GVU Trojaner bei Standardbenutzer

berni199

Hallo Leute,
mein Sohn hat sich auf seinem PC (Windows 7 64 Bit) auch den GVU-Trojaner eingefangen. Andere Benutzer und mein Admin-Konto sind bisher nicht betroffen. Ich habe den Rechner mit einem Windows 7 Image gebootet und schon mal mit FRST64 gescannt. Das log:


Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2013 01
Ran by SYSTEM on 29-06-2013 16:48:44
Running from I:\
Windows 7 Professional (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11545192 2010-11-02] (Realtek Semiconductor)
HKLM\...\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1281512 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe [454144 2012-10-15] (Saitek)
HKLM\...\Run: [SaiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe [158208 2012-10-15] (Saitek)
HKLM-x32\...\RunOnce: [EasyTuneVI] C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [40960 2012-02-01] ()
HKLM-x32\...\Run: [WTClient] WTClient.exe [32768 2009-10-30] (Tablet Driver)
HKU\Jonas\...\Run: [Google Update] "C:\Users\Jonas\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-06-26] (Google Inc.)
HKU\Jonas\...\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [1305408 2011-01-20] (DT Soft Ltd)
HKU\Jonas\...\Run: [Steam] "D:\Spiele\Steam\steam.exe" -silent [x]
HKU\Jonas\...\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EADM\Core.exe -silent [x]
HKU\Jonas\...\Run: [Facebook Update] "C:\Users\Jonas\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-07-11] (Facebook Inc.)
HKU\Jonas\...\Run: [Spotify] "C:\Users\Jonas\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart [5576408 2012-10-20] (Spotify Ltd)
HKU\Jonas\...\Run: [Spotify Web Helper] "C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1193176 2012-10-20] ()
HKU\Jonas\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\Jonas\AppData\Local\Temp\errgdg0nnrtg.exe [x] <===== ATTENTION
HKU\Jonas\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\Jonas\...\Command Processor: "C:\Users\Jonas\AppData\Local\Temp\errgdg0nnrtg.exe" <===== ATTENTION!
HKU\Jytte\...\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [1305408 2011-01-20] (DT Soft Ltd)
HKU\Jytte\...\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent [x]
HKU\Jytte\...\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EADM\Core.exe -silent [x]
Startup: C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> (No File)
Startup: C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> (No File)
Startup: C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Services (Whitelisted) =================

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-06-11] (Advanced Micro Devices, Inc.)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)
S2 ndassvc; C:\Program Files\NDAS\System\ndassvc.exe [331752 2010-01-13] (XIMETA, Inc.)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-12-25] ()
S2 SuRunSVC; C:\Windows\SuRun.exe [727552 2013-06-26] (hxxp://kay-bruns.de)

==================== Drivers (Whitelisted) ====================

S3 AODDriver; C:\Program Files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys [52280 2010-03-12] (Advanced Micro Devices)
S3 AODDriver; C:\Program Files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys [52280 2010-03-12] (Advanced Micro Devices)
S2 AODDriver4.01; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
S2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-03-12] ()
S2 cpuz135; C:\Windows\system32\drivers\cpuz135_x64.sys [21992 2010-11-09] (CPUID)
S3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2011-05-01] (DT Soft Ltd)
S3 etdrv; C:\Windows\etdrv.sys [25640 2012-08-10] (Windows (R) Server 2003 DDK provider)
S3 etdrv; C:\Windows\etdrv.sys [25640 2012-08-10] (Windows (R) Server 2003 DDK provider)
S3 gdrv; C:\Windows\gdrv.sys [25640 2013-06-29] (Windows (R) Server 2003 DDK provider)
S3 gdrv; C:\Windows\gdrv.sys [25640 2013-06-29] (Windows (R) Server 2003 DDK provider)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2013-06-29] ()
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2013-06-29] ()
S0 lfsfilt; C:\Windows\System32\DRIVERS\lfsfilt.sys [738792 2010-01-13] (XIMETA, Inc.)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-03-12] ()
S0 lpx; C:\Windows\System32\DRIVERS\lpx6x.sys [151528 2010-01-13] (XIMETA, Inc.)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)
S3 ndasbus; C:\Windows\System32\DRIVERS\ndasbus.sys [497640 2010-01-13] (XIMETA, Inc.)
S1 ndasfat; C:\Windows\System32\DRIVERS\ndasfat.sys [607720 2010-01-13] (Windows (R) Codename Longhorn DDK provider)
S0 ndasfs; C:\Windows\System32\DRIVERS\ndasfs.sys [746472 2010-01-13] (XIMETA, Inc.)
S1 ndasrofs; C:\Windows\System32\DRIVERS\ndasrofs.sys [1053160 2010-01-13] (XIMETA, Inc.)
S3 ndasscsi; C:\Windows\System32\DRIVERS\ndasscsi.sys [486888 2010-01-13] (XIMETA, Inc.)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)
S3 RTL8023x64; C:\Windows\System32\DRIVERS\Rtnic64.sys [51712 2009-06-10] (Realtek Semiconductor Corporation )
S3 SaiK1708; C:\Windows\System32\DRIVERS\SaiK1708.sys [180544 2012-09-20] (Saitek)
S3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [24680 2012-10-15] (Saitek)
S3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [52200 2012-10-15] (Saitek)
S3 SaiU1708; C:\Windows\System32\DRIVERS\SaiU1708.sys [47168 2012-09-20] (Saitek)
S3 trustms; C:\Windows\System32\drivers\trustms.sys [12416 2010-11-15] ()
S3 Tablet2k; "%SystemRoot%\System32\Drivers\Tablet2k.sys" [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-29 14:43 - 2013-06-29 14:43 - 02721168 ____A (Microsoft Corporation) C:\Users\Bernd\Desktop\Windows7-USB-DVD1024-tool.exe
2013-06-29 14:25 - 2013-06-29 14:25 - 00000000 ____D C:\FRST
2013-06-29 10:21 - 2013-06-29 10:23 - 01933572 ____A (Farbar) C:\Users\Bernd\Desktop\FRST64.exe
2013-06-29 10:21 - 2013-06-29 10:23 - 01372101 ____A (Farbar) C:\Users\Bernd\Desktop\FRST.exe
2013-06-29 09:57 - 2013-06-29 09:57 - 00163112 ____A C:\Users\Bernd\Desktop\Extras.Txt
2013-06-29 09:56 - 2013-06-29 09:56 - 00156748 ____A C:\Users\Bernd\Desktop\OTL.Txt
2013-06-29 09:41 - 2013-06-29 09:41 - 00602112 ____A (OldTimer Tools) C:\Users\Bernd\Desktop\OTL.exe
2013-06-29 09:40 - 2013-06-29 09:41 - 00602112 ____A (OldTimer Tools) C:\Users\Bernd\Downloads\OTL.exe
2013-06-28 21:02 - 2013-06-28 21:02 - 00351782 ____A C:\Users\Bernd\Documents\sophos.log
2013-06-28 13:07 - 2013-06-28 13:07 - 00000000 ____D C:\Users\Jytte\AppData\Local\Macromedia
2013-06-28 12:46 - 2013-06-28 12:46 - 00163064 ____A C:\Users\Jonas\AppData\Local\2433f433
2013-06-28 12:46 - 2013-06-28 12:46 - 00163057 ____A C:\Users\Jonas\AppData\Roaming\2433f433
2013-06-28 12:46 - 2013-06-28 12:46 - 00163004 ____A C:\ProgramData\2433f433
2013-06-27 20:30 - 2013-06-27 20:30 - 00055560 ___RA C:\Users\Jonas\Desktop\USAIPDEMO.pbk
2013-06-26 17:12 - 2013-06-26 17:12 - 00727552 ____A (hxxp://kay-bruns.de) C:\Windows\SuRun.exe
2013-06-26 17:12 - 2013-06-26 17:12 - 00674816 ____A (hxxp://kay-bruns.de) C:\Windows\SuRun32.bin
2013-06-26 17:12 - 2013-06-26 17:12 - 00189952 ____A (hxxp://kay-bruns.de) C:\Windows\SuRunExt.dll
2013-06-26 17:12 - 2013-06-26 17:12 - 00175104 ____A (hxxp://kay-bruns.de) C:\Windows\SuRunExt32.dll
2013-06-25 12:56 - 2013-06-25 12:56 - 06247175 ____A C:\Users\Jonas\Desktop\GameCam_V261_Setup.exe
2013-06-24 19:06 - 2013-06-24 19:06 - 00004096 ____A C:\Windows\d3dx.dat
2013-06-23 20:04 - 2013-06-23 20:04 - 00000615 ____A C:\Users\Jonas\Desktop\Autorun - Verknüpfung.lnk
2013-06-23 20:00 - 2013-06-23 20:00 - 00000631 ____A C:\Users\Jytte\Desktop\Gothic.lnk
2013-06-23 20:00 - 2013-06-23 20:00 - 00000631 ____A C:\Users\Jonas\Desktop\Gothic.lnk
2013-06-23 20:00 - 2013-06-23 20:00 - 00000631 ____A C:\Users\Bernd\Desktop\Gothic.lnk
2013-06-20 16:30 - 2013-06-20 16:31 - 00000000 ____D C:\Users\Jonas\AppData\Local\{391135D3-A2F1-4FFA-BEF8-AC1E26541FAD}
2013-06-16 02:00 - 2013-06-08 15:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-16 02:00 - 2013-06-08 15:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-16 02:00 - 2013-06-08 15:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-16 02:00 - 2013-06-08 15:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-16 02:00 - 2013-06-08 15:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-16 02:00 - 2013-06-08 13:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-16 02:00 - 2013-06-08 12:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-16 02:00 - 2013-06-08 12:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-16 02:00 - 2013-06-08 12:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-16 02:00 - 2013-06-08 12:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-16 02:00 - 2013-06-08 12:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-16 02:00 - 2013-06-08 12:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-14 20:07 - 2013-06-13 13:02 - 170631995 ____A C:\Users\Jonas\Desktop\langeweile.wmv
2013-06-13 12:59 - 2013-06-13 13:00 - 00000000 ____D C:\Users\Jonas\AppData\Local\{EE4CB6AE-ABD0-4EAA-B4DA-10B8E2263D87}
2013-06-13 02:00 - 2013-05-17 02:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 02:00 - 2013-05-17 02:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 02:00 - 2013-05-17 02:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 02:00 - 2013-05-17 02:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 02:00 - 2013-05-17 02:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 02:00 - 2013-05-17 02:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 02:00 - 2013-05-17 02:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 02:00 - 2013-05-17 02:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 02:00 - 2013-05-17 01:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 02:00 - 2013-05-17 01:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 02:00 - 2013-05-17 01:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 02:00 - 2013-05-17 01:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 02:00 - 2013-05-17 01:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 02:00 - 2013-05-17 01:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 02:00 - 2013-05-17 01:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 02:00 - 2013-05-17 01:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 02:00 - 2013-05-17 01:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 02:00 - 2013-05-14 13:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 02:00 - 2013-05-14 09:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 20:29 - 2013-05-08 07:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 20:27 - 2013-05-13 06:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 20:27 - 2013-05-13 06:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 20:27 - 2013-05-13 06:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 20:27 - 2013-05-13 06:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 20:27 - 2013-05-13 05:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 20:27 - 2013-05-13 05:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 20:27 - 2013-05-13 05:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 20:27 - 2013-05-13 04:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 20:27 - 2013-05-13 04:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 20:27 - 2013-05-13 04:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 20:27 - 2013-05-10 06:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 20:27 - 2013-05-10 04:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 20:27 - 2013-04-26 06:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 20:27 - 2013-04-26 05:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 20:27 - 2013-04-17 08:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 20:27 - 2013-04-17 07:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 20:26 - 2013-04-26 00:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 20:26 - 2013-03-31 23:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-02 13:34 - 2013-06-02 13:34 - 00275656 ____A C:\Windows\Minidump\060213-15428-01.dmp

==================== One Month Modified Files and Folders =======

2013-06-29 14:43 - 2013-06-29 14:43 - 02721168 ____A (Microsoft Corporation) C:\Users\Bernd\Desktop\Windows7-USB-DVD1024-tool.exe
2013-06-29 14:41 - 2012-08-08 12:40 - 00000004 ____A C:\Windows\SysWOW64\GVTunner.ref
2013-06-29 14:41 - 2012-08-08 09:47 - 00030528 ____A C:\Windows\GVTDrv64.sys
2013-06-29 14:40 - 2012-08-08 09:34 - 00025640 ____A (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2013-06-29 14:39 - 2009-07-14 06:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-29 14:39 - 2009-07-14 05:51 - 00092321 ____A C:\Windows\setupact.log
2013-06-29 14:25 - 2013-06-29 14:25 - 00000000 ____D C:\FRST
2013-06-29 13:54 - 2011-04-27 13:21 - 01746243 ____A C:\Windows\WindowsUpdate.log
2013-06-29 13:48 - 2009-07-14 18:58 - 00696848 ____A C:\Windows\System32\perfh007.dat
2013-06-29 13:48 - 2009-07-14 18:58 - 00148144 ____A C:\Windows\System32\perfc007.dat
2013-06-29 13:48 - 2009-07-14 06:13 - 01613412 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-29 13:41 - 2012-06-24 12:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-29 10:23 - 2013-06-29 10:21 - 01933572 ____A (Farbar) C:\Users\Bernd\Desktop\FRST64.exe
2013-06-29 10:23 - 2013-06-29 10:21 - 01372101 ____A (Farbar) C:\Users\Bernd\Desktop\FRST.exe
2013-06-29 10:18 - 2012-04-22 19:07 - 00001138 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4073321541-1563285234-612992118-1007UA.job
2013-06-29 10:11 - 2011-06-26 19:58 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4073321541-1563285234-612992118-1007UA.job
2013-06-29 10:09 - 2013-01-28 19:46 - 00000000 ____D C:\Users\Bernd\AppData\Local\PMB Files
2013-06-29 10:05 - 2011-04-28 07:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-29 10:04 - 2012-03-29 20:45 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 09:57 - 2013-06-29 09:57 - 00163112 ____A C:\Users\Bernd\Desktop\Extras.Txt
2013-06-29 09:56 - 2013-06-29 09:56 - 00156748 ____A C:\Users\Bernd\Desktop\OTL.Txt
2013-06-29 09:46 - 2009-07-14 05:45 - 00020816 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-29 09:46 - 2009-07-14 05:45 - 00020816 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-29 09:41 - 2013-06-29 09:41 - 00602112 ____A (OldTimer Tools) C:\Users\Bernd\Desktop\OTL.exe
2013-06-29 09:41 - 2013-06-29 09:40 - 00602112 ____A (OldTimer Tools) C:\Users\Bernd\Downloads\OTL.exe
2013-06-29 09:39 - 2012-07-17 10:06 - 00000000 ____D C:\Users\Bernd\AppData\Local\LogMeIn Hamachi
2013-06-29 09:01 - 2012-09-10 14:49 - 00000000 ____D C:\Users\Jytte\AppData\Local\LogMeIn Hamachi
2013-06-28 22:18 - 2012-04-22 19:07 - 00001116 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4073321541-1563285234-612992118-1007Core.job
2013-06-28 21:02 - 2013-06-28 21:02 - 00351782 ____A C:\Users\Bernd\Documents\sophos.log
2013-06-28 13:07 - 2013-06-28 13:07 - 00000000 ____D C:\Users\Jytte\AppData\Local\Macromedia
2013-06-28 13:06 - 2011-05-03 15:20 - 00109296 ____A C:\Users\Jytte\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-28 12:46 - 2013-06-28 12:46 - 00163064 ____A C:\Users\Jonas\AppData\Local\2433f433
2013-06-28 12:46 - 2013-06-28 12:46 - 00163057 ____A C:\Users\Jonas\AppData\Roaming\2433f433
2013-06-28 12:46 - 2013-06-28 12:46 - 00163004 ____A C:\ProgramData\2433f433
2013-06-28 12:35 - 2011-10-18 18:42 - 00000000 ____D C:\Users\Jonas\AppData\Roaming\Skype
2013-06-28 11:50 - 2012-12-24 13:57 - 00000000 ____D C:\Users\Jonas\Desktop\Bildschirmhintergründe
2013-06-28 01:38 - 2013-01-03 17:33 - 00000000 ____D C:\Users\Jonas\AppData\Roaming\TS3Client
2013-06-28 01:11 - 2011-06-26 19:58 - 00001068 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4073321541-1563285234-612992118-1007Core.job
2013-06-27 23:48 - 2013-02-02 00:32 - 00000000 ____D C:\Users\Jonas\AppData\Local\Activision
2013-06-27 20:30 - 2013-06-27 20:30 - 00055560 ___RA C:\Users\Jonas\Desktop\USAIPDEMO.pbk
2013-06-27 14:50 - 2013-03-05 19:17 - 00000000 ____D C:\Users\Jonas\AppData\Roaming\Dropbox
2013-06-27 14:49 - 2013-03-05 19:19 - 00000000 ___RD C:\Users\Jonas\Dropbox
2013-06-27 14:48 - 2012-10-20 03:17 - 00000000 ____D C:\Users\Jonas\AppData\Roaming\Spotify
2013-06-27 14:48 - 2012-07-11 17:56 - 00000000 ____D C:\Users\Jonas\AppData\Local\LogMeIn Hamachi
2013-06-26 17:12 - 2013-06-26 17:12 - 00727552 ____A (hxxp://kay-bruns.de) C:\Windows\SuRun.exe
2013-06-26 17:12 - 2013-06-26 17:12 - 00674816 ____A (hxxp://kay-bruns.de) C:\Windows\SuRun32.bin
2013-06-26 17:12 - 2013-06-26 17:12 - 00189952 ____A (hxxp://kay-bruns.de) C:\Windows\SuRunExt.dll
2013-06-26 17:12 - 2013-06-26 17:12 - 00175104 ____A (hxxp://kay-bruns.de) C:\Windows\SuRunExt32.dll
2013-06-25 12:56 - 2013-06-25 12:56 - 06247175 ____A C:\Users\Jonas\Desktop\GameCam_V261_Setup.exe
2013-06-24 22:15 - 2011-08-26 22:25 - 00000000 ____D C:\Users\Jonas\Desktop\Sai Bilder
2013-06-24 22:14 - 2013-04-20 11:03 - 00000000 ____D C:\Users\Jonas\Desktop\Niki
2013-06-24 19:06 - 2013-06-24 19:06 - 00004096 ____A C:\Windows\d3dx.dat
2013-06-23 20:04 - 2013-06-23 20:04 - 00000615 ____A C:\Users\Jonas\Desktop\Autorun - Verknüpfung.lnk
2013-06-23 20:00 - 2013-06-23 20:00 - 00000631 ____A C:\Users\Jytte\Desktop\Gothic.lnk
2013-06-23 20:00 - 2013-06-23 20:00 - 00000631 ____A C:\Users\Jonas\Desktop\Gothic.lnk
2013-06-23 20:00 - 2013-06-23 20:00 - 00000631 ____A C:\Users\Bernd\Desktop\Gothic.lnk
2013-06-23 19:50 - 2012-10-13 00:59 - 00000000 ____D C:\Users\Jonas\Desktop\Tabulaturen
2013-06-21 14:22 - 2011-04-28 12:41 - 00000000 ____D C:\Windows\Minidump
2013-06-20 17:45 - 2011-04-28 15:22 - 00000000 ____D C:\Users\Jonas\AppData\Roaming\XBMC
2013-06-20 16:31 - 2013-06-20 16:30 - 00000000 ____D C:\Users\Jonas\AppData\Local\{391135D3-A2F1-4FFA-BEF8-AC1E26541FAD}
2013-06-20 15:17 - 2011-04-30 16:05 - 00054272 ____A C:\Users\Jonas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-13 13:02 - 2013-06-14 20:07 - 170631995 ____A C:\Users\Jonas\Desktop\langeweile.wmv
2013-06-13 13:00 - 2013-06-13 12:59 - 00000000 ____D C:\Users\Jonas\AppData\Local\{EE4CB6AE-ABD0-4EAA-B4DA-10B8E2263D87}
2013-06-13 02:57 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-06-13 02:03 - 2011-04-29 13:04 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-13 02:01 - 2011-04-28 06:51 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 20:05 - 2013-05-14 21:05 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-12 20:05 - 2012-03-29 20:45 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 20:05 - 2011-05-31 17:00 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-08 15:08 - 2013-06-16 02:00 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 15:07 - 2013-06-16 02:00 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 15:06 - 2013-06-16 02:00 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 15:06 - 2013-06-16 02:00 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 15:06 - 2013-06-16 02:00 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:28 - 2013-06-16 02:00 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 12:42 - 2013-06-16 02:00 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 12:40 - 2013-06-16 02:00 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 12:40 - 2013-06-16 02:00 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 12:40 - 2013-06-16 02:00 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 12:40 - 2013-06-16 02:00 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 12:13 - 2013-06-16 02:00 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-02 13:34 - 2013-06-02 13:34 - 00275656 ____A C:\Windows\Minidump\060213-15428-01.dmp
2013-06-02 00:30 - 2011-07-07 21:11 - 00291088 ____A C:\Windows\SysWOW64\PnkBstrB.xtr
2013-06-02 00:30 - 2011-07-07 21:06 - 00291088 ____A C:\Windows\SysWOW64\PnkBstrB.exe
2013-06-01 23:53 - 2011-07-07 21:06 - 00291088 ____A C:\Windows\SysWOW64\PnkBstrB.ex0
2013-05-31 19:09 - 2012-07-28 17:20 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins

Files to move or delete:
====================
C:\ProgramData\hash.dat

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-06-29 09:46:40
Restore point made on: 2013-06-29 09:59:24
Restore point made on: 2013-06-29 10:02:10
Restore point made on: 2013-06-29 10:03:33
Restore point made on: 2013-06-29 14:44:15

==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 8188.52 MB
Available physical RAM: 7344.49 MB
Total Pagefile: 8186.67 MB
Available Pagefile: 7347.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:172.69 GB) (Free:28.99 GB) NTFS (Disk=0 Partition=2)
Drive d: (Volume) (Fixed) (Total:465.76 GB) (Free:375.02 GB) NTFS (Disk=2 Partition=1)
Drive e: (Volume) (Fixed) (Total:232.88 GB) (Free:116.9 GB) NTFS (Disk=1 Partition=1)
Drive g: (Volume) (Fixed) (Total:292.97 GB) (Free:17.84 GB) NTFS (Disk=0 Partition=3)
Drive h: (GRMCPRXFRER_DE_DVD) (CDROM) (Total:2.97 GB) (Free:0 GB) UDF
Drive i: () (Removable) (Total:7.48 GB) (Free:4.43 GB) NTFS (Disk=3 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 000D31B3)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=173 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=293 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 233 GB) (Disk ID: 8AA0E4DE)
Partition 1: (Not Active) - (Size=233 GB) - (Type=OF Extended)

========================================================
Disk: 2 (Size: 466 GB) (Disk ID: 0F4C0F4B)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 7 GB) (Disk ID: 0007DE0E)
Partition 1: (Active) - (Size=7 GB) - (Type=07 NTFS)


LastRegBack: 2013-06-25 12:19

==================== End Of Log ============================

Könnt ihr mir weiterhelfen?
Vielen Dank.
Gruß
berni199