GVU-Trojaner am Hals, Farbar Recovery erledigt - Logfile auswerten?

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-07-2013
Ran by SYSTEM on 14-07-2013 17:32:54
Running from E:\rescue
Windows 8 Release Preview (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AdobeAAMUpdater-1.0] - "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [x]
HKLM-x32\...\Run: [VolPanel] - "C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe" /r [241789 2010-02-18] (Creative Technology Ltd)
HKLM-x32\...\Run: [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4282728 2012-08-21] (AVAST Software)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073352 2012-06-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [36760 2011-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2904984 2011-09-05] (Adobe Systems Inc.)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-08-27] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-09-09] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [642216 2012-10-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [CTxfiHlp] - CTXFIHLP.EXE [25600 2011-08-22] (Creative Technology Ltd)
HKU\tre\...\Run: [AdobeBridge] -  [x]
HKU\tre\...\Run: [Steam] - "E:\Steam\steam.exe" -silent [x]
HKU\tre\...\Run: [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [3671904 2012-08-28] (DT Soft Ltd)
HKU\tre\...\Run: [Unified Remote v2] - C:\Program Files (x86)\Unified Remote\RemoteServer.exe [279136 2012-11-24] (Unified Intents AB)
HKU\tre\...\Run: [TpScrex] - C:\ProgramData\TpScrex\TpScrex.exe /somering [11776 2012-10-24] ()
HKU\tre\...\Run: [F.lux] - "C:\Users\tre\Local Settings\Apps\F.lux\flux.exe" /noshow [966656 2009-08-29] ()
HKU\tre\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\tre\AppData\Local\Temp\ocxbjpjvlabxapmom.exe [52224 2013-07-14] (NVIDIA Corporation) <===== ATTENTION
HKU\tre\...\Winlogon: [Shell] cmd.exe [408064 2012-05-19] (Microsoft Corporation) <==== ATTENTION 
HKU\tre\...\Command Processor: "C:\Users\tre\AppData\Local\Temp\ocxbjpjvlabxapmom.exe" <===== ATTENTION!
Startup: C:\ProgramData\Start Menu\Programs\Startup\NETGEAR WG111v2 Smart Wizard.lnk
ShortcutTarget: NETGEAR WG111v2 Smart Wizard.lnk -> C:\Program Files (x86)\NETGEAR\WG111v2\WG111v2.exe ()
Startup: C:\Users\tre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\tre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\tre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)

==================== Services (Whitelisted) =================

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [44808 2012-08-21] (AVAST Software)
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-11-27] ()
S2 SCM_Service; C:\Windows\SysWOW64\WinService.exe [186848 2010-05-10] ()
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14888 2012-05-19] (Microsoft Corporation)
S2 HiPatchService; E:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [x]

==================== Drivers (Whitelisted) ====================

S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [25232 2012-08-21] (AVAST Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [71600 2012-08-21] (AVAST Software)
S1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [54072 2012-08-21] (AVAST Software)
S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [969200 2012-08-21] (AVAST Software)
S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [359464 2012-08-21] (AVAST Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [59728 2012-08-21] (AVAST Software)
S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)
S3 bthav; C:\Windows\system32\drivers\bthav.sys [40448 2008-07-10] (CSR, plc)
S1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2012-09-19] (DT Soft Ltd)
S3 MTsensor; C:\Windows\system32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 RTL8187; C:\Windows\system32\DRIVERS\wg111v2.sys [340992 2007-12-26] (NETGEAR Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-14 17:32 - 2013-07-14 17:32 - 00000000 ____D C:\FRST
2013-07-14 04:28 - 2013-07-14 17:30 - 00000000 _____ C:\Recovery.txt
2013-07-14 03:18 - 2013-07-14 03:18 - 300100663 _____ C:\Windows\MEMORY.DMP
2013-07-14 03:18 - 2013-07-14 03:18 - 00262144 _____ C:\Windows\Minidump\071413-8798-01.dmp
2013-07-14 03:06 - 2013-07-14 03:06 - 00003536 ____N C:\bootsqm.dat
2013-07-14 03:00 - 2013-07-14 03:00 - 00163024 _____ C:\Users\tre\AppData\Local\2433f433
2013-07-14 03:00 - 2013-07-14 03:00 - 00163018 _____ C:\Users\tre\AppData\Roaming\2433f433
2013-07-14 03:00 - 2013-07-14 03:00 - 00162976 _____ C:\ProgramData\2433f433
2013-07-14 02:24 - 2013-07-14 02:24 - 00000117 _____ C:\Windows\System32\netcfg-57090687.txt
2013-07-14 02:24 - 2013-07-14 02:24 - 00000117 _____ C:\Windows\System32\netcfg-57089954.txt
2013-07-13 01:04 - 2013-07-13 01:04 - 00000117 _____ C:\Windows\System32\netcfg-34216806.txt
2013-07-13 01:04 - 2013-07-13 01:04 - 00000117 _____ C:\Windows\System32\netcfg-34215621.txt
2013-07-12 01:14 - 2013-07-12 01:14 - 00000117 _____ C:\Windows\System32\netcfg-32645783.txt
2013-07-12 01:14 - 2013-07-12 01:14 - 00000117 _____ C:\Windows\System32\netcfg-32644691.txt
2013-07-11 15:50 - 2013-07-11 15:50 - 00000985 _____ C:\Users\Public\Desktop\Last.fm Scrobbler.lnk
2013-07-10 23:35 - 2013-07-10 23:35 - 00000091 _____ C:\Users\tre\AppData\Roaming\mbam.context.scan
2013-07-10 23:02 - 2013-07-10 23:02 - 00000117 _____ C:\Windows\System32\netcfg-3708689.txt
2013-07-10 23:02 - 2013-07-10 23:02 - 00000117 _____ C:\Windows\System32\netcfg-3702137.txt
2013-07-10 20:09 - 2013-07-10 20:09 - 00000117 _____ C:\Windows\System32\netcfg-522993.txt
2013-07-10 20:09 - 2013-07-10 20:09 - 00000117 _____ C:\Windows\System32\netcfg-519920.txt
2013-07-10 20:08 - 2013-07-10 20:08 - 00000117 _____ C:\Windows\System32\netcfg-487955.txt
2013-07-10 20:07 - 2013-07-10 20:07 - 00001107 _____ C:\Windows\System32\netcfg-430079.txt
2013-07-10 20:07 - 2013-07-10 20:07 - 00000168 _____ C:\Windows\System32\netcfg-434088.txt
2013-07-10 20:05 - 2013-07-10 20:05 - 00001114 _____ C:\Windows\System32\netcfg-308445.txt
2013-07-10 20:05 - 2013-07-10 20:05 - 00000137 _____ C:\Windows\SysWOW64\WinService.log
2013-07-10 20:05 - 2013-07-10 20:05 - 00000000 ____D C:\Users\tre\AppData\Roaming\InstallShield
2013-07-10 20:05 - 2013-07-10 20:05 - 00000000 ____D C:\Program Files (x86)\NETGEAR
2013-07-10 20:05 - 2010-05-10 11:14 - 00186848 _____ C:\Windows\SysWOW64\WinService.exe
2013-07-10 20:05 - 2007-12-26 09:46 - 00340992 _____ (NETGEAR Inc.) C:\Windows\System32\Drivers\wg111v2.sys
2013-07-10 20:05 - 2007-07-17 14:15 - 00290816 _____ (SerComm Corporation) C:\Windows\SysWOW64\SCMLib.dll
2013-07-10 20:05 - 2007-01-19 02:24 - 00025312 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\System32\Drivers\SCMNdisP.sys
2013-07-10 20:04 - 2011-12-02 00:20 - 06502693 _____ C:\Users\tre\Desktop\WG111v2_v4.0.0.zip

==================== One Month Modified Files and Folders =======

2013-07-14 17:32 - 2013-07-14 17:32 - 00000000 ____D C:\FRST
2013-07-14 17:30 - 2013-07-14 04:28 - 00000000 _____ C:\Recovery.txt
2013-07-14 16:28 - 2012-12-16 01:31 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-14 16:28 - 2012-05-19 09:43 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-14 04:29 - 2012-12-08 04:23 - 00000000 ____D C:\Program Files (x86)\Last.fm
2013-07-14 04:29 - 2012-09-24 13:07 - 00000000 ____D C:\Program Files (x86)\uTorrent
2013-07-14 04:29 - 2012-09-24 13:06 - 00000000 ____D C:\Users\tre\AppData\Roaming\uTorrent
2013-07-14 04:29 - 2012-09-21 13:54 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-14 04:29 - 2012-09-18 12:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-07-14 04:29 - 2012-09-17 17:52 - 00000000 ____D C:\Users\tre\AppData\Roaming\vlc
2013-07-14 04:29 - 2012-09-17 14:55 - 00000000 ____D C:\Windows\Minidump
2013-07-14 04:29 - 2012-09-17 14:34 - 00000000 ____D C:\Program Files (x86)\Opera
2013-07-14 04:29 - 2012-05-19 10:33 - 00000000 ____D C:\Windows\System32\sru
2013-07-14 04:29 - 2012-05-19 10:33 - 00000000 ____D C:\Windows\System32\spp
2013-07-14 04:22 - 2012-11-24 15:57 - 00000000 ____D C:\Users\tre\AppData\Roaming\IrfanView
2013-07-14 04:04 - 2012-09-17 14:26 - 00000000 __SHD C:\Recovery
2013-07-14 03:18 - 2013-07-14 03:18 - 300100663 _____ C:\Windows\MEMORY.DMP
2013-07-14 03:18 - 2013-07-14 03:18 - 00262144 _____ C:\Windows\Minidump\071413-8798-01.dmp
2013-07-14 03:11 - 2012-12-16 01:31 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-14 03:06 - 2013-07-14 03:06 - 00003536 ____N C:\bootsqm.dat
2013-07-14 03:00 - 2013-07-14 03:00 - 00163024 _____ C:\Users\tre\AppData\Local\2433f433
2013-07-14 03:00 - 2013-07-14 03:00 - 00163018 _____ C:\Users\tre\AppData\Roaming\2433f433
2013-07-14 03:00 - 2013-07-14 03:00 - 00162976 _____ C:\ProgramData\2433f433
2013-07-14 02:40 - 2012-09-17 15:20 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1935327651-1984232927-2885287207-1001
2013-07-14 02:40 - 2012-05-19 13:32 - 00749776 _____ C:\Windows\System32\perfh007.dat
2013-07-14 02:40 - 2012-05-19 13:32 - 00155292 _____ C:\Windows\System32\perfc007.dat
2013-07-14 02:40 - 2012-05-19 09:49 - 01745420 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-14 02:35 - 2012-09-17 22:20 - 00000000 ____D C:\Users\tre\AppData\Roaming\Dropbox
2013-07-14 02:27 - 2012-09-17 14:47 - 00000000 ____D C:\Users\tre\AppData\Local\Adobe
2013-07-14 02:24 - 2013-07-14 02:24 - 00000117 _____ C:\Windows\System32\netcfg-57090687.txt
2013-07-14 02:24 - 2013-07-14 02:24 - 00000117 _____ C:\Windows\System32\netcfg-57089954.txt
2013-07-14 02:24 - 2012-09-17 14:27 - 01448041 _____ C:\Windows\WindowsUpdate.log
2013-07-13 12:22 - 2012-09-17 15:27 - 00000000 ____D C:\Users\tre\AppData\Roaming\foobar2000
2013-07-13 11:10 - 2012-12-08 04:23 - 00000000 ____D C:\Users\tre\AppData\Local\Last.fm
2013-07-13 01:06 - 2012-12-16 01:31 - 00004098 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 01:06 - 2012-12-16 01:31 - 00003862 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 01:04 - 2013-07-13 01:04 - 00000117 _____ C:\Windows\System32\netcfg-34216806.txt
2013-07-13 01:04 - 2013-07-13 01:04 - 00000117 _____ C:\Windows\System32\netcfg-34215621.txt
2013-07-12 01:14 - 2013-07-12 01:14 - 00000117 _____ C:\Windows\System32\netcfg-32645783.txt
2013-07-12 01:14 - 2013-07-12 01:14 - 00000117 _____ C:\Windows\System32\netcfg-32644691.txt
2013-07-11 15:50 - 2013-07-11 15:50 - 00000985 _____ C:\Users\Public\Desktop\Last.fm Scrobbler.lnk
2013-07-10 23:35 - 2013-07-10 23:35 - 00000091 _____ C:\Users\tre\AppData\Roaming\mbam.context.scan
2013-07-10 23:35 - 2012-09-17 20:29 - 00000000 ____D C:\Users\tre\Desktop\1325-1483-1138-6642-6471-6251
2013-07-10 23:02 - 2013-07-10 23:02 - 00000117 _____ C:\Windows\System32\netcfg-3708689.txt
2013-07-10 23:02 - 2013-07-10 23:02 - 00000117 _____ C:\Windows\System32\netcfg-3702137.txt
2013-07-10 20:09 - 2013-07-10 20:09 - 00000117 _____ C:\Windows\System32\netcfg-522993.txt
2013-07-10 20:09 - 2013-07-10 20:09 - 00000117 _____ C:\Windows\System32\netcfg-519920.txt
2013-07-10 20:08 - 2013-07-10 20:08 - 00000117 _____ C:\Windows\System32\netcfg-487955.txt
2013-07-10 20:07 - 2013-07-10 20:07 - 00001107 _____ C:\Windows\System32\netcfg-430079.txt
2013-07-10 20:07 - 2013-07-10 20:07 - 00000168 _____ C:\Windows\System32\netcfg-434088.txt
2013-07-10 20:05 - 2013-07-10 20:05 - 00001114 _____ C:\Windows\System32\netcfg-308445.txt
2013-07-10 20:05 - 2013-07-10 20:05 - 00000137 _____ C:\Windows\SysWOW64\WinService.log
2013-07-10 20:05 - 2013-07-10 20:05 - 00000000 ____D C:\Users\tre\AppData\Roaming\InstallShield
2013-07-10 20:05 - 2013-07-10 20:05 - 00000000 ____D C:\Program Files (x86)\NETGEAR
2013-07-10 20:05 - 2012-09-17 14:30 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-10 20:00 - 2012-05-19 07:43 - 00262144 ___SH C:\Windows\System32\config\BBI
2013-07-10 19:35 - 2012-10-24 13:48 - 00000000 _____ C:\Windows\System32\Drivers\lvuvc.hs

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-01-12 17:08:15
Restore point made on: 2013-07-10 18:03:33

==================== Memory info =========================== 

Percentage of memory in use: 10%
Total physical RAM: 8190.05 MB
Available physical RAM: 7341.73 MB
Total Pagefile: 8191.05 MB
Available Pagefile: 7386.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:119.24 GB) (Free:22.03 GB) NTFS (Disk=0 Partition=1)
Drive d: (Lokaler Datenträger) (Fixed) (Total:1863.01 GB) (Free:398.49 GB) NTFS (Disk=1 Partition=1) ==>[System with boot components (obtained from reading drive)]
Drive e: () (Removable) (Total:0.48 GB) (Free:0.48 GB) FAT (Disk=2 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119 GB) (Disk ID: D4C1E005)
Partition 1: (Not Active) - (Size=119 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: F367ACE0)
Partition 1: (Active) - (Size=-198626508800) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 491 MB) (Disk ID: 0D0C0B0A)
Partition 1: (Active) - (Size=491 MB) - (Type=06)


LastRegBack: 2013-07-13 08:29

==================== End Of Log ============================