Trojaner - Interpol

Mirena · 11.08.2013, 18:41

Hallo,

ich brauche ganz dringend ihre Hilfe.
Ich war am surfen und plötzlich kam ein Sperrbildschirm mit Interpol und ich hätte pornographische Inhalte verbreitet. Mit Frau Merkel oben und ich sollte 100 Euro zahlen usw.
Was soll ich machen ? Können Sie mir bitte helfen.
Vielen Vielen Dank im Voraus

schrauber · 11.08.2013, 18:56

hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Mirena · 11.08.2013, 19:02

Hallo,

ich habe die bisherige Anleitung schon durchgeführt bzgl. Farbar Recovery Scan Tool und würde jatzt gerne den Logfile posten. Ich hoffe ich mache es jetzt richtig.

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-08-2013
Ran by SYSTEM on 11-08-2013 19:54:10
Running from F:\
Windows Vista (TM) Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RAVCpl64.exe [6453760 2008-10-17] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2008-10-17] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [152576 2008-07-18] (Alps Electric Co., Ltd.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2780776 2011-07-19] (CANON INC.)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [44280 2012-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [642816 2012-12-18] (Adobe Systems Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [317280 2008-04-03] (Sony Corporation)
HKLM-x32\...\Run: [McENUI] - C:\PROGRA~2\McAfee\MHN\McENUI.exe [1176808 2008-06-13] (McAfee, Inc.)
HKLM-x32\...\Run: [MarketingTools] - C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [24576 2008-12-08] (Sony Corporation)
HKLM-x32\...\Run: [AML] - C:\Program Files (x86)\Sony\VAIO Launcher\AML.exe [1097728 2008-09-09] (Sony)
HKLM-x32\...\Run: [mcagent_exe] - C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe [641208 2008-07-11] (McAfee, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe [202256 2010-08-10] (RealNetworks, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [SSBkgdUpdate] - C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] - C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [30248 2007-01-29] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] - C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46632 2007-01-29] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] - C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [255528 2007-02-01] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1573584 2012-10-19] (Ask)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1637496 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [468112 2011-07-25] (CANON INC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-11-16] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\Default\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2008-12-08] (Google Inc.)
HKU\Default\...\Run: [NSUFloatingUI] - C:\Program Files\Sony\Network Utility\LANUtil.exe [329728 2008-11-22] (Sony Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\Default User\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2008-12-08] (Google Inc.)
HKU\Default User\...\Run: [NSUFloatingUI] - C:\Program Files\Sony\Network Utility\LANUtil.exe [329728 2008-11-22] (Sony Corporation)
HKU\Juwelchen\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [2438656 2009-04-11] (Microsoft Corporation)
HKU\Juwelchen\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2008-12-08] (Google Inc.)
HKU\Juwelchen\...\Run: [NSUFloatingUI] - C:\Program Files\Sony\Network Utility\LANUtil.exe [329728 2008-11-22] (Sony Corporation)
HKU\Juwelchen\...\Run: [Spotify] - C:\Users\Juwelchen\AppData\Roaming\Spotify\Spotify.exe [4011184 2012-03-26] (Spotify Ltd)
HKU\Juwelchen\...\Run: [DriverScanner] - C:\Program Files (x86)\Uniblue\DriverScanner\launcher.exe [338848 2012-07-10] (Uniblue Systems Limited)
HKU\Juwelchen\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
Startup: C:\Users\Juwelchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Juwelchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sflfdjgubualsrjxeey.lnk
ShortcutTarget: sflfdjgubualsrjxeey.lnk -> C:\Users\JUWELC~1\AppData\Local\Temp\yeexjrslaubugjdflfs.bfg ()
SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AdobeActiveFileMonitor6.0; C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [124832 2007-09-11] ()
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-25] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-25] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-06-25] (Avira Operations GmbH & Co. KG)
S2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [206112 2008-07-23] ()
S2 mcmscsvc; C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe [794232 2008-11-06] (McAfee, Inc.)
S2 McNASvc; c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe [2482848 2008-07-18] (McAfee, Inc.)
S2 McProxy; c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe [358736 2008-07-09] (McAfee, Inc.)
S2 McShield; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [152384 2008-06-20] (McAfee, Inc.)
S3 McSysmon; C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe [605512 2008-09-16] (McAfee, Inc.)
S2 MpfService; C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe [884360 2008-07-09] (McAfee, Inc.)
S3 MSCSPTISRV; C:\Program Files (x86)\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [53248 2008-05-20] (Sony Corporation)
S2 MSK80Service; C:\Program Files (x86)\McAfee\MSK\MskSrver.exe [25416 2008-07-09] (McAfee, Inc.)
S2 NSUService; C:\Program Files\sony\Network Utility\NSUService.exe [360448 2008-11-22] (Sony Corporation)
S3 PACSPTISVR; C:\Program Files (x86)\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [53248 2008-05-20] (Sony Corporation)
S2 RtkAudioService; C:\Windows\RtkAudioService.exe [134656 2008-10-17] (Realtek Semiconductor)
S3 SOHCImp; C:\Program Files (x86)\Sony\VAIO Media plus\SOHCImp.exe [103712 2008-10-21] (Sony Corporation)
S3 SOHDms; C:\Program Files (x86)\Sony\VAIO Media plus\SOHDms.exe [353568 2008-10-21] (Sony Corporation)
S3 SOHDs; C:\Program Files (x86)\Sony\VAIO Media plus\SOHDs.exe [62752 2008-10-21] (Sony Corporation)
S3 SPTISRV; C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SPTISRV.exe [77824 2008-05-20] (Sony Corporation)
S2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [73728 2008-09-08] (Sony Corporation)
S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [446464 2008-09-11] (Sony Corporation)
S3 Vcsw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [279848 2008-09-08] (Sony Corporation)
S2 VzCdbSvc; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [192512 2008-09-08] (Sony Corporation)
S3 McODS; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [x]

==================== Drivers (Whitelisted) ====================

S3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2008-04-24] (ArcSoft, Inc.)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-28] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-03-28] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-28] (Avira Operations GmbH & Co. KG)
S1 DMICall; C:\Windows\SysWow64\DRIVERS\DMICall.sys [10216 2008-11-24] (Sony Corporation)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [101832 2008-06-27] (McAfee, Inc.)
S1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [300360 2008-06-27] (McAfee, Inc.)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40648 2008-06-20] (McAfee, Inc.)
S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2008-06-27] (McAfee, Inc.)
S1 MPFP; C:\Windows\System32\Drivers\Mpfp.sys [176144 2008-06-02] (McAfee, Inc.)
S2 risdptsk; C:\Windows\System32\DRIVERS\risdsn64.sys [76288 2008-10-23] (REDC)
S3 RivaTuner64; C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys [19952 2013-03-30] ()
S3 RivaTuner64; C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys [19952 2013-03-30] ()
S1 DMICall; system32\DRIVERS\DMICall.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-11 18:21 - 2013-08-11 18:21 - 00008212 _____ C:\Windows\mfebcdata
2013-08-11 17:55 - 2013-08-11 17:55 - 00726464 _____ (Enigma Software Group USA, LLC.) C:\Users\Juwelchen\Downloads\SpyHunter-Installer.exe
2013-08-11 17:20 - 2013-08-11 17:20 - 00000165 _____ C:\ProgramData\sflfdjgubualsrjxeey.reg
2013-08-11 17:20 - 2013-08-11 17:20 - 00000070 _____ C:\ProgramData\sflfdjgubualsrjxeey.bat
2013-08-04 18:35 - 2013-08-04 18:42 - 00000000 ____D C:\Users\Juwelchen\Desktop\Kopie USB
2013-07-28 12:48 - 2013-08-04 18:35 - 00000000 ____D C:\Users\Juwelchen\Desktop\BadEms
2013-07-25 18:46 - 2013-07-25 18:46 - 00002115 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-07-23 19:47 - 2013-07-23 19:51 - 00000000 ____D C:\Windows\System32\MRT
2013-07-19 19:08 - 2013-05-29 07:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-19 19:08 - 2013-05-29 06:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-19 19:08 - 2013-05-29 06:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-19 19:08 - 2013-05-29 06:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-19 19:08 - 2013-05-29 06:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-19 19:08 - 2013-05-29 06:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-07-19 19:08 - 2013-05-29 06:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-07-19 19:08 - 2013-05-29 06:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-19 19:08 - 2013-05-29 06:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-19 19:08 - 2013-05-29 06:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-07-19 19:08 - 2013-05-29 06:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-07-19 19:08 - 2013-05-29 06:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-19 19:08 - 2013-05-29 06:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-19 19:08 - 2013-05-29 06:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-19 19:08 - 2013-05-29 06:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-07-19 19:08 - 2013-05-29 06:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-19 19:08 - 2013-05-29 02:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-19 19:08 - 2013-05-29 02:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-19 19:08 - 2013-05-29 02:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-19 19:08 - 2013-05-29 02:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-19 19:08 - 2013-05-29 02:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-19 19:08 - 2013-05-29 02:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-19 19:08 - 2013-05-29 02:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-19 19:08 - 2013-05-29 02:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-19 19:08 - 2013-05-29 02:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-19 19:08 - 2013-05-29 02:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-19 19:08 - 2013-05-29 02:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-19 19:08 - 2013-05-29 02:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-19 19:08 - 2013-05-29 02:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-19 19:08 - 2013-05-29 02:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-19 19:08 - 2013-05-29 02:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-19 19:08 - 2013-05-29 02:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-17 08:58 - 2013-06-01 05:19 - 00619008 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-17 08:58 - 2013-06-01 05:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-17 08:58 - 2013-04-17 13:32 - 01268224 _____ (Microsoft Corporation) C:\Windows\System32\d3d10.dll
2013-07-17 08:58 - 2013-04-17 13:32 - 00327680 _____ (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll
2013-07-17 08:58 - 2013-04-17 13:32 - 00287232 _____ (Microsoft Corporation) C:\Windows\System32\d3d10core.dll
2013-07-17 08:58 - 2013-04-17 13:32 - 00196096 _____ (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll
2013-07-17 08:58 - 2013-04-17 12:29 - 02002944 _____ (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2013-07-17 08:58 - 2013-04-17 12:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-07-17 08:58 - 2013-04-17 12:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-07-17 08:58 - 2013-04-17 12:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-07-17 08:58 - 2013-04-17 12:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-07-17 08:58 - 2013-04-17 12:27 - 00566272 _____ (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2013-07-17 08:58 - 2013-04-17 12:02 - 00834048 _____ (Microsoft Corporation) C:\Windows\System32\d2d1.dll
2013-07-17 08:58 - 2013-04-17 11:58 - 01556480 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-07-17 08:58 - 2013-04-17 11:58 - 01149440 _____ (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2013-07-17 08:58 - 2013-04-17 11:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-07-17 08:58 - 2013-04-17 11:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-07-17 08:58 - 2013-04-17 11:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-07-17 08:58 - 2013-04-17 11:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-17 08:56 - 2013-05-08 05:18 - 01706496 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-17 08:56 - 2013-05-08 05:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-17 08:53 - 2013-06-04 03:03 - 02775040 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys

==================== One Month Modified Files and Folders =======

2013-08-11 18:21 - 2013-08-11 18:21 - 00008212 _____ C:\Windows\mfebcdata
2013-08-11 18:21 - 2008-12-08 14:10 - 00046067 _____ C:\Windows\System32\Config.MPF
2013-08-11 18:21 - 2008-10-30 17:28 - 00001076 _____ C:\Windows\bthservsdp.dat
2013-08-11 18:21 - 2006-11-02 16:42 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-11 18:21 - 2006-11-02 16:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-11 18:20 - 2006-11-02 16:22 - 00003616 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-11 18:20 - 2006-11-02 16:22 - 00003616 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-11 17:55 - 2013-08-11 17:55 - 00726464 _____ (Enigma Software Group USA, LLC.) C:\Users\Juwelchen\Downloads\SpyHunter-Installer.exe
2013-08-11 17:48 - 2012-10-18 18:09 - 00000280 _____ C:\Windows\Tasks\DriverScanner.job
2013-08-11 17:48 - 2009-07-30 19:18 - 01681576 _____ C:\Windows\WindowsUpdate.log
2013-08-11 17:42 - 2013-05-14 17:02 - 00000680 _____ C:\Users\Juwelchen\AppData\Local\d3d9caps.dat
2013-08-11 17:39 - 2010-04-05 13:42 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-11 17:20 - 2013-08-11 17:20 - 00000165 _____ C:\ProgramData\sflfdjgubualsrjxeey.reg
2013-08-11 17:20 - 2013-08-11 17:20 - 00000070 _____ C:\ProgramData\sflfdjgubualsrjxeey.bat
2013-08-11 17:14 - 2012-10-18 19:28 - 00000000 ____D C:\Users\Juwelchen\AppData\Local\DoNotTrackPlus
2013-08-11 17:12 - 2012-03-26 11:05 - 00000000 ____D C:\Users\Juwelchen\AppData\Roaming\Spotify
2013-08-04 18:52 - 2010-04-05 13:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-04 18:49 - 2013-05-07 08:36 - 00000000 ____D C:\Users\Juwelchen\Desktop\E2 Poensgen
2013-08-04 18:42 - 2013-08-04 18:35 - 00000000 ____D C:\Users\Juwelchen\Desktop\Kopie USB
2013-08-04 18:35 - 2013-07-28 12:48 - 00000000 ____D C:\Users\Juwelchen\Desktop\BadEms
2013-08-04 18:00 - 2012-04-06 13:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-04 17:58 - 2012-10-18 21:28 - 00000656 _____ C:\Windows\Tasks\WebContent AutoUpdate 2012.job
2013-08-04 17:57 - 2012-10-31 20:10 - 00000624 _____ C:\Windows\Tasks\WebContent AutoUpdate 2013.job
2013-08-04 13:43 - 2012-03-04 14:19 - 00003690 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{B2B2D8C9-5283-4B44-A625-A188A71E0C88}
2013-08-01 17:40 - 2008-01-21 12:10 - 01445546 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-01 17:40 - 2008-01-21 12:09 - 00628992 _____ C:\Windows\System32\perfh007.dat
2013-08-01 17:40 - 2008-01-21 12:09 - 00126704 _____ C:\Windows\System32\perfc007.dat
2013-07-25 18:46 - 2013-07-25 18:46 - 00002115 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-07-25 18:46 - 2009-07-30 19:51 - 00000000 ____D C:\Users\Juwelchen\AppData\Local\Google
2013-07-25 18:45 - 2008-12-08 14:06 - 00000000 ____D C:\Program Files (x86)\Google
2013-07-23 19:51 - 2013-07-23 19:47 - 00000000 ____D C:\Windows\System32\MRT
2013-07-21 10:11 - 2012-04-06 13:32 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-21 10:11 - 2012-04-06 13:32 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-21 10:11 - 2011-07-25 20:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-21 10:11 - 2009-07-30 19:20 - 00000000 ____D C:\Users\Juwelchen\AppData\Local\Adobe
2013-07-20 11:26 - 2006-11-02 16:21 - 00478352 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-20 11:22 - 2006-11-02 16:07 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-07-20 11:22 - 2006-11-02 16:07 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-17 11:27 - 2006-11-02 16:27 - 00126085 _____ C:\Windows\setupact.log
2013-07-17 08:47 - 2010-04-05 13:42 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-17 08:47 - 2010-04-05 13:42 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

Files to move or delete:
====================
C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
C:\ProgramData\sflfdjgubualsrjxeey.bat
C:\ProgramData\sflfdjgubualsrjxeey.reg

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-06-05 19:47:08
Restore point made on: 2013-06-08 16:38:43
Restore point made on: 2013-06-11 16:13:42
Restore point made on: 2013-06-16 09:28:51
Restore point made on: 2013-06-16 19:21:01
Restore point made on: 2013-06-18 19:36:41
Restore point made on: 2013-06-19 13:40:38
Restore point made on: 2013-06-22 20:29:14
Restore point made on: 2013-06-23 20:35:20
Restore point made on: 2013-06-25 16:23:55
Restore point made on: 2013-06-26 13:20:14
Restore point made on: 2013-06-30 08:13:24
Restore point made on: 2013-07-01 21:07:02
Restore point made on: 2013-07-02 10:51:05
Restore point made on: 2013-07-17 16:02:39
Restore point made on: 2013-07-19 19:07:24
Restore point made on: 2013-07-20 14:48:48
Restore point made on: 2013-07-21 16:13:07
Restore point made on: 2013-07-23 19:46:39
Restore point made on: 2013-07-24 16:18:08
Restore point made on: 2013-07-27 18:55:33
Restore point made on: 2013-07-28 14:10:02
Restore point made on: 2013-07-30 09:51:26
Restore point made on: 2013-08-01 14:21:27
Restore point made on: 2013-08-04 16:35:55

==================== Memory info =========================== 

Percentage of memory in use: 14%
Total physical RAM: 4062.12 MB
Available physical RAM: 3482.9 MB
Total Pagefile: 3808.37 MB
Available Pagefile: 3455.71 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:451.3 GB) (Free:306.23 GB) NTFS (Disk=0 Partition=2) ==>[Drive with boot components (obtained from BCD)]
Drive e: (Recovery) (Fixed) (Total:14.46 GB) (Free:0.82 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]
Drive f: (Sony_16GR) (Removable) (Total:14.92 GB) (Free:12.4 GB) FAT32 (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.06 GB) (Free:0.06 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 90A59430)
Partition 1: (Not Active) - (Size=14 GB) - (Type=27)
Partition 2: (Active) - (Size=451 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)


LastRegBack: 2013-08-11 18:11

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 12.08.2013, 08:02

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

Startup: C:\Users\Juwelchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sflfdjgubualsrjxeey.lnk
ShortcutTarget: sflfdjgubualsrjxeey.lnk -> C:\Users\JUWELC~1\AppData\Local\Temp\yeexjrslaubugjdflfs.bfg ()
C:\ProgramData\sflfdjgubualsrjxeey.bat
C:\ProgramData\sflfdjgubualsrjxeey.reg
C:\Users\JUWELC~1\AppData\Local\Temp\yeexjrslaubugjdflfs.bfg

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Rechner neu starten

Trojaner - Interpol

Plagegeister aller Art und deren Bekämpfung: Trojaner - Interpol