GVU Trojaner auf meinem Windows 7 64 Bit System

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03
Ran by SYSTEM on 01-08-2013 10:45:21
Running from H:\
Windows 7 Professional (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8116256 2009-09-22] (Realtek Semiconductor)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1281512 2013-01-27] (Microsoft Corporation)
HKLM-x32\...\Run: [] -  [x]
HKU\Ronald\...\Run: [TrueCrypt] - C:\Program Files (x86)\TrueCrypt\TrueCrypt.exe [1415632 2009-12-21] (TrueCrypt Foundation)
HKU\Ronald\...\Run: [] -  [x]
HKU\Ronald\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKU\Ronald\...\Winlogon: [Shell] explorer.exe,C:\Users\Ronald\AppData\Roaming\cache.dat [61952 2011-11-17] () <==== ATTENTION 
AppInit_DLLs: acaptuser64.dll [119160 2008-06-11] (Adobe Systems, Inc.)
AppInit_DLLs-x32: acaptuser32.dll [111992 2008-06-11] (Adobe Systems, Inc.)

==================== Services (Whitelisted) =================

S2 DES2 Service; C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [68136 2009-06-17] ()
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)
S3 ANIWZCSdService; C:\Program Files (x86)\ANI\ANIWZCS2 Service\ANIWZCSdS.exe [x]
S2 HitmanPro37CrusaderBoot; "F:\Users\Ronald\Downloads\HitmanPro_x64.exe" /crusader:boot [x]

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-12-25] ()
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
S3 etdrv; C:\Windows\etdrv.sys [25640 2009-12-22] (Windows (R) Server 2003 DDK provider)
S3 etdrv; C:\Windows\etdrv.sys [25640 2009-12-22] (Windows (R) Server 2003 DDK provider)
S3 gdrv; C:\Windows\gdrv.sys [25640 2013-08-01] (Windows (R) Server 2003 DDK provider)
S3 gdrv; C:\Windows\gdrv.sys [25640 2013-08-01] (Windows (R) Server 2003 DDK provider)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2009-12-28] ()
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2009-12-28] ()
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-12-25] ()
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)
S3 rt2870; C:\Windows\System32\DRIVERS\rt2870.sys [941056 2009-04-15] (Ralink Technology, Corp.)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2009-12-21] (Duplex Secure Ltd.)
S1 truecrypt; C:\Windows\SysWow64\drivers\truecrypt.sys [222160 2009-12-21] (TrueCrypt Foundation)
S1 truecrypt; C:\Windows\SysWow64\drivers\truecrypt.sys [222160 2009-12-21] (TrueCrypt Foundation)
S3 AODDriver; \??\C:\Program Files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys [x]
S3 cpuz130; \??\C:\Users\Anwender\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]
S3 EverestDriver; \??\C:\inst\EverestUltimate5301900\EverestUltimate\kerneld.amd64 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-01 10:45 - 2013-08-01 10:45 - 00000000 ____D C:\FRST
2013-07-30 14:47 - 2013-07-30 23:51 - 00000004 _____ C:\Users\Ronald\AppData\Roaming\cache.ini
2013-07-27 12:09 - 2013-07-27 12:09 - 00000000 ____D C:\Users\Ronald\Desktop\Schneemann
2013-07-27 12:09 - 2013-07-27 12:09 - 00000000 ____D C:\Users\Ronald\Desktop\Der Erlöser

==================== One Month Modified Files and Folders =======

2013-08-01 09:24 - 2009-12-22 21:07 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2013-08-01 09:24 - 2009-12-21 14:15 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-01 09:24 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-01 09:24 - 2009-07-14 05:51 - 00186228 _____ C:\Windows\setupact.log
2013-07-30 23:51 - 2013-07-30 14:47 - 00000004 _____ C:\Users\Ronald\AppData\Roaming\cache.ini
2013-07-30 20:36 - 2009-12-21 19:27 - 01380564 _____ C:\Windows\WindowsUpdate.log
2013-07-30 20:31 - 2009-07-14 05:45 - 00020304 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-30 20:31 - 2009-07-14 05:45 - 00020304 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-30 20:30 - 2009-07-14 18:58 - 00653402 _____ C:\Windows\System32\perfh007.dat
2013-07-30 20:30 - 2009-07-14 18:58 - 00130022 _____ C:\Windows\System32\perfc007.dat
2013-07-30 20:30 - 2009-07-14 06:13 - 01497992 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-30 18:21 - 2013-01-28 15:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-30 14:13 - 2009-12-27 18:34 - 00000000 ____D C:\Program Files (x86)\Runes of Magic
2013-07-29 10:36 - 2012-08-06 17:22 - 00000000 ____D C:\Users\Ronald\Desktop\EKST
2013-07-27 12:10 - 2011-06-26 18:36 - 00525824 ___SH C:\Users\Ronald\Desktop\Thumbs.db
2013-07-27 12:09 - 2013-07-27 12:09 - 00000000 ____D C:\Users\Ronald\Desktop\Schneemann
2013-07-27 12:09 - 2013-07-27 12:09 - 00000000 ____D C:\Users\Ronald\Desktop\Der Erlöser
2013-07-27 12:09 - 2013-06-26 17:41 - 00000000 ____D C:\Users\Ronald\Desktop\__MACOSX
2013-07-26 09:43 - 2009-12-21 14:24 - 00006162 _____ C:\Windows\PFRO.log
2013-07-26 08:42 - 2011-10-24 09:15 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-07-26 08:39 - 2012-08-06 15:33 - 00000000 ____D C:\Users\Ronald\AppData\Local\.elfohilfe
2013-07-26 08:37 - 2009-12-21 23:58 - 00000000 ____D C:\users\Ronald
2013-07-22 11:51 - 2009-12-23 14:19 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-22 11:51 - 2009-12-21 15:45 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe

ZeroAccess:
C:\Users\Ronald\AppData\Local\{91d0d802-296e-41a5-217e-c568205d9c42}

Files to move or delete:
====================
C:\Users\Ronald\AppData\Roaming\skype.ini
C:\Users\Ronald\AppData\Roaming\cache.dat
C:\Users\Ronald\AppData\Roaming\cache.ini

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================


==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 4091.48 MB
Available physical RAM: 3468.36 MB
Total Pagefile: 4089.63 MB
Available Pagefile: 3459.47 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (Windows 7) (Fixed) (Total:195.21 GB) (Free:117.24 GB) NTFS (Disk=0 Partition=2)
Drive g: (Anno 1404 Add-On) (CDROM) (Total:0.77 GB) (Free:0 GB) CDFS
Drive h: (USB 1 GB) (Removable) (Total:0.93 GB) (Free:0.66 GB) FAT (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 5F963CEE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=736 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 953 MB) (Disk ID: 440F0626)
Partition 1: (Active) - (Size=953 MB) - (Type=06)


LastRegBack: 2013-06-03 18:31

==================== End Of Log ============================