GVU Trojaner-Befall, vermutlich V2.07. WIN7pro 32Bit

karmann · 02.09.2013, 14:22

Hallo,
ich habe seit gestern den GVU Trojaner. Nach einigen Recherchen meine ich es ist V2.07.Aber Ihr seid die Profis, kann mich auch täuschen

Keiner der Startmodi funktioniert, jedes mal meldet sich der Rechner ab und fährt herunter.
Habe bereits FRST auf einen USB-Stick gezogen und füge hier das TXT-File an:

Mein Betriebssystem ist WIN 7 32bit

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-09-2013 04
Ran by SYSTEM on MININT-I3JNJUI on 02-09-2013 14:55:15
Running from F:\
Windows 7 Professional (X86) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-29] (Synaptics Incorporated)
HKLM\...\Run: [SoundMAXPnP] - C:\Program Files\Analog Devices\Core\smax4pnp.exe [1183744 2007-02-21] (Analog Devices, Inc.)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2009-05-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [CnxtCoInstallerDefer] - C:\Program Files\CONEXANT\SETUP4BD06912293\SETUP\Setup.exe [1116728 2009-03-04] (Conexant Systems, Inc.)
HKLM\...\Run: [] -  [x]
HKLM\...\Run: [NeroFilterCheck] - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe [4367360 2010-05-20] (Broadcom Corporation)
HKLM\...\Run: [PAC207_Monitor] - C:\Windows\PixArt\PAC207\Monitor.exe [323584 2007-12-10] (PixArt Imaging Incorporation)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [hpqSRMon] - C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [995176 2013-06-20] (Microsoft Corporation)
HKLM\...\Run: [Smart File Advisor] - C:\Program Files\Smart File Advisor\sfa.exe [280824 2011-04-04] (Filefacts.net)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310128 2013-02-13] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\HP 6715B\...\Run: [AnyDVD] - C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe [ 2011-08-24] (SlySoft, Inc.)
HKU\HP 6715B\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [ 2013-02-13] (Samsung)
HKU\HP 6715B\...\Run: [KiesPDLR] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-02-13] (Samsung)
HKU\HP 6715B\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-02-13] (Samsung)
HKU\HP 6715B\...\Run: [Google Update] - C:\Users\HP 6715B\AppData\Local\Google\Update\GoogleUpdate.exe [ 2011-12-27] (Google Inc.)
HKU\HP 6715B\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\HP6715~1\AppData\Local\Temp\hsjclucevusvloqst.exe [ 2013-08-28] (Valve Corporation) <===== ATTENTION
HKU\HP 6715B\...\Policies\system: [NoDispCPL] 0
HKU\HP 6715B\...\Policies\system: [DisableClock] 0
HKU\HP 6715B\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION 
HKU\HP 6715B\...\Command Processor: "C:\Users\HP6715~1\AppData\Local\Temp\hsjclucevusvloqst.exe" <===== ATTENTION!
Startup: C:\Users\HP 6715B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK
ShortcutTarget: Hardcopy.LNK -> C:\Program Files\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)

========================== Services (Whitelisted) =================

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-06-20] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295376 2013-06-20] (Microsoft Corporation)
S2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe [3718656 2010-05-20] (Broadcom Corporation)

==================== Drivers (Whitelisted) ====================

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [46976 2009-07-13] (Microsoft Corporation)
S2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
S3 Andbus; C:\Windows\System32\DRIVERS\lgandbus.sys [14336 2010-12-07] (LG Electronics Inc.)
S3 AndDiag; C:\Windows\System32\DRIVERS\lganddiag.sys [20736 2010-12-07] (LG Electronics Inc.)
S3 AndGps; C:\Windows\System32\DRIVERS\lgandgps.sys [20096 2010-12-07] (LG Electronics Inc.)
S3 ANDModem; C:\Windows\System32\DRIVERS\lgandmodem.sys [25088 2010-12-07] (LG Electronics Inc.)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag.sys [23168 2010-11-28] (LG Electronics Inc.)
S3 AndNetGps; C:\Windows\System32\DRIVERS\lgandnetgps.sys [22272 2010-11-28] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem.sys [28032 2010-11-28] (LG Electronics Inc.)
S3 andnetndis; C:\Windows\System32\DRIVERS\lgandnetndis.sys [69632 2010-11-28] (LG Electronics Inc)
S3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [108480 2010-07-22] (SlySoft, Inc.)
S3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [101248 2011-08-07] (AVM Berlin)
S3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2010-05-20] (Broadcom Corporation)
S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-13] (Microsoft Corporation)
S2 DirectNT; C:\Windows\System32\Drivers\DirectNT.sys [3424 1996-12-04] (c't)
S1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [26024 2010-01-01] (Elaborate Bytes AG)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-02-05] ()
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation)
S1 MpKsl11c2cb5e; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsl11c2cb5e.sys [29904 2013-08-28] (Microsoft Corporation)
S1 MpKsl1ef9c6d4; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsl1ef9c6d4.sys [29904 2013-09-01] (Microsoft Corporation)
S1 MpKsl46a74808; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsl46a74808.sys [29904 2013-09-02] ()
S1 MpKsl5889921c; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsl5889921c.sys [29904 2013-08-28] ()
S1 MpKsl8920220d; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsl8920220d.sys [29904 2013-09-02] ()
S1 MpKsla0329d44; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsla0329d44.sys [29904 2013-09-01] ()
S3 PAC207; C:\Windows\System32\DRIVERS\PFC027.SYS [618112 2008-02-13] (PixArt Imaging Inc.)
S3 vpcbus; C:\Windows\System32\DRIVERS\vpchbus.sys [165376 2009-09-22] (Microsoft Corporation)
S1 vpcnfltr; C:\Windows\System32\DRIVERS\vpcnfltr.sys [55040 2009-09-22] (Microsoft Corporation)
S3 vpcusb; C:\Windows\System32\DRIVERS\vpcusb.sys [78336 2009-09-22] (Microsoft Corporation)
S1 vpcvmm; C:\Windows\System32\drivers\vpcvmm.sys [294912 2009-09-22] (Microsoft Corporation)
S3 LgBttPort; system32\DRIVERS\lgbtport.sys [x]
S3 lgbusenum; system32\DRIVERS\lgbtbus.sys [x]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\61883.sys BEB5E6A8C17C3C7485563281E0F9E77E
C:\Windows\System32\DRIVERS\Accelerometer.sys E2346D37CE60F2D928857EE33D04CBDF
C:\Windows\system32\drivers\acedrv11.sys E6F53D6C0DEA3D375362265E175CA638
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ADIHdAud.sys FB9ECE3F7B8A03E474E611031AD4CD23
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 9EBBBA55060F786F0FCAA3893BFA2806
C:\Windows\System32\DRIVERS\AGRSM.sys 7E10E3BB9B258AD8A9300F91214D67B9
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\djsvs.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2
C:\Windows\System32\DRIVERS\lgandbus.sys 3E59DF4984FBD6800D6621480B38A34E
C:\Windows\System32\DRIVERS\lganddiag.sys 8E0BF6F3B2C9C292BC7CE0DE727CDD56
C:\Windows\System32\DRIVERS\lgandgps.sys 1D2C90E25483363D54B652898BBC8F2A
C:\Windows\System32\DRIVERS\lgandmodem.sys B1B06A95DA2CAC7FA19832C60C348C85
C:\Windows\System32\DRIVERS\lgandnetdiag.sys A9EA7C3CFCBEE7FDD8FEED28692684E3
C:\Windows\System32\DRIVERS\lgandnetgps.sys 0863139F017029B7A9545D9389682BBB
C:\Windows\System32\DRIVERS\lgandnetmodem.sys 40AC5219DDE356AB1B5BFE6DDE1CD022
C:\Windows\System32\DRIVERS\lgandnetndis.sys D1240F055057ADAAD67DCE49CC5EE76C
C:\Windows\System32\Drivers\AnyDVD.sys C6A45FEE274FB31DAF3DE1E12D53A191
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys EBA9B1E2E62091B72C57C93211AA7FB2
C:\Windows\System32\Drivers\ATSwpWDF.sys BEFE54E9BC648A3C79C917A63B6EE7DA
C:\Windows\System32\DRIVERS\avc.sys C44BDD77E06053CF5AFE046F3A47C16B
C:\Windows\System32\DRIVERS\avmaudio.sys 728C4A6C722535C16D1025F51AA31E22
C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\System32\drivers\BCM42RLY.sys 06740BCA09A1D6A7B2D753F17D0BB10B
C:\Windows\System32\DRIVERS\bcmwl6.sys 40FB1D9065E668CD4BEEFF0A804C40E0
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bufeap.sys 1F8A49EFAF7BBB9545902AF0956F41CC
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 247B4CE2DAB1160CD422D532D5241E1F
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssudbus.sys 649705E3DAE598BC0F957BACBF9A2BD5
C:\Windows\System32\Drivers\DirectNT.sys 80D5A04463AFF05E84FEBEE50920481E
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Dot4.sys B5E479EB83707DD698F66953E922042C
C:\Windows\System32\DRIVERS\Dot4Prt.sys CAEFD09B6A6249C53A67D55A9A9FCABF
C:\Windows\System32\DRIVERS\dot4usb.sys CF491FF38D62143203C065260567E2F7
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 16498EBC04AE9DD07049A8884B205C05
C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ElbyCDIO.sys 309AC30471A0F1C3A89DEE1C81230576
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fssfltr.sys BFAAA92861526BB0ADCD01E964AB6609
C:\Windows\system32\FsUsbExDisk.SYS DDEE99DC54EFA20BD5A442CD733C4462
C:\Windows\System32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05
C:\Windows\System32\drivers\ftdibus.sys AAE37F0F2F613218DCE17B42A18C38DB
C:\Windows\System32\drivers\ftser2k.sys 48BFD1BA45C9C9E7AB339E25ABFBA1D2
C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cpqbttn.sys 7DAD592A4D28092D584CFB4DEEF1373D
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hpdskflt.sys 20C3DE306E40CA433581E0DB4578546E
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys B7895B4182C0D16F6EFADEB8081E8D36
C:\Windows\System32\Drivers\ksecpkg.sys D30159AC9237519FBC62C6EC247D2D46
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MpFilter.sys 24406D75B40F0F6B3C1AC7031D734565
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsl11c2cb5e.sys A69630D039C38018689190234F866D77
c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsl1ef9c6d4.sys A69630D039C38018689190234F866D77
c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsl46a74808.sys 4137EE420481D10734DA3018D0325582
c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsl5889921c.sys 4137EE420481D10734DA3018D0325582
c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsl8920220d.sys 4137EE420481D10734DA3018D0325582
c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7E177430-47B0-4E06-BC76-11E727F68EF4}\MpKsla0329d44.sys 4137EE420481D10734DA3018D0325582
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25
C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC
C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\msdv.sys 114B67C324D64C8195FD3BF93B4DF02A
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 8C9C922D71F1CD4DEF73F186416B7896
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NisDrvWFP.sys C58DB40E4C95BE8EE727BE872BE6383F
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 5E43D2B0EE64123D4880DFA6626DEFDE
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0
C:\Windows\system32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\PFC027.SYS 4A410C7AEA51123519C20D43A20BCE96
C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B
C:\Windows\System32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys F031683E6D1FEA157ABB2FF260B51E61
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46
C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB
C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC
C:\Windows\System32\DRIVERS\ssudmdm.sys 6D82CB78DE57A073E95431F3486B1B27
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys 1DE40024679CDE0E573465253519730E
C:\Windows\System32\drivers\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\DRIVERS\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\drivers\tcpipreg.sys 3EEBD3BD93DA46A26E89893C7AB2FF3B
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\tpm.sys 5AD05191DC8B444A7BA4D79B76C42A30
C:\Windows\System32\DRIVERS\tssecsrv.sys B37B08F2E5EEB1A37E448E09BACE1101
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\drivers\usbaudio.sys 1D9F2BD026E8E2D45033A4DF3F16B78C
C:\Windows\System32\DRIVERS\usbccgp.sys BD9C55D7023C5DE374507ACC7A14E2AC
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbehci.sys F92DE757E4B7CE9C07C5E65423F3AE3B
C:\Windows\System32\DRIVERS\usbhub.sys 8DC94AEC6A7E644A06135AE7506DC2E9
C:\Windows\System32\DRIVERS\usbohci.sys E185D44FAC515A18D9DEDDC23C2CDF44
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys 576096CCBC07E7C4EA4F5E6686D6888F
C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A
C:\Windows\system32\drivers\usbuhci.sys 68DF884CF41CDADA664BEB01DAF67E3D
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vpchbus.sys 33E74DF34753FCAAB06F6F2BDC8CABF5
C:\Windows\System32\DRIVERS\vpcnfltr.sys 5F04362CEB5FB5901037E9D9EADD3760
C:\Windows\System32\DRIVERS\vpcusb.sys 625088D6EE9EDE977FD03CF18D1CD5C5
C:\Windows\System32\drivers\vpcvmm.sys 5ED378D91E32134F3C0B3810860FFD71
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys 7090D3436EEB4E7DA3373090A23448F7
C:\Windows\System32\DRIVERS\vwifimp.sys A3F04CBEA6C2A10E6CB01F8B47611882
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys A840213F1ACDCC175B4D1D5AAEAC0D7A
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070
C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-01 11:46 - 2013-09-01 12:38 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0
2013-08-28 07:36 - 2013-08-28 07:36 - 00163051 _____ C:\Users\HP 6715B\AppData\Roaming\2433f433
2013-08-28 07:36 - 2013-08-28 07:36 - 00163049 _____ C:\Users\HP 6715B\AppData\Local\2433f433
2013-08-28 07:36 - 2013-08-28 07:36 - 00163034 _____ C:\ProgramData\2433f433
2013-08-19 06:50 - 2013-08-19 06:51 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-19 04:49 - 2013-07-25 19:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-19 04:49 - 2013-07-25 19:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-19 04:49 - 2013-07-25 19:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-19 04:49 - 2013-07-25 19:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-19 04:49 - 2013-07-25 19:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-19 04:49 - 2013-07-25 19:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-19 04:49 - 2013-07-25 19:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-19 04:49 - 2013-07-25 19:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-19 04:49 - 2013-07-25 19:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-19 04:49 - 2013-07-25 19:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-19 04:49 - 2013-07-25 19:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-19 04:49 - 2013-07-25 19:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-19 04:49 - 2013-07-25 19:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-19 04:49 - 2013-07-25 19:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-19 04:49 - 2013-07-25 18:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-19 04:49 - 2013-07-25 17:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-16 13:09 - 2013-08-16 13:09 - 00000000 ____D C:\Windows\System32\MRT
2013-08-16 13:06 - 2013-07-25 00:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-16 13:06 - 2013-07-18 17:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-16 13:06 - 2013-07-08 21:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-08-16 13:06 - 2013-07-08 21:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-08-16 13:06 - 2013-07-08 20:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-08-16 13:06 - 2013-07-08 20:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-16 13:06 - 2013-07-08 20:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-16 13:06 - 2013-07-08 20:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-16 13:06 - 2013-07-08 20:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-16 13:06 - 2013-07-08 20:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-16 13:06 - 2013-07-05 21:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-16 13:06 - 2013-06-14 19:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-13 05:30 - 2013-08-13 06:16 - 04836122 _____ C:\Users\HP 6715B\Downloads\INPA Installation - Copy.zip
2013-08-13 05:19 - 1998-05-15 09:01 - 01355776 ____N (Microsoft Corporation) C:\Windows\System32\MSVBVM50.DLL
2013-08-13 05:18 - 2013-08-13 05:18 - 00000000 ____D C:\Program Files\CARSOFT
2013-08-13 05:18 - 2013-08-13 05:18 - 00000000 ____D C:\cm75f
2013-08-13 05:18 - 1998-10-29 05:45 - 00306688 _____ (InstallShield Software Corporation) C:\Windows\IsUninst.exe
2013-08-13 05:17 - 2013-08-13 05:17 - 26149989 _____ C:\Users\HP 6715B\Downloads\BMWCarsoft6.5SP1Cracks.zip
2013-08-09 03:16 - 2013-08-09 03:19 - 00000000 ____D C:\Users\HP 6715B\Desktop\2013_08_09

==================== One Month Modified Files and Folders =======

2013-09-02 14:54 - 2013-09-02 14:54 - 00000000 ____D C:\FRST
2013-09-02 04:44 - 2010-04-22 06:34 - 01853761 _____ C:\Windows\WindowsUpdate.log
2013-09-02 04:42 - 2009-07-13 20:39 - 00179655 _____ C:\Windows\setupact.log
2013-09-01 12:38 - 2013-09-01 11:46 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0
2013-09-01 10:46 - 2010-04-22 07:18 - 01498742 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-01 10:41 - 2011-08-07 05:31 - 00000438 _____ C:\Windows\System32\Drivers\etc\hosts.ics
2013-09-01 09:10 - 2009-07-13 20:34 - 00019696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-01 09:10 - 2009-07-13 20:34 - 00019696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-01 08:45 - 2010-04-22 07:02 - 00000000 ____D C:\users\HP 6715B
2013-09-01 08:40 - 2012-01-15 09:31 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-28 07:36 - 2013-08-28 07:36 - 00163051 _____ C:\Users\HP 6715B\AppData\Roaming\2433f433
2013-08-28 07:36 - 2013-08-28 07:36 - 00163049 _____ C:\Users\HP 6715B\AppData\Local\2433f433
2013-08-28 07:36 - 2013-08-28 07:36 - 00163034 _____ C:\ProgramData\2433f433
2013-08-26 01:19 - 2012-06-06 08:17 - 00000000 ____D C:\Users\HP 6715B\AppData\Roaming\UseNeXT
2013-08-26 01:17 - 2012-06-06 08:17 - 00000000 ____D C:\Users\HP 6715B\Documents\UseNeXT
2013-08-21 07:51 - 2012-08-26 11:22 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-08-21 07:51 - 2011-10-16 02:47 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-08-21 04:54 - 2012-07-29 08:40 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-19 06:51 - 2013-08-19 06:50 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-19 06:34 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\rescache
2013-08-19 05:49 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-19 05:28 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-08-19 04:48 - 2012-05-15 07:55 - 00000000 ____D C:\Users\HP 6715B\Desktop\Neuer Ordner
2013-08-16 13:13 - 2013-08-16 13:09 - 00000000 ____D C:\Windows\System32\MRT
2013-08-16 13:09 - 2010-04-22 07:44 - 75778376 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-08-13 06:17 - 2011-03-17 08:47 - 00000000 ____D C:\Users\HP 6715B\Desktop\Auto
2013-08-13 06:16 - 2013-08-13 05:30 - 04836122 _____ C:\Users\HP 6715B\Downloads\INPA Installation - Copy.zip
2013-08-13 05:18 - 2013-08-13 05:18 - 00000000 ____D C:\Program Files\CARSOFT
2013-08-13 05:18 - 2013-08-13 05:18 - 00000000 ____D C:\cm75f
2013-08-13 05:17 - 2013-08-13 05:17 - 26149989 _____ C:\Users\HP 6715B\Downloads\BMWCarsoft6.5SP1Cracks.zip
2013-08-13 04:54 - 2013-02-17 06:34 - 00027648 ___SH C:\Users\HP 6715B\Thumbs.db
2013-08-13 03:08 - 2011-09-17 01:48 - 00000000 ____D C:\Users\HP 6715B\Downloads\Buffalo
2013-08-13 03:05 - 2013-01-17 05:34 - 00000000 ____D C:\Users\HP 6715B\Downloads\BMW
2013-08-09 03:19 - 2013-08-09 03:16 - 00000000 ____D C:\Users\HP 6715B\Desktop\2013_08_09
2013-08-07 06:45 - 2012-07-28 09:55 - 00000000 ____D C:\Users\HP 6715B\AppData\Roaming\Mozilla

Files to move or delete:
====================
C:\Users\HP6715~1\AppData\Local\Temp\hsjclucevusvloqst.exe
C:\Users\HP 6715B\2920.exe
C:\Users\HP 6715B\Firefox_Setup_14.0.1.exe
C:\Users\HP 6715B\freenetsetup.exe
C:\Users\HP 6715B\GMX_IE9_Setup.exe
C:\Users\HP 6715B\AppData\Local\Temp\hsjclucevusvloqst.dll
C:\Users\HP 6715B\AppData\Local\Temp\hsjclucevusvloqst.exe
C:\Users\HP 6715B\AppData\Local\Temp\Instprog.exe
C:\Users\HP 6715B\AppData\Local\Temp\Instprog901.exe
C:\Users\HP 6715B\AppData\Local\Temp\b70f3589-ab2a-43e6-8e34-78dc6abb3b05\CliSecureRT.dll

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-08-13 03:11:36
Restore point made on: 2013-08-16 13:02:38
Restore point made on: 2013-08-19 04:47:22
Restore point made on: 2013-08-19 10:43:44
Restore point made on: 2013-08-25 22:51:10
Restore point made on: 2013-09-01 08:39:44

==================== BCD ================================

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=Y:
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {default}
resumeobject            {6bbaf95a-4e6f-11df-a910-9ef642ae3a0c}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {current}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {6bbaf95a-4e6f-11df-a910-9ef642ae3a0c}
nx                      OptIn

Windows Boot Loader
-------------------
identifier              {current}
device                  ramdisk=[C:]\Recovery\6bbaf95c-4e6f-11df-a910-9ef642ae3a0c\Winre.wim,{6bbaf95d-4e6f-11df-a910-9ef642ae3a0c}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\6bbaf95c-4e6f-11df-a910-9ef642ae3a0c\Winre.wim,{6bbaf95d-4e6f-11df-a910-9ef642ae3a0c}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Resume from Hibernate
---------------------
identifier              {6bbaf95a-4e6f-11df-a910-9ef642ae3a0c}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
pae                     Yes
debugoptionenabled      No

Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=Y:
path                    \boot\memtest.exe
description             Windows-Speicherdiagnose
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS Settings
------------
identifier              {emssettings}
bootems                 Yes

Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM Defects
-----------
identifier              {badmemory}

Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}

Device options
--------------
identifier              {6bbaf95d-4e6f-11df-a910-9ef642ae3a0c}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\6bbaf95c-4e6f-11df-a910-9ef642ae3a0c\boot.sdi


==================== Memory info =========================== 

Percentage of memory in use: 22%
Total physical RAM: 1919.3 MB
Available physical RAM: 1481.79 MB
Total Pagefile: 1919.3 MB
Available Pagefile: 1481.85 MB
Total Virtual: 2047.88 MB
Available Virtual: 1942.39 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:32.25 GB) NTFS
Drive f: () (Removable) (Total:3.73 GB) (Free:0.74 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 4DE7E302)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: 6F20736B)
No partition Table on disk 1.
Disk 1 is a removable device.


LastRegBack: 2013-08-13 03:31

==================== End Of Log ============================

schrauber · 02.09.2013, 14:26

hi,

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKU\HP 6715B\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\HP6715~1\AppData\Local\Temp\hsjclucevusvloqst.exe [ 2013-08-28] (Valve Corporation) <===== ATTENTION
HKU\HP 6715B\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION 
HKU\HP 6715B\...\Command Processor: "C:\Users\HP6715~1\AppData\Local\Temp\hsjclucevusvloqst.exe" <===== ATTENTION!
2013-08-28 07:36 - 2013-08-28 07:36 - 00163051 _____ C:\Users\HP 6715B\AppData\Roaming\2433f433
2013-08-28 07:36 - 2013-08-28 07:36 - 00163049 _____ C:\Users\HP 6715B\AppData\Local\2433f433
2013-08-28 07:36 - 2013-08-28 07:36 - 00163034 _____ C:\ProgramData\2433f433
C:\Users\HP6715~1\AppData\Local\Temp\hsjclucevusvloqst.exe
C:\Users\HP 6715B\2920.exe
C:\Users\HP 6715B\Firefox_Setup_14.0.1.exe
C:\Users\HP 6715B\freenetsetup.exe
C:\Users\HP 6715B\GMX_IE9_Setup.exe
C:\Users\HP 6715B\AppData\Local\Temp\hsjclucevusvloqst.dll
C:\Users\HP 6715B\AppData\Local\Temp\hsjclucevusvloqst.exe
C:\Users\HP 6715B\AppData\Local\Temp\Instprog.exe
C:\Users\HP 6715B\AppData\Local\Temp\Instprog901.exe
C:\Users\HP 6715B\AppData\Local\Temp\b70f3589-ab2a-43e6-8e34-78dc6abb3b05\CliSecureRT.dll

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Rechner normal starten

karmann · 02.09.2013, 14:42

Hier ist das Fixlog:

Normal booten hat funktioniert. Super!! Was muss ich sonst noch tun?

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-09-2013 04
Ran by SYSTEM at 2013-09-02 15:39:25 Run:1
Running from F:\
Boot Mode: Recovery

==============================================

Content of fixlist:
*****************
HKU\HP 6715B\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\HP6715~1\AppData\Local\Temp\hsjclucevusvloqst.exe [ 2013-08-28] (Valve Corporation) <===== ATTENTION
HKU\HP 6715B\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION 
HKU\HP 6715B\...\Command Processor: "C:\Users\HP6715~1\AppData\Local\Temp\hsjclucevusvloqst.exe" <===== ATTENTION!
2013-08-28 07:36 - 2013-08-28 07:36 - 00163051 _____ C:\Users\HP 6715B\AppData\Roaming\2433f433
2013-08-28 07:36 - 2013-08-28 07:36 - 00163049 _____ C:\Users\HP 6715B\AppData\Local\2433f433
2013-08-28 07:36 - 2013-08-28 07:36 - 00163034 _____ C:\ProgramData\2433f433
C:\Users\HP6715~1\AppData\Local\Temp\hsjclucevusvloqst.exe
C:\Users\HP 6715B\2920.exe
C:\Users\HP 6715B\Firefox_Setup_14.0.1.exe
C:\Users\HP 6715B\freenetsetup.exe
C:\Users\HP 6715B\GMX_IE9_Setup.exe
C:\Users\HP 6715B\AppData\Local\Temp\hsjclucevusvloqst.dll
C:\Users\HP 6715B\AppData\Local\Temp\hsjclucevusvloqst.exe
C:\Users\HP 6715B\AppData\Local\Temp\Instprog.exe
C:\Users\HP 6715B\AppData\Local\Temp\Instprog901.exe
C:\Users\HP 6715B\AppData\Local\Temp\b70f3589-ab2a-43e6-8e34-78dc6abb3b05\CliSecureRT.dll
         
*****************

HKU\HP 6715B\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully.
HKU\HP 6715B\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\HP 6715B\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
C:\Users\HP 6715B\AppData\Roaming\2433f433 => Moved successfully.
C:\Users\HP 6715B\AppData\Local\2433f433 => Moved successfully.
C:\ProgramData\2433f433 => Moved successfully.
C:\Users\HP6715~1\AppData\Local\Temp\hsjclucevusvloqst.exe => Moved successfully.
C:\Users\HP 6715B\2920.exe => Moved successfully.
C:\Users\HP 6715B\Firefox_Setup_14.0.1.exe => Moved successfully.
C:\Users\HP 6715B\freenetsetup.exe => Moved successfully.
C:\Users\HP 6715B\GMX_IE9_Setup.exe => Moved successfully.
C:\Users\HP 6715B\AppData\Local\Temp\hsjclucevusvloqst.dll => Moved successfully.
"C:\Users\HP 6715B\AppData\Local\Temp\hsjclucevusvloqst.exe" => File/Directory not found.
C:\Users\HP 6715B\AppData\Local\Temp\Instprog.exe => Moved successfully.
C:\Users\HP 6715B\AppData\Local\Temp\Instprog901.exe => Moved successfully.
C:\Users\HP 6715B\AppData\Local\Temp\b70f3589-ab2a-43e6-8e34-78dc6abb3b05\CliSecureRT.dll => Moved successfully.

==== End of Fixlog ====

schrauber · 02.09.2013, 18:51

Ab jetzt im normalen Modus:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

GVU Trojaner-Befall, vermutlich V2.07. WIN7pro 32Bit

Log-Analyse und Auswertung: GVU Trojaner-Befall, vermutlich V2.07. WIN7pro 32Bit