| |
| |||||||
Log-Analyse und Auswertung: GVU Virus auf Asus Netbook mit Win 7 starter / USB Start nicht möglichWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
07.09.2013, 13:21
| #1 |
| |  GVU Virus auf Asus Netbook mit Win 7 starter / USB Start nicht möglich Hallo, das Netbook meiner Freundin hat den GVU Virus. Sie hat ihn seit gestern bzw. gestern bemerkt. Der Rechner sperrt ca. 1 Minute nachdem er hochgefahren wurde. Hardware / Software: Asus Eee PC 1005PE mit Windows 7 Starter (32Bit) Bisher versucht: Ich hab mir HitmanPro Kickstart auf einen USB Stick installiert. Dieser lässt sich aber trotz der entsprechenden Änderungen im Bios nicht starten. Mit dem Programm komme ich derzeit nicht weiter. Daher hab ich mir mittels FRST ein Logfile erstellt: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-09-2013 01
Ran by SYSTEM on MININT-A5I2ESC on 07-09-2013 13:59:00
Running from E:\
Windows 7 Starter (X86) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [HotkeyMon] - C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe [100328 2009-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [HotkeyService] - C:\Program Files\EeePC\HotkeyService\HotkeyService.exe [1021424 2009-10-16] (ASUSTeK Computer Inc.)
HKLM\...\Run: [SuperHybridEngine] - C:\Program Files\EeePC\SHE\SuperHybridEngine.exe [413688 2009-10-26] (ASUSTeK Computer Inc.)
HKLM\...\Run: [Eee Docking] - C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [414384 2009-11-17] ()
HKLM\...\Run: [LiveUpdate] - C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe [803304 2009-08-27] ()
HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [83240 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [ASUS Screen Saver Protector] - C:\Windows\AsScrPro.exe [3058304 2010-01-06] (ASUS)
HKLM\...\Run: [EeeSplendidAgent] - C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe [104960 2009-12-29] ()
HKLM\...\Run: [UCam_Menu] - C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7744032 2009-09-29] (Realtek Semiconductor)
HKLM\...\Run: [ASUSPRP] - C:\Program Files\ASUS\APRP\APRP.EXE [2018032 2010-01-06] (ASUSTek Computer Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253672 2011-01-07] (Sun Microsystems, Inc.)
HKLM\...\Run: [ASUSWebStorage] - C:\Program Files\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM\...\Run: [hpqSRMon] - C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKU\Default\...\RunOnce: [Reboot] - AsusSender.exe C:\Windows\AP\Reboot.exe 40 [x]
HKU\Default User\...\RunOnce: [Reboot] - AsusSender.exe C:\Windows\AP\Reboot.exe 40 [x]
Startup: C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2lflrja.lnk
ShortcutTarget: b2lflrja.lnk -> C:\PROGRA~2\ajrlfl2b.plz (Microsoft Corporation)
========================== Services (Whitelisted) =================
S2 AsusService; C:\Windows\System32\AsusService.exe [219136 2009-08-18] ()
S2 Winmgmt; C:\PROGRA~2\ajrlfl2b.plz [222166 2013-09-06] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S1 AsUpIO; C:\Windows\System32\drivers\AsUpIO.sys [11448 2009-07-05] ()
S3 asushwio; C:\windows\system32\drivers\asushwio.sys [6144 1999-03-06] ()
S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-13] (Microsoft Corporation)
S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [13880 2009-07-20] ( )
S3 btwaudio; system32\drivers\btwaudio.sys [x]
S3 btwavdt; \SystemRoot\system32\DRIVERS\btwavdt.sys [x]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [x]
S3 btwrchid; \SystemRoot\system32\DRIVERS\btwrchid.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-06 04:57 - 2013-09-06 14:19 - 00000000 _____ C:\ProgramData\b2lflrja.ctrl
2013-09-06 04:57 - 2013-09-06 08:21 - 95025368 ____T C:\ProgramData\b2lflrja.pff
2013-09-06 04:56 - 2013-09-06 04:56 - 00222166 _____ (Microsoft Corporation) C:\ProgramData\ajrlfl2b.plz
2013-09-06 04:20 - 2013-09-06 04:25 - 43790848 _____ (o2 (Germany) GmbH & Co.OHG) C:\Users\Alex\Desktop\dsl-connection-manager-win-1-1.exe
2013-08-15 08:15 - 2013-07-25 19:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-15 08:15 - 2013-07-25 19:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-15 08:15 - 2013-07-25 19:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-15 08:15 - 2013-07-25 19:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-15 08:15 - 2013-07-25 19:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-15 08:15 - 2013-07-25 19:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-15 08:15 - 2013-07-25 19:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-15 08:15 - 2013-07-25 19:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-15 08:15 - 2013-07-25 19:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-15 08:15 - 2013-07-25 19:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-15 08:15 - 2013-07-25 19:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-15 08:15 - 2013-07-25 19:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-15 08:15 - 2013-07-25 19:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-15 08:15 - 2013-07-25 19:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-15 08:15 - 2013-07-25 18:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-15 08:15 - 2013-07-25 17:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-15 05:15 - 2013-07-08 20:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-15 05:14 - 2013-07-25 00:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-15 05:14 - 2013-07-08 21:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-08-15 05:14 - 2013-07-08 21:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-08-15 05:14 - 2013-07-08 20:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-08-15 05:14 - 2013-07-08 20:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-15 05:14 - 2013-07-08 20:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-15 05:14 - 2013-07-08 20:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-15 05:14 - 2013-07-08 20:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-15 05:14 - 2013-07-05 21:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-15 05:13 - 2013-07-18 17:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-15 05:12 - 2013-06-14 19:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-14 23:28 - 2013-08-15 01:40 - 00638464 ____H C:\Users\Alex\Desktop\~WRL0001.tmp
==================== One Month Modified Files and Folders =======
2013-09-07 13:58 - 2013-09-07 13:58 - 00000000 ____D C:\FRST
2013-09-07 03:32 - 2009-07-13 20:39 - 00113264 _____ C:\Windows\setupact.log
2013-09-06 14:19 - 2013-09-06 04:57 - 00000000 _____ C:\ProgramData\b2lflrja.ctrl
2013-09-06 08:36 - 2010-05-09 05:40 - 01228797 _____ C:\Windows\WindowsUpdate.log
2013-09-06 08:21 - 2013-09-06 04:57 - 95025368 ____T C:\ProgramData\b2lflrja.pff
2013-09-06 05:08 - 2009-07-13 20:34 - 00009696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-06 05:08 - 2009-07-13 20:34 - 00009696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-06 04:56 - 2013-09-06 04:56 - 00222166 _____ (Microsoft Corporation) C:\ProgramData\ajrlfl2b.plz
2013-09-06 04:25 - 2013-09-06 04:20 - 43790848 _____ (o2 (Germany) GmbH & Co.OHG) C:\Users\Alex\Desktop\dsl-connection-manager-win-1-1.exe
2013-08-16 01:10 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\rescache
2013-08-16 00:53 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-15 23:11 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-08-15 08:26 - 2010-01-06 13:56 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-15 08:21 - 2009-07-24 23:50 - 01520734 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-15 01:40 - 2013-08-14 23:28 - 00638464 ____H C:\Users\Alex\Desktop\~WRL0001.tmp
2013-08-14 23:12 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\NDF
Files to move or delete:
====================
C:\Users\Alex\AppData\Local\Temp\aol-messaging_toolbarE735.exe
C:\Users\Alex\AppData\Local\Temp\AskSLib.dll
C:\Users\Alex\AppData\Local\Temp\atl80.dll
C:\Users\Alex\AppData\Local\Temp\contentDATs.exe
C:\Users\Alex\AppData\Local\Temp\DataCard_Setup.exe
C:\Users\Alex\AppData\Local\Temp\ffunzip.exe
C:\Users\Alex\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\Alex\AppData\Local\Temp\GLF9737.tmp.ConduitEngineSetup.exe
C:\Users\Alex\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe
C:\Users\Alex\AppData\Local\Temp\gpiwoykpuihhgbanjlt.bfg
C:\Users\Alex\AppData\Local\Temp\jreD377.exe
C:\Users\Alex\AppData\Local\Temp\mfc80.dll
C:\Users\Alex\AppData\Local\Temp\mfc80u.dll
C:\Users\Alex\AppData\Local\Temp\mfcm80.dll
C:\Users\Alex\AppData\Local\Temp\mfcm80u.dll
C:\Users\Alex\AppData\Local\Temp\msvcm80.dll
C:\Users\Alex\AppData\Local\Temp\msvcp80.dll
C:\Users\Alex\AppData\Local\Temp\msvcr71.dll
C:\Users\Alex\AppData\Local\Temp\msvcr80.dll
C:\Users\Alex\AppData\Local\Temp\prxGLF9737.tmp.tbDVDV.dll
C:\Users\Alex\AppData\Local\Temp\ResetDevice.exe
C:\Users\Alex\AppData\Local\Temp\SCC.dll
C:\Users\Alex\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Alex\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Alex\AppData\Local\Temp\Sony_Ericsson_Update_Engine_Setup-2.11.1.9.exe
C:\Users\Alex\AppData\Local\Temp\tbDVDV.dll
C:\Users\Alex\AppData\Local\Temp\TmDbg32.dll
C:\Users\Alex\AppData\Local\Temp\Uninstall.exe
C:\Users\Alex\AppData\Local\Temp\vsinit.dll
C:\Users\Alex\AppData\Local\Temp\vsutil.dll
C:\Users\Alex\AppData\Local\Temp\zauninst.exe
C:\Users\Alex\AppData\Local\Temp\{27A9320E-98B6-4A97-91FC-1AC006BC5968}-GoogleUpdateSetup.exe
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-07-12 03:40:48
Restore point made on: 2013-07-20 21:58:15
Restore point made on: 2013-07-25 23:18:29
Restore point made on: 2013-08-15 02:07:45
Restore point made on: 2013-08-15 05:05:55
Restore point made on: 2013-08-15 08:14:46
Restore point made on: 2013-09-06 05:26:16
==================== Memory info ===========================
Percentage of memory in use: 43%
Total physical RAM: 1014.18 MB
Available physical RAM: 578 MB
Total Pagefile: 1014.18 MB
Available Pagefile: 643.98 MB
Total Virtual: 2047.88 MB
Available Virtual: 1944.09 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:100 GB) (Free:57.16 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:122.87 GB) (Free:122.62 GB) NTFS
Drive e: (HITMANPRO) (Removable) (Total:14.91 GB) (Free:14.9 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: ABF319E9)
Partition 1: (Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=123 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10 GB) - (Type=1B)
Partition 4: (Not Active) - (Size=17 MB) - (Type=EF)
========================================================
Disk: 1 (Size: 15 GB) (Disk ID: DE16F1AD)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)
LastRegBack: 2013-09-06 05:18
==================== End Of Log ============================
Ich bin für jede Hilfe sehr dankbar. Viele Grüße Chewie |
| Themen zu GVU Virus auf Asus Netbook mit Win 7 starter / USB Start nicht möglich |
| adobe, association, asus, bios, computer, desktop, eeepc, explorer, farbar, farbar recovery scan tool, google, logfile, microsoft, nicht möglich, programm, realtek, registry, scan, services.exe, software, stick, svchost.exe, system, temp, usb, usb stick, virus, windows, winlogon.exe |
Baum-Darstellung