Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
GVU Trojaner auf Windows 7 64Bit Sytem eingefangen

GVU Trojaner auf Windows 7 64Bit Sytem eingefangen


Log-Analyse und Auswertung: GVU Trojaner auf Windows 7 64Bit Sytem eingefangen

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 25.07.2013, 21:37   #11
bozza
 
GVU Trojaner auf Windows 7 64Bit Sytem eingefangen - Standard

GVU Trojaner auf Windows 7 64Bit Sytem eingefangen


Hi Leo, hi Trojaner-Board,

hat 'ne Weile gedauert, hier sind die entsprechenden Logs:

1) MBRMastr_...

Code:
ATTFilter
Detected Windows version: 6.1 Build 7601 Service Pack 1
Installing direct disk access driver ...
Driver connection handle: 0x00000114
1 valid drive(s) found.

Details for Disk 0 - FUJITSU MJA2500BH G2 Rev 8919:
  Device name              : \\.\PhysicalDrive0
  Geometry (C/H/S)         : 60801/255/63
  Boot loader reputation   : Unknown
  Cross view comparison    : Passed
  Partition table integrity: Passed

  Boot loader hashes
    SHA-1                  : 551A462D73A93F55DB9FAA0B7688E7B930C72630
    MD5                    : 97CBDD92FBE0D9700DF3731E4DD547C6
2) Malwarebytes
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.07.24.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
klaus :: KLAUS-PC [Administrator]

Schutz: Aktiviert

24.07.2013 21:10:10
mbam-log-2013-07-24 (21-10-10).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 216882
Laufzeit: 7 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
3. ESET

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=89f8ddb26a382149970cd656faaf38d4
# engine=14521
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-25 07:22:44
# local_time=2013-07-25 09:22:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 99 2187671 120550647 2192244 0
# compatibility_mode=5893 16776573 100 94 86555 126410014 0 0
# scanned=267550
# found=11
# cleaned=0
# scan_time=85279
sh=76CE169A125A0878B3FC84371B87046661BE17B5 ft=1 fh=11d6f4a18d56bc9f vn="a variant of Win32/Kryptik.BCKC trojan" ac=I fn="C:\FRST\Quarantine\lv4e.dat"
sh=DD68DD5811C6216C5755FFB05C1C843BE34D01BB ft=1 fh=68f0e5c70876de44 vn="a variant of Win32/Kryptik.BEWL trojan" ac=I fn="C:\FRST\Quarantine\skype.dat"
sh=D36DF650482ED124929B6B158AA818067383140F ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Users\klaus\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\94MMLNM5\win-theres_kills[1].htm"
sh=D6A9AF39F40EED8B51371A8AF5AD553EA48F4221 ft=0 fh=0000000000000000 vn="JS/Exploit.Pdfka.QHC trojan" ac=I fn="C:\Users\klaus\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9S1N138M\cnk[1].pdf"
sh=09A3F1CED0A7DE59F47FDB714C2DE144DFD10D2D ft=0 fh=0000000000000000 vn="JS/Exploit.Pdfka.PTI trojan" ac=I fn="C:\Users\klaus\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M9V7C2XS\40b07[1].pdf"
sh=A7611EDE99648FAC5C86E6D924B054C592E2C02D ft=0 fh=0000000000000000 vn="JS/Agent.NHS trojan" ac=I fn="C:\Users\klaus\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S32UBH1V\world_tie-promised_why[1].htm"
sh=9C67A04A4A54B115A3EBA59B7ABB150A72912562 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Users\klaus\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XDH3DPDH\counter[1].htm"
sh=AAD0A56987BD9954E7A7F726B7F84B5EA7D7D2CF ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Users\klaus\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XDH3DPDH\pornandwillowslice_net[1].htm"
sh=9EC1DF5770526508A83EB3ECBEA520A9194A5E77 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\klaus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\63ae8798-373bc882"
sh=BB61A3022F892EF3FA7DE50808B955D02F05445B ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\klaus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\10ef49e8-54570bc8"
sh=76CE169A125A0878B3FC84371B87046661BE17B5 ft=1 fh=11d6f4a18d56bc9f vn="a variant of Win32/Kryptik.BCKC trojan" ac=I fn="C:\Users\klaus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\53c82aeb-1e09e3f1"
4. FRST


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-07-2013 01
Ran by klaus (administrator) on 25-07-2013 21:46:32
Running from C:\Users\klaus\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe
(Hewlett-Packard) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
() C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
() C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe
(TomTom) C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files (x86)\Remote Mouse\server\server.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(CyberLink Corp.) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(CyberLink Corp.) c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe
(CyberLink) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-15] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [450048 2009-07-22] (IDT, Inc.)
HKLM\...\Run: [SmartMenu] - C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [610872 2009-07-21] ()
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [171520 2009-08-26] (Sun Microsystems, Inc.)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1668664 2009-07-15] (Hewlett-Packard)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-12-12] (Google Inc.)
HKCU\...\Run: [Remote Mouse] - C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe [872448 2011-12-07] ()
HKCU\...\Run: [MyTomTomSA.exe] - C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe [436728 2012-09-10] (TomTom)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-03-22] (TomTom)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil64_11_7_700_224_ActiveX.exe -update activex [514952 2013-06-13] (Adobe Systems Incorporated)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-07-02] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPCam_Menu] - "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam" [218408 2009-02-25] (CyberLink Corp.)
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [323640 2010-02-25] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [UpdatePRCShortCut] - "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35760 2011-01-31] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-06-22] (EasyBits Software AS)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [932288 2010-09-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-02] (Apple Inc.)
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [500792 2010-03-23] (Hewlett-Packard Company)
HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253672 2011-01-07] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-09-09] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKU\Default\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard)
HKU\Default\...\Policies\system: [WallpaperStyle] 2
HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard)
HKU\Default User\...\Policies\system: [WallpaperStyle] 2

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gmx.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {1C15C370-2F1C-403D-879E-20D890E30C9D} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM - {303F3FE1-068E-4238-B5A5-DC9445C7FD67} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM - {A7253891-81B5-42DE-A688-B522DF631322} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {1C15C370-2F1C-403D-879E-20D890E30C9D} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM-x32 - {303F3FE1-068E-4238-B5A5-DC9445C7FD67} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM-x32 - {A7253891-81B5-42DE-A688-B522DF631322} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - {1C15C370-2F1C-403D-879E-20D890E30C9D} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKCU - {303F3FE1-068E-4238-B5A5-DC9445C7FD67} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKCU - {A7253891-81B5-42DE-A688-B522DF631322} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: No Name - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a}  -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52272 2009-08-26] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.250.6) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U25) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File

==================== Services (Whitelisted) =================

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-08] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-08] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-01-21] ()
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe [240128 2009-07-22] (IDT, Inc.)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-08] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-08] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-09-16] (Avira GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-04-16] (Research In Motion Limited)
U4 eabfiltr; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-24 21:23 - 2013-07-24 21:23 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-24 20:57 - 2013-07-24 20:57 - 00000000 ____D C:\Users\klaus\AppData\Roaming\Malwarebytes
2013-07-24 20:56 - 2013-07-24 20:56 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-24 20:56 - 2013-07-24 20:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-24 20:56 - 2013-07-24 20:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-24 20:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-24 01:35 - 2013-07-24 01:35 - 00019118 _____ C:\ComboFix.txt
2013-07-24 01:14 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-07-24 01:14 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-07-24 01:14 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-07-24 01:14 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-07-24 01:14 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-07-24 01:14 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-07-24 01:14 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-07-24 01:14 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-07-24 01:13 - 2013-07-24 01:35 - 00000000 ____D C:\Qoobox
2013-07-24 01:13 - 2013-07-24 01:33 - 00000000 ____D C:\Windows\erdnt
2013-07-24 01:12 - 2013-07-24 00:40 - 05092552 ____R (Swearware) C:\Users\klaus\Desktop\ComboFix.exe
2013-07-23 23:00 - 2013-07-23 23:01 - 00018878 _____ C:\Users\klaus\Desktop\Addition.txt
2013-07-23 22:57 - 2013-07-23 00:07 - 01779447 _____ (Farbar) C:\Users\klaus\Desktop\FRST64.exe
2013-07-23 22:07 - 2013-07-23 22:07 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-07-23 22:02 - 2013-07-23 22:18 - 00011098 _____ C:\Windows\IE10_main.log
2013-07-23 10:15 - 2013-07-23 10:15 - 00000000 ____D C:\FRST
2013-07-23 01:04 - 2013-07-23 01:04 - 00000000 ____D C:\5c8e7b112c665af70429c6e2cf

==================== One Month Modified Files and Folders =======

2013-07-25 21:46 - 2010-04-18 10:07 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4AC032B7-827C-46D2-A436-2ACA09287214}
2013-07-25 21:46 - 2009-07-14 06:51 - 00991311 _____ C:\Windows\setupact.log
2013-07-25 21:42 - 2012-09-20 23:58 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-25 21:29 - 2012-09-20 23:59 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-25 21:29 - 2012-09-20 23:59 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-25 20:59 - 2009-09-30 01:28 - 01721375 _____ C:\Windows\WindowsUpdate.log
2013-07-24 21:33 - 2012-09-20 23:59 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-24 21:24 - 2012-09-20 23:59 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-24 21:24 - 2012-09-20 23:59 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-24 21:23 - 2013-07-24 21:23 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-24 21:06 - 2009-07-14 06:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-24 21:06 - 2009-07-14 06:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-24 20:57 - 2013-07-24 20:57 - 00000000 ____D C:\Users\klaus\AppData\Roaming\Malwarebytes
2013-07-24 20:56 - 2013-07-24 20:56 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-24 20:56 - 2013-07-24 20:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-24 20:56 - 2013-07-24 20:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-24 20:54 - 2009-08-26 21:46 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-07-24 20:54 - 2009-08-26 21:46 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-07-24 20:54 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-24 20:06 - 2009-09-30 01:51 - 00228672 _____ C:\Windows\PFRO.log
2013-07-24 20:06 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-24 01:35 - 2013-07-24 01:35 - 00019118 _____ C:\ComboFix.txt
2013-07-24 01:35 - 2013-07-24 01:13 - 00000000 ____D C:\Qoobox
2013-07-24 01:35 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-24 01:33 - 2013-07-24 01:13 - 00000000 ____D C:\Windows\erdnt
2013-07-24 01:32 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-07-24 01:26 - 2009-12-10 21:52 - 00000000 ____D C:\Users\klaus
2013-07-24 00:40 - 2013-07-24 01:12 - 05092552 ____R (Swearware) C:\Users\klaus\Desktop\ComboFix.exe
2013-07-23 23:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-07-23 23:01 - 2013-07-23 23:00 - 00018878 _____ C:\Users\klaus\Desktop\Addition.txt
2013-07-23 22:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-07-23 22:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-07-23 22:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\zh-HK
2013-07-23 22:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\tr-TR
2013-07-23 22:40 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-07-23 22:18 - 2013-07-23 22:02 - 00011098 _____ C:\Windows\IE10_main.log
2013-07-23 22:07 - 2013-07-23 22:07 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-07-23 22:07 - 2013-07-23 22:07 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-07-23 10:15 - 2013-07-23 10:15 - 00000000 ____D C:\FRST
2013-07-23 01:04 - 2013-07-23 01:04 - 00000000 ____D C:\5c8e7b112c665af70429c6e2cf
2013-07-23 00:07 - 2013-07-23 22:57 - 01779447 _____ (Farbar) C:\Users\klaus\Desktop\FRST64.exe
2013-07-22 03:24 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration

ZeroAccess:
C:\Users\klaus\AppData\Local\{ade2952b-2416-bc8d-8427-85532ef19a98}
C:\Users\klaus\AppData\Local\{ade2952b-2416-bc8d-8427-85532ef19a98}\@
C:\Users\klaus\AppData\Local\{ade2952b-2416-bc8d-8427-85532ef19a98}\L
C:\Users\klaus\AppData\Local\{ade2952b-2416-bc8d-8427-85532ef19a98}\U

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-23 23:34

==================== End Of Log ============================
--- --- ---


EMSI.ZIP im Anhang

Danke schon mal fürs Prüfen

LG,
Bozza

 

Themen zu GVU Trojaner auf Windows 7 64Bit Sytem eingefangen
.dll, adobe, adobe flash player, antivir, association, autorun, avg, avira, desktop, explorer, farbar, farbar recovery scan tool, flash player, frst.txt, google, home, launch, log, neu, opera, registry, scan, services.exe, software, svchost.exe, system, trojaner, windows, windows xp, winlogon.exe


« GVU W7HP Log-Files | Nach Trojaner-Entfernung hängt PC beim Start bei cmd.exe »


Ähnliche Themen: GVU Trojaner auf Windows 7 64Bit Sytem eingefangen


  1. Windows 7 64bit: SmartSaver 15 eingefangen. Logs bereits erstellt.
    Log-Analyse und Auswertung - 01.11.2014 (13)
  2. Windows 7, 64bit - Virus eingefangen; Seiten-interne Links sind grün und doppelt unterstrichen; Pop-ups gehen auf, etc.
    Plagegeister aller Art und deren Bekämpfung - 17.12.2013 (9)
  3. GVU Trojaner Windows 7 64bit
    Log-Analyse und Auswertung - 03.06.2013 (13)
  4. [Win7 Home 64bit] GVU Trojaner eingefangen und entfernt?
    Plagegeister aller Art und deren Bekämpfung - 12.05.2013 (27)
  5. !Hilfe! hab mir Trojaner Polizei Österreich eingefangen!Win7 64bit
    Plagegeister aller Art und deren Bekämpfung - 28.09.2012 (2)
  6. BKA-Trojaner V. 1.15 - Windows 7 64bit
    Log-Analyse und Auswertung - 25.09.2012 (10)
  7. GVU 2.07 Trojaner, Windows 7, 64bit
    Log-Analyse und Auswertung - 17.09.2012 (4)
  8. GVU-Trojaner 2.07 / Windows 7 64bit
    Log-Analyse und Auswertung - 06.09.2012 (13)
  9. Windows 7 (64bit): BKA-Trojaner v. 2.07
    Plagegeister aller Art und deren Bekämpfung - 07.08.2012 (16)
  10. Win7 64bit GVU-Trojaner 2.07 eingefangen
    Log-Analyse und Auswertung - 31.07.2012 (18)
  11. GVU Trojaner eingefangen unter Win7 64bit
    Log-Analyse und Auswertung - 23.07.2012 (19)
  12. Windows 7 (64bit) Virus/Trojaner (evtl. Windows Verschlüsselungs Trojaner)
    Plagegeister aller Art und deren Bekämpfung - 07.05.2012 (19)
  13. Fehlermeldungen, dann Sytem-Check Fake angeblich von Windows, alle Daten weg!
    Plagegeister aller Art und deren Bekämpfung - 22.03.2012 (3)
  14. Windows Sytem Blockiert (50€ Virus)/Bundestrojaner LÖSUNG
    Plagegeister aller Art und deren Bekämpfung - 06.03.2012 (1)
  15. System Fix eingefangen, Windows 7, 64bit
    Plagegeister aller Art und deren Bekämpfung - 24.11.2011 (31)
  16. Trojaner Sytem Repair
    Log-Analyse und Auswertung - 01.08.2011 (2)
  17. Trojan Drop und andere Trojaner im Sytem
    Log-Analyse und Auswertung - 11.12.2005 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema GVU Trojaner auf Windows 7 64Bit Sytem eingefangen - Hi Leo, hi Trojaner-Board, hat 'ne Weile gedauert, hier sind die entsprechenden Logs: 1) MBRMastr_... Code: Alles auswählen Aufklappen ATTFilter Detected Windows version: 6.1 Build 7601 Service Pack 1 Installing - GVU Trojaner auf Windows 7 64Bit Sytem eingefangen...
Archiv
Du betrachtest: GVU Trojaner auf Windows 7 64Bit Sytem eingefangen auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19