiteAdvisor\McSACore.exe" [x]
S3 msiserver; %systemroot%\system32\msiexec /V [x]

==================== Drivers (Whitelisted) ====================

S3 AF05BDA; C:\Windows\System32\DRIVERS\AF05BDA.sys [123584 2009-11-05] (AfaTech                  )
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83392 2012-06-01] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137928 2012-06-01] (Avira GmbH)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36000 2011-09-16] (Avira GmbH)
S2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2006-11-14] (SAMSUNG ELECTRONICS CO., LTD.)
S3 rtl819xp; C:\Windows\System32\DRIVERS\rtl819xp.sys [505344 2009-05-23] (Realtek Semiconductor Corporation                           )
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2011-04-04] (Duplex Secure Ltd.)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2009-10-08] (Avira GmbH)
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-16 20:26 - 2009-01-09 05:03 - 00213640 ____A (McAfee, Inc.) C:\Windows\System32\Drivers\mfehidk.sys
2013-06-16 20:26 - 2009-01-09 05:03 - 00079304 ____A (McAfee, Inc.) C:\Windows\System32\Drivers\mfeavfk.sys
2013-06-16 20:26 - 2009-01-09 05:03 - 00040552 ____A (McAfee, Inc.) C:\Windows\System32\Drivers\mfesmfk.sys
2013-06-16 20:26 - 2009-01-09 05:03 - 00035272 ____A (McAfee, Inc.) C:\Windows\System32\Drivers\mfebopk.sys
2013-06-16 20:26 - 2009-01-09 05:03 - 00034216 ____A (McAfee, Inc.) C:\Windows\System32\Drivers\mferkdk.sys
2013-06-16 20:26 - 2008-10-23 06:08 - 00130424 ____A (McAfee, Inc.) C:\Windows\System32\Drivers\Mpfp.sys
2013-06-16 20:26 - 2008-01-21 04:24 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\extmgr.dll
2013-06-16 20:26 - 2008-01-21 04:24 - 00078336 ____A (Microsoft Corporation) C:\Windows\System32\ieencode.dll
2013-06-16 20:26 - 2008-01-21 04:24 - 00054784 ____A (Microsoft Corporation) C:\Windows\System32\WsmProv.dll
2013-06-16 20:26 - 2008-01-21 04:24 - 00001536 ____A (Microsoft Corporation) C:\Windows\System32\WsmCl.dll
2013-06-16 20:26 - 2008-01-21 04:23 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vsp1cln.exe
2013-06-16 20:26 - 2008-01-21 04:23 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_Kernel_01007_Inbox_Critical.Wdf
2013-06-16 10:38 - 2013-06-16 10:38 - 00000000 ____D C:\FRST
2013-06-15 11:13 - 2013-06-15 11:13 - 00002612 ____A C:\ProgramData\374ir.js
2013-06-14 10:55 - 2013-06-16 10:29 - 95023320 ___AT C:\ProgramData\374ir.pad
2013-06-14 10:55 - 2013-06-16 10:29 - 00000000 ____A C:\ProgramData\as98213.txt
2013-06-14 10:55 - 2013-06-14 10:55 - 00176128 ____A (?????????? ??????????) C:\ProgramData\ri473.dat
2013-06-14 10:55 - 2013-06-14 10:55 - 00044544 ____A (Microsoft Corporation) C:\ProgramData\rundll32.exe
2013-06-14 10:55 - 2013-06-14 10:55 - 00000000 ____D C:\Windows\Sun
2013-06-14 10:39 - 2013-06-14 10:39 - 00367160 ____A C:\Users\Niccolò\Downloads\OR Vortrag.pptx
2013-06-12 08:11 - 2013-05-17 05:50 - 01212928 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 08:11 - 2013-05-17 05:50 - 00916480 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 08:11 - 2013-05-17 05:50 - 00105984 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-12 08:11 - 2013-05-17 05:48 - 00206848 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-12 08:11 - 2013-05-17 05:46 - 06014464 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 08:11 - 2013-05-17 05:46 - 00611840 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll
2013-06-12 08:11 - 2013-05-17 05:46 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-12 08:11 - 2013-05-17 05:45 - 00630272 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 08:11 - 2013-05-17 05:45 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-12 08:11 - 2013-05-17 05:45 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-12 08:11 - 2013-05-17 05:45 - 00025600 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 08:11 - 2013-05-17 05:44 - 11111424 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 08:11 - 2013-05-17 05:44 - 02004992 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 08:11 - 2013-05-17 05:44 - 01469440 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-12 08:11 - 2013-05-17 05:44 - 00387584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-12 08:11 - 2013-05-17 05:44 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-12 08:11 - 2013-05-17 05:44 - 00164352 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 08:11 - 2013-05-17 05:44 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 08:11 - 2013-05-17 05:44 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 08:11 - 2013-05-17 05:44 - 00055808 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 08:11 - 2013-05-17 04:06 - 00385024 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-12 08:11 - 2013-05-17 02:20 - 00133632 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-12 08:11 - 2013-05-17 02:19 - 00174080 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 08:11 - 2013-05-17 02:18 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 08:11 - 2013-05-17 02:18 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-12 08:11 - 2013-05-08 06:37 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 08:11 - 2013-05-02 06:04 - 00443904 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 08:11 - 2013-05-02 06:03 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-12 08:11 - 2013-04-24 06:00 - 00985600 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 08:11 - 2013-04-24 06:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 08:11 - 2013-04-24 06:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 08:11 - 2013-04-24 06:00 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 08:11 - 2013-04-24 03:46 - 00812544 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 08:10 - 2013-05-03 00:03 - 03603832 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 08:10 - 2013-05-03 00:03 - 03551096 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 08:10 - 2013-04-17 14:30 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-11 14:27 - 2013-06-11 14:28 - 03723264 ____A C:\Users\Niccolò\Downloads\Vorlesung 6 .ppt
2013-06-11 13:12 - 2013-06-11 13:12 - 01324544 ____A C:\Users\Niccolò\Downloads\Vorlesung 5 (1).ppt
2013-06-11 13:11 - 2013-06-11 13:11 - 01324544 ____A C:\Users\Niccolò\Downloads\Vorlesung 5.ppt
2013-06-11 12:35 - 2013-06-11 12:35 - 07113728 ____A C:\Users\Niccolò\Downloads\Vorlesung 4.ppt
2013-06-11 12:00 - 2013-06-11 12:01 - 16493568 ____A C:\Users\Niccolò\Downloads\Vorlesung 2 (1).ppt
2013-06-11 12:00 - 2013-06-11 12:01 - 13513728 ____A C:\Users\Niccolò\Downloads\Vorlesung 3.ppt
2013-06-11 11:49 - 2013-06-11 11:50 - 16493568 ____A C:\Users\Niccolò\Downloads\Vorlesung 2.ppt
2013-06-04 23:14 - 2013-06-04 23:14 - 00000000 ____D C:\Program Files\Dropbox
2013-06-03 23:41 - 2013-06-03 23:41 - 00035179 ____A C:\Users\Niccolò\Downloads\Trikosfsf.xlsx
2013-05-30 15:14 - 2013-05-30 15:14 - 00222272 ____A C:\Users\Niccolò\Downloads\20110827_2NE1_1st_Concert_NOLZA_-_CL_SOLO_MOV.exe
2013-05-21 08:37 - 2013-05-21 15:19 - 00000000 ____D C:\Users\Niccolò\Desktop\max prosa

==================== One Month Modified Files and Folders ========

2013-06-16 10:38 - 2013-06-16 10:38 - 00000000 ____D C:\FRST
2013-06-16 10:37 - 2006-11-02 14:47 - 03769680 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-16 10:30 - 2009-04-17 20:04 - 00000012 ____A C:\Windows\bthservsdp.dat
2013-06-16 10:30 - 2006-11-02 15:01 - 00032530 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-16 10:30 - 2006-11-02 15:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-16 10:29 - 2013-06-14 10:55 - 95023320 ___AT C:\ProgramData\374ir.pad
2013-06-16 10:29 - 2013-06-14 10:55 - 00000000 ____A C:\ProgramData\as98213.txt
2013-06-16 10:29 - 2006-11-02 14:47 - 00004784 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-16 10:29 - 2006-11-02 14:47 - 00004784 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-16 00:52 - 2009-04-17 20:04 - 01867472 ____A C:\Windows\WindowsUpdate.log
2013-06-16 00:50 - 2010-02-08 15:42 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-15 12:59 - 2013-02-21 13:29 - 00000000 ____D C:\Windows\pss
2013-06-15 12:20 - 2012-06-10 22:40 - 00000000 ____D C:\Users\Niccolò\AppData\Roaming\Dropbox
2013-06-15 12:20 - 2010-12-25 14:05 - 00000000 ____D C:\Users\Niccolò\AppData\Local\PMB Files
2013-06-15 12:19 - 2012-06-10 22:53 - 00000000 ___RD C:\Users\Niccolò\Dropbox
2013-06-15 12:19 - 2010-01-04 14:30 - 00000426 ___AH C:\Windows\Tasks\User_Feed_Synchronization-{A8B6D27C-2A96-4F75-BFA2-B3C56CF4622B}.job
2013-06-15 11:37 - 2012-11-23 16:45 - 00000000 ____D C:\Users\Niccolò\AppData\Roaming\Spotify
2013-06-15 11:36 - 2010-12-25 18:40 - 00000680 ____A C:\Users\Niccolò\AppData\Local\d3d9caps.dat
2013-06-15 11:13 - 2013-06-15 11:13 - 00002612 ____A C:\ProgramData\374ir.js
2013-06-14 18:10 - 2009-12-24 13:01 - 00001128 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2236149280-2537161501-2249316146-1000UA.job
2013-06-14 17:36 - 2010-02-08 15:42 - 00001100 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-14 15:08 - 2013-03-10 01:39 - 00000000 ____D C:\Users\Niccolò\AppData\Roaming\Fyahu
2013-06-14 15:08 - 2009-12-24 02:53 - 00000000 ____D C:\users\Niccolò
2013-06-14 10:55 - 2013-06-14 10:55 - 00176128 ____A (?????????? ??????????) C:\ProgramData\ri473.dat
2013-06-14 10:55 - 2013-06-14 10:55 - 00044544 ____A (Microsoft Corporation) C:\ProgramData\rundll32.exe
2013-06-14 10:55 - 2013-06-14 10:55 - 00000000 ____D C:\Windows\Sun
2013-06-14 10:39 - 2013-06-14 10:39 - 00367160 ____A C:\Users\Niccolò\Downloads\OR Vortrag.pptx
2013-06-14 09:39 - 2012-05-09 02:07 - 00000000 ____D C:\Users\Niccolò\Documents\dokumente
2013-06-14 09:38 - 2006-11-02 12:33 - 01715488 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-14 09:31 - 2009-12-24 13:01 - 00001076 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2236149280-2537161501-2249316146-1000Core.job
2013-06-13 19:18 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-06-13 19:14 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-06-13 18:51 - 2008-01-21 04:47 - 00779444 ____A C:\Windows\PFRO.log
2013-06-13 18:51 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-13 17:49 - 2006-11-02 12:24 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-06-12 09:16 - 2009-12-24 02:55 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 09:14 - 2013-03-27 19:03 - 00000000 ____D C:\Users\Niccolò\Desktop\Praktikum BOSCH
2013-06-11 21:30 - 2011-04-08 13:23 - 00000000 ____D C:\Users\Niccolò\AppData\Roaming\Skype
2013-06-11 14:28 - 2013-06-11 14:27 - 03723264 ____A C:\Users\Niccolò\Downloads\Vorlesung 6 .ppt
2013-06-11 13:12 - 2013-06-11 13:12 - 01324544 ____A C:\Users\Niccolò\Downloads\Vorlesung 5 (1).ppt
2013-06-11 13:11 - 2013-06-11 13:11 - 01324544 ____A C:\Users\Niccolò\Downloads\Vorlesung 5.ppt
2013-06-11 12:35 - 2013-06-11 12:35 - 07113728 ____A C:\Users\Niccolò\Downloads\Vorlesung 4.ppt
2013-06-11 12:01 - 2013-06-11 12:00 - 16493568 ____A C:\Users\Niccolò\Downloads\Vorlesung 2 (1).ppt
2013-06-11 12:01 - 2013-06-11 12:00 - 13513728 ____A C:\Users\Niccolò\Downloads\Vorlesung 3.ppt
2013-06-11 11:50 - 2013-06-11 11:49 - 16493568 ____A C:\Users\Niccolò\Downloads\Vorlesung 2.ppt
2013-06-07 00:36 - 2006-11-02 14:52 - 00213715 ____A C:\Windows\setupact.log
2013-06-06 14:31 - 2013-04-08 17:00 - 00002090 ____A C:\Users\Niccolò\Desktop\Google Chrome.lnk
2013-06-06 09:26 - 2012-11-23 16:45 - 00000000 ____D C:\Users\Niccolò\AppData\Local\Spotify
2013-06-04 23:14 - 2013-06-04 23:14 - 00000000 ____D C:\Program Files\Dropbox
2013-06-04 17:05 - 2011-06-08 09:33 - 00000000 ____D C:\Users\Niccolò\Documents\studium
2013-06-03 23:41 - 2013-06-03 23:41 - 00035179 ____A C:\Users\Niccolò\Downloads\Trikosfsf.xlsx
2013-05-31 13:31 - 2013-01-20 18:51 - 00000000 ____D C:\Users\Niccolò\Desktop\Clueso-So_Sehr_Dabei-Live-DE-2009-NBD
2013-05-30 15:14 - 2013-05-30 15:14 - 00222272 ____A C:\Users\Niccolò\Downloads\20110827_2NE1_1st_Concert_NOLZA_-_CL_SOLO_MOV.exe
2013-05-21 15:19 - 2013-05-21 08:37 - 00000000 ____D C:\Users\Niccolò\Desktop\max prosa
2013-05-17 05:50 - 2013-06-12 08:11 - 01212928 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-17 05:50 - 2013-06-12 08:11 - 00916480 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-17 05:50 - 2013-06-12 08:11 - 00105984 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-17 05:48 - 2013-06-12 08:11 - 00206848 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-05-17 05:46 - 2013-06-12 08:11 - 06014464 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-17 05:46 - 2013-06-12 08:11 - 00611840 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll
2013-05-17 05:46 - 2013-06-12 08:11 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-17 05:45 - 2013-06-12 08:11 - 00630272 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-17 05:45 - 2013-06-12 08:11 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-05-17 05:45 - 2013-06-12 08:11 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-05-17 05:45 - 2013-06-12 08:11 - 00025600 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-17 05:44 - 2013-06-12 08:11 - 11111424 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-17 05:44 - 2013-06-12 08:11 - 02004992 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-17 05:44 - 2013-06-12 08:11 - 01469440 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-17 05:44 - 2013-06-12 08:11 - 00387584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-05-17 05:44 - 2013-06-12 08:11 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-05-17 05:44 - 2013-06-12 08:11 - 00164352 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-17 05:44 - 2013-06-12 08:11 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-17 05:44 - 2013-06-12 08:11 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-17 05:44 - 2013-06-12 08:11 - 00055808 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-17 04:06 - 2013-06-12 08:11 - 00385024 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-05-17 02:20 - 2013-06-12 08:11 - 00133632 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-17 02:19 - 2013-06-12 08:11 - 00174080 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-17 02:18 - 2013-06-12 08:11 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-17 02:18 - 2013-06-12 08:11 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-2236149280-2537161501-2249316146-1000\$e06f4385b66e4122870bd95753823b5c

Files to move or delete:
====================
C:\ProgramData\rundll32.exe
C:\Users\Niccolò\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
C:\Users\Niccolò\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
C:\Users\Niccolò\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
C:\ProgramData\2830723.pad
C:\ProgramData\374ir.pad
C:\ProgramData\ri473.dat

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-15 11:17

==================== End Of Log ============================