BKA/GVU Trojaner Win7 32bit

cayinda2

Hallo, habe mir den BKA/GVU trojaner eingefangen. Habe Win7 32bit und der abgesicherte Modus klappt nicht. Malwarebytes findet nichts. Hier das FRST-Log:


Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-06-2013
Ran by SYSTEM on 16-06-2013 11:35:18
Running from C:\
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [CTHelper] CTHELPER.EXE [x]
HKLM\...\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files\AMD AVT\bin\kdbsync.exe" aml [10752 2012-01-31] ()
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [641664 2012-04-06] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SSDMonitor] C:\Program Files\Symantec\Norton Utilities 16\sMonitor\SSDMonitor.exe [104480 2012-09-29] (Symantec)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [2238704 2013-02-21] (Logitech, Inc.)
HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [262656 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKU\Administrator\...\Run: [fli4l] "C:\Program Files\Imonc3_0_4\Imonc.exe" /S:192.168.178.1 [ 2010-06-25] ()
HKU\Administrator\...\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [x]
HKU\Administrator\...\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 [x]
HKU\Administrator\...\RunOnce: [CTAutoUpdate] "C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe" /RunFromInstaller [ 2009-01-15] (Creative Technology Ltd)
HKU\Administrator\...\RunOnce: [InetReg] "C:\Program Files\Creative\Produktregistrierung\German\InetReg.exe" /PreProcess=RegFlash.exe /Delay=6 [x]
HKU\volker\...\Run: [iDevice Manager Launcher] "C:\Program Files\Software4u\iDevice Manager\Software4u.IDMLauncher.exe" /run [ 2013-04-28] (Marx Softwareentwicklung - www.software4u.de)
HKU\volker\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] D:\Temp\KNVH7Wf.exe [x]
HKU\volker\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\volker\...\Command Processor: "D:\Temp\KNVH7Wf.exe" <===== ATTENTION!
Startup: C:\Users\volker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files\FRITZ!DSL\FritzDsl.exe (AVM Berlin)

========================== Services (Whitelisted) =================

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2011-07-17] (Creative Labs)
S3 DiskDoctorService; C:\Program Files\Symantec\Norton Utilities 16\Tools\Disk Doctor\DiskDoctorSrv.exe [1147424 2012-09-29] (Symantec Corporation)
S3 GSService; C:\Windows\system32\GSService.exe [403832 2012-12-30] ()
S2 IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] ()
S2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [73528 2009-07-28] (AVM Berlin)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S2 NAV; C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\diMaster.dll [554288 2013-03-29] (Symantec Corporation)
S2 NCO; C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\diMaster.dll [554288 2013-03-29] (Symantec Corporation)
S2 NU16StartManagerSvc; C:\Program Files\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe [792608 2012-09-29] (Symantec)
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2012-01-21] ()
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Technische Unterstützung (Engineer) 2012\RpcAgentSrv.exe [93848 2008-11-06] (SiSoftware)
S3 SpeedDiskService; C:\Program Files\Symantec\Norton Utilities 16\Tools\SpeedDisk\SpeedDiskSrv.exe [1160224 2012-09-29] (Symantec Corporation)
S2 WMPNetworkSvc;

==================== Drivers (Whitelisted) ====================

S3 atidgllk; C:\Program Files\GPU-Z\atidgllk.sys [12048 2006-07-19] (ATI Technologies Inc.)
S1 atitray; C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [20384 2011-03-27] ()
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [14976 2006-11-07] (AVM GmbH)
S1 ccSet_NAV; C:\Windows\system32\drivers\NAV\1403010.016\ccSetx86.sys [134304 2012-11-16] (Symantec Corporation)
S1 ccSet_NST; C:\Windows\system32\drivers\NST\7DD03030.013\ccSetx86.sys [134304 2012-11-16] (Symantec Corporation)
S3 COMMONFX; C:\Windows\System32\drivers\COMMONFX.SYS [99416 2010-03-18] (Creative Technology Ltd)
S3 COMMONFX.SYS; C:\Windows\System32\drivers\COMMONFX.SYS [99416 2010-03-18] (Creative Technology Ltd)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2009-12-18] ()
S3 CT20XUT.DLL; C:\Windows\System32\CT20XUT.DLL [164608 2007-04-12] (Creative Technology Ltd.)
S3 CTAUDFX; C:\Windows\System32\drivers\CTAUDFX.SYS [555096 2010-03-18] (Creative Technology Ltd)
S3 CTAUDFX.SYS; C:\Windows\System32\drivers\CTAUDFX.SYS [555096 2010-03-18] (Creative Technology Ltd)
S3 ctdvda2k; C:\Windows\System32\drivers\ctdvda2k.sys [347144 2010-03-18] (Creative Technology Ltd)
S3 CTEAPSFX.DLL; C:\Windows\System32\CTEAPSFX.DLL [168192 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPFX.DLL; C:\Windows\System32\CTEDSPFX.DLL [280320 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPIO.DLL; C:\Windows\System32\CTEDSPIO.DLL [128768 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPSY.DLL; C:\Windows\System32\CTEDSPSY.DLL [323328 2007-04-12] (Creative Technology Ltd)
S3 CTERFXFX; C:\Windows\System32\drivers\CTERFXFX.SYS [100952 2010-03-18] (Creative Technology Ltd)
S3 CTERFXFX.SYS; C:\Windows\System32\drivers\CTERFXFX.SYS [100952 2010-03-18] (Creative Technology Ltd)
S3 CTEXFIFX.DLL; C:\Windows\System32\CTEXFIFX.DLL [1317632 2007-04-12] (Creative Technology Ltd.)
S3 CTHWIUT.DLL; C:\Windows\System32\CTHWIUT.DLL [66816 2007-04-12] (Creative Technology Ltd.)
S3 CTSBLFX; C:\Windows\System32\drivers\CTSBLFX.SYS [566360 2010-03-18] (Creative Technology Ltd)
S3 CTSBLFX.SYS; C:\Windows\System32\drivers\CTSBLFX.SYS [566360 2010-03-18] (Creative Technology Ltd)
S3 drhard; C:\Windows\system32\DRIVERS\DRHARD.SYS [23600 2005-12-01] (Licensed for Gebhard Software)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-12-15] (Symantec Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)
S0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [15720 2012-04-18] (GARMIN Corp.)
S3 ha10kx2k; C:\Windows\System32\drivers\ha10kx2k.sys [798808 2010-03-18] (Creative Technology Ltd)
S3 hap16v2k; C:\Windows\System32\drivers\hap16v2k.sys [162904 2010-03-18] (Creative Technology Ltd)
S3 hap17v2k; C:\Windows\System32\drivers\hap17v2k.sys [189528 2010-03-18] (Creative Technology Ltd)
S3 ksaud; C:\Windows\System32\drivers\ksaud.sys [1255168 2010-07-30] (Creative Technology Ltd.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [28160 2009-07-08] (hxxp://libusb-win32.sourceforge.net)
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [40200 2013-01-03] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30984 2013-01-03] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S3 MP4ConverterAudio; C:\Windows\System32\drivers\MP4ConverterAudio.sys [23608 2012-12-30] (Windows (R) Win 7 DDK provider)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [6504 2009-05-13] ()
S0 oem-drv86; C:\Windows\System32\DRIVERS\oem-drv86.sys [28160 2013-06-16] (secr9tos)
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Technische Unterstützung (Engineer) 2012\WNt500x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [47176 2010-07-28] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [61312 2011-10-14] (Silicon Laboratories)
S0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
S3 SRTSP; C:\Windows\System32\Drivers\NAV\1403010.016\SRTSP.SYS [602712 2013-01-29] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NAV\1403010.016\SRTSPX.SYS [32344 2013-01-29] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NAV\1403010.016\SYMDS.SYS [367704 2013-01-22] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NAV\1403010.016\SYMEFA.SYS [934488 2013-01-31] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2012-12-16] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NAV\1403010.016\Ironx86.SYS [175264 2012-11-16] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NAV\1403010.016\SYMNETS.SYS [338592 2013-01-31] (Symantec Corporation)
S1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [24680 2011-01-26] (CaptainFlint Software)
S3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [117760 2011-02-25] (VIA Technologies, Inc.)
S3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [164864 2011-02-25] (VIA Technologies, Inc.)
S1 BHDrvx86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\BASHDefs\20130515.001\BHDrvx86.sys [x]
S3 COMMONFX.DLL; system32\COMMONFX.DLL [x]
S3 CTAUDFX.DLL; system32\CTAUDFX.DLL [x]
S3 CTERFXFX.DLL; system32\CTERFXFX.DLL [x]
S3 CTSBLFX.DLL; system32\CTSBLFX.DLL [x]
S1 EIO; system32\DRIVERS\EIO.sys [x]
S3 EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S1 IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\IPSDefs\20130531.001\IDSvix86.sys [x]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\VirusDefs\20130603.003\NAVENG.SYS [x]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\VirusDefs\20130603.003\NAVEX15.SYS [x]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-14 23:27 - 2013-06-14 23:27 - 00000000 ____D C:\FRST
2013-06-14 22:20 - 2013-06-14 20:46 - 01359323 ____A (Farbar) C:\FRST.exe
2013-06-14 22:18 - 2013-06-14 22:18 - 00003424 ____N C:\bootsqm.dat
2013-06-14 22:18 - 2013-06-14 22:18 - 00000000 __SHD C:\found.000
2013-06-14 20:16 - 2013-06-14 18:05 - 09171472 ____A (SurfRight B.V.) C:\HitmanPro.exe
2013-06-14 20:16 - 2013-06-03 10:32 - 09833328 ____A (SurfRight B.V.) C:\HitmanPro_x64.exe
2013-06-14 13:38 - 2013-06-14 13:38 - 00163058 ____A C:\ProgramData\2433f433
2013-06-14 13:38 - 2013-06-14 13:38 - 00163038 ____A C:\Users\volker\AppData\Roaming\2433f433
2013-06-14 13:38 - 2013-06-14 13:38 - 00163008 ____A C:\Users\volker\AppData\Local\2433f433
2013-06-12 21:40 - 2013-05-16 23:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 21:40 - 2013-05-16 23:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 21:40 - 2013-05-16 23:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 21:40 - 2013-05-16 23:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-12 21:40 - 2013-05-16 23:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 21:40 - 2013-05-16 23:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 21:40 - 2013-05-16 23:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-12 21:40 - 2013-05-16 23:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-12 21:40 - 2013-05-16 23:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 21:40 - 2013-05-16 23:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 21:40 - 2013-05-16 23:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-12 21:40 - 2013-05-16 23:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 21:40 - 2013-05-16 23:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 21:39 - 2013-05-17 00:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 21:39 - 2013-05-16 23:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 21:39 - 2013-05-16 23:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-12 18:38 - 2013-05-13 05:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 18:38 - 2013-05-13 05:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 18:38 - 2013-05-13 05:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 18:38 - 2013-05-13 04:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 18:38 - 2013-05-13 04:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 18:38 - 2013-05-10 04:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 18:38 - 2013-05-08 06:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 18:38 - 2013-05-06 06:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 18:38 - 2013-05-06 06:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 18:38 - 2013-04-26 05:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 18:38 - 2013-04-26 00:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 18:38 - 2013-04-17 08:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-09 16:18 - 2013-06-09 16:18 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iPod
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt32.exe.lnk
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt Kurzanleitung.pdf.lnk
2013-06-01 13:10 - 2013-06-01 13:13 - 00000032 ____A C:\Windows\CD_Start.INI
2013-05-30 13:17 - 2013-04-10 06:18 - 00728424 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-30 13:17 - 2013-04-10 06:18 - 00218984 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-30 13:17 - 2013-04-10 04:14 - 02347520 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-30 13:17 - 2013-03-19 05:53 - 00186368 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-30 13:17 - 2013-03-19 04:33 - 00040960 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-30 13:17 - 2013-02-27 06:05 - 00101720 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-30 13:17 - 2013-02-27 05:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-30 13:17 - 2013-02-27 05:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-30 13:17 - 2013-02-27 05:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-30 13:17 - 2013-02-27 05:49 - 00047104 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll

==================== One Month Modified Files and Folders ========

2013-06-16 10:32 - 2012-12-16 20:22 - 00000278 ____A C:\Windows\Tasks\NUAutoUpdate.job
2013-06-16 10:32 - 2011-11-27 16:42 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-16 10:32 - 2011-05-12 12:53 - 00178240 ____A C:\Windows\setupact.log
2013-06-16 10:32 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-16 10:31 - 2011-07-15 18:58 - 00028160 ____A (secr9tos) C:\Windows\System32\Drivers\oem-drv86.sys
2013-06-14 23:29 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\LogFiles
2013-06-14 23:27 - 2013-06-14 23:27 - 00000000 ____D C:\FRST
2013-06-14 22:18 - 2013-06-14 22:18 - 00003424 ____N C:\bootsqm.dat
2013-06-14 22:18 - 2013-06-14 22:18 - 00000000 __SHD C:\found.000
2013-06-14 22:11 - 2011-07-17 20:35 - 00000000 ____D C:\ProgramData\Norton
2013-06-14 22:11 - 2011-07-17 14:26 - 00000000 ____D C:\Users\volker\AppData\Roaming\SlimBrowser
2013-06-14 22:11 - 2011-07-15 20:41 - 00000000 ____D C:\Users\volker\AppData\Roaming\GHISLER
2013-06-14 22:11 - 2011-07-15 19:00 - 00000000 ____D C:\users\volker
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\wfp
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-14 20:46 - 2013-06-14 22:20 - 01359323 ____A (Farbar) C:\FRST.exe
2013-06-14 18:05 - 2013-06-14 20:16 - 09171472 ____A (SurfRight B.V.) C:\HitmanPro.exe
2013-06-14 13:38 - 2013-06-14 13:38 - 00163058 ____A C:\ProgramData\2433f433
2013-06-14 13:38 - 2013-06-14 13:38 - 00163038 ____A C:\Users\volker\AppData\Roaming\2433f433
2013-06-14 13:38 - 2013-06-14 13:38 - 00163008 ____A C:\Users\volker\AppData\Local\2433f433
2013-06-14 13:37 - 2012-10-30 16:20 - 04931577 ____A C:\Windows\{00000005-00000000-00000001-00001102-00000004-20021102}.BAK
2013-06-14 13:37 - 2012-10-30 16:17 - 04931577 ____A C:\Windows\{00000005-00000000-00000001-00001102-00000004-20021102}.CDF
2013-06-14 13:37 - 2011-07-15 18:58 - 02006644 ____A C:\Windows\WindowsUpdate.log
2013-06-14 13:35 - 2011-07-21 20:39 - 00000000 ____D C:\Program Files\Zoom Player
2013-06-14 13:21 - 2011-11-27 16:42 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-14 13:20 - 2012-03-30 15:24 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-14 13:20 - 2010-11-20 22:01 - 00006630 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-13 18:06 - 2012-12-17 19:00 - 00000396 ____A C:\Windows\System32\AppLog.log
2013-06-13 18:06 - 2012-12-16 20:22 - 00000270 ____A C:\Windows\Tasks\NUSchedule.job
2013-06-13 14:46 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-13 14:46 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-13 14:39 - 2013-03-23 13:08 - 00032019 ____A C:\Users\volker\DesktopStCenter.txt
2013-06-12 21:42 - 2011-07-17 14:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 21:40 - 2011-05-12 12:26 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 19:23 - 2012-03-30 15:24 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 19:23 - 2011-07-17 14:27 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-12 18:55 - 2012-12-16 19:57 - 00000000 ____D C:\Windows\System32\Drivers\NAV
2013-06-09 16:18 - 2013-06-09 16:18 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iPod
2013-06-09 16:18 - 2011-07-24 19:50 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-06-03 10:32 - 2013-06-14 20:16 - 09833328 ____A (SurfRight B.V.) C:\HitmanPro_x64.exe
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt32.exe.lnk
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt Kurzanleitung.pdf.lnk
2013-06-01 13:13 - 2013-06-01 13:10 - 00000032 ____A C:\Windows\CD_Start.INI
2013-06-01 13:07 - 2012-07-03 21:43 - 00000000 ____D C:\Program Files\WATT32
2013-05-31 08:10 - 2010-11-20 22:48 - 00463602 ____A C:\Windows\PFRO.log
2013-05-30 21:37 - 2011-07-17 15:58 - 00000000 ____D C:\Program Files\JDownloader
2013-05-30 20:50 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-05-30 15:22 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-30 13:23 - 2009-07-14 05:33 - 00420072 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-17 00:08 - 2013-06-12 21:39 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-06-07 18:00:31
Restore point made on: 2013-06-09 18:00:35
Restore point made on: 2013-06-10 18:00:35
Restore point made on: 2013-06-11 18:00:33
Restore point made on: 2013-06-12 21:39:56
Restore point made on: 2013-06-13 18:00:46

==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 3262.08 MB
Available physical RAM: 2741.15 MB
Total Pagefile: 3258.31 MB
Available Pagefile: 2749.02 MB
Total Virtual: 2047.88 MB
Available Virtual: 1922.29 MB

==================== Drives ================================

Drive c: (C) (Fixed) (Total:111.79 GB) (Free:36.22 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:146.48 GB) (Free:78.49 GB) NTFS
Drive e: (G (Fixed) (Total:931.51 GB) (Free:736.87 GB) NTFS
Drive f: (D) (Fixed) (Total:155.19 GB) (Free:81.17 GB) NTFS
Drive g: (E) (Fixed) (Total:629.84 GB) (Free:264.43 GB) NTFS
Drive h: (madmax786511) (CDROM) (Total:2.53 GB) (Free:0 GB) UDF
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 750A4590)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 525FE842)
Partition 1: (Not Active) - (Size=932 GB) - (Type=OF Extended)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E9D1147C)
Partition 1: (Active) - (Size=146 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=785 GB) - (Type=OF Extended)


LastRegBack: 2013-06-14 15:37

==================== End Of Log ============================