Windows Vista (Laptop) Gvu-Trojaner; vermutlich noch mehr

TGB87 · 18.09.2013, 14:22

Hallo liebes TB,

Habe mir vor 3-4 Wochen zum zweiten mal den GVU-Trojaner eingefangen.

Habe meinen Desktop zurück gewonnen durch die Nutzung, der auf Chip.de empfohlenen Kaspersky Rescue Disk. (Logs kann ich nicht finden, falls welche gemacht worden sind)
Konnte aber nach Empfehlung einige Dateien löschen und sollte einige in Quarantäne verschieben. Weis aber leider nicht mehr was ich da getan habe.

Kann meinen Laptop, glaube ich, immoment auch uneingeschrenkt nutzen. Habe nur Angst in irgendeiner Weise beobachtet zu werden. Sprich: Ich glaube das alle Vorgänge beobachtet werden. Auch jetzt grade.

Kann das Windows Sicherheitscenter nicht öffnen, sowie den Browserschutz von Avira.

Habe auch schon über eine komplett-Formatierung nachgedacht. Sinnvoll?

Habe die Funde von Avira zwar exportieren können, kann sie aber nicht finden um sie hier zu posten.

Danke schonmal in vorraus.

Hier die vier log-files:

1.
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:06 on 18/09/2013 (Tim)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

2.FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-09-2013 03
Ran by Tim at 2013-09-18 14:12:52
Running from C:\Users\Tim\Desktop
Boot Mode: Normal
==========================================================
 
 
==================== Installed Programs =======================
 
32 Bit HP CIO Components Installer (Version: 2.1.5)
7-Zip 9.20
Absolute Poker
Acer Arcade Deluxe (Version: 2.0.5412)
Acer eDataSecurity Management (Version: 3.0.3062)
Acer Empowering Technology (Version: 3.0.3006)
Acer ePower Management (Version: 3.0.3012)
Acer eSettings Management (Version: 3.0.3007)
Acer GameZone Console 2.0.1.1
Acer GridVista (Version: 2.72.317)
Acer Mobility Center Plug-In (Version: 3.0.3000)
Acer ScreenSaver (Version: 1.12.0506)
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe AIR (Version: 3.2.0.2070)
Adobe Flash Player 11 ActiveX (Version: 11.8.800.94)
Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7)
Adobe Shockwave Player 11.6 (Version: 11.6.1.629)
Agere Systems HDA Modem
Anti-Twin (Installation 15.09.2012)
Ask Toolbar (Version: 1.15.18.0)
Audacity 2.0.3 (Version: 2.0.3)
Avira Free Antivirus (Version: 13.0.0.4052)
Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.2.4.37268)
Backspin Billiards
Big Kahuna Reef
Bonjour (Version: 3.0.0.10)
Bricks of Egypt
Broadcom Gigabit Integrated Controller (Version: 11.11.03)
CCleaner (Version: 2.28)
CyberLink PowerDirector (Version: 6.5.3023)
eSobi v2 (Version: 2.0.3.000189)
Free Audio Converter version 5.0.22.128 (Version: 5.0.22.128)
Free Video Converter (Version: 1.0.1.4)
Full Tilt Poker.Eu (Version: 4.63.10.WIN.FullTilt.EU)
Google Chrome (Version: 29.0.1547.66)
Google Desktop (Version: 5.7.0808.07150)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4413.1752)
Google Update Helper (Version: 1.3.21.153)
Guitar Pro 5.2
Haali Media Splitter
Holdem Manager 2
HPSSupply (Version: 100.0.170.000)
HTC BMP USB Driver (Version: 1.0.5375)
HTC Sync (Version: 3.2.20)
IB Updater Service (Version: 3.0.5.4)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
Internet Explorer Toolbar 4.6 by SweetPacks (Version: 4.6.0004)
IPTInstaller (Version: 4.0.8)
Java 7 Update 7 (Version: 7.0.70)
Java Auto Updater (Version: 2.1.9.0)
JMicron JMB38X Flash Media Controller (Version: 1.00.10.04)
Launch Manager
LightScribe 1.4.142.1 (Version: 1.4.142.1)
Mahjong Escape Ancient China
Mahjongg Artifacts
MFC RunTime files (Version: 1.0.0)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2000 Premium (Version: 9.00.2816)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Works (Version: 08.05.0822)
MPEG4E VFW - H.264/MPEG-4 AVC codec (remove only)
MSVC80_x86_v2 (Version: 1.0.3.0)
MSVC90_x86 (Version: 1.0.1.2)
MSVCSetup (Version: 1.00.0000)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2758694) (Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (Version: 4.30.2100.0)
Norton Internet Security (Version: 16.0.0.125)
NTI Backup Now 5 (Version: 5.1.2.606)
NTI Backup Now Standard (Version: 5.1.2.606)
NTI Media Maker 8 (Version: 8.0.2.6329)
O&O MediaRecovery (Version: 4.1.1322)
Orion (Version: 2.0.1)
PhotoNow! (Version: 1.1.4619)
Pixum Fotobuch
Play65 (HKCU Version: Nov_21_2011_16_20_54)
PokerStars
PostgreSQL 8.4 (Version: 8.4)
Power Tab Editor 1.7
QuickTime (Version: 7.71.80.42)
Realtek High Definition Audio Driver (Version: 6.0.1.5612)
Shop for HP Supplies (Version: 10.0)
SweetIM for Messenger 3.7 (Version: 3.7.0005)
swMSM (Version: 12.0.0.1)
Synaptics Pointing Device Driver (Version: 10.2.4.0)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1)
Update Manager for SweetPacks 1.1 (Version: 1.1.0008)
VLC media player 1.0.5 (Version: 1.0.5)
WinRAR 4.20 (32-Bit) (Version: 4.20.0)
Zuma Deluxe
Zylom Games Player Plugin
 
==================== Restore Points =========================
 
13-08-2013 09:13:12 Windows Update
15-08-2013 00:50:51 Windows Update
17-08-2013 16:45:26 Geplanter Prüfpunkt
20-08-2013 16:38:35 Windows Update
24-08-2013 10:03:11 Windows Update
05-09-2013 17:54:36 Windows Update
05-09-2013 18:19:19 Windows Update
09-09-2013 10:47:36 Geplanter Prüfpunkt
14-09-2013 10:06:14 Geplanter Prüfpunkt
 
==================== Hosts content: ==========================
 
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
 
==================== Scheduled Tasks (whitelisted) =============
 
Task: {0F7F386C-9DFA-4B84-9856-7732F7567485} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-21] (Microsoft Corp.)
Task: {12CDCB5A-CD77-4035-AA3B-07F873DDE523} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2013-02-08] ()
Task: {13CE2DFD-75F3-4975-9B5A-D4456A19F547} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {26D9A740-DF57-4CA7-8326-12341E0D6B83} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-13] (Google Inc.)
Task: {31784498-666F-4CCE-A0A6-818EFBABD99C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2008-01-21] (Microsoft Corporation)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {40DE577F-6139-45E3-BDA7-98FABFB8ADA5} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe [2012-04-17] ()
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {59722FB8-6FA0-4E76-81EC-3FCED0780481} - System32\Tasks\RegistryDoktor => C:\Program Files\RegistryDoktor 4.1\RegistryDoktor.exe
Task: {776D270E-28FD-4450-83EC-D7E782FC395A} - System32\Tasks\Microsoft\Windows\WindowsBackup\CheckFull => C:\Windows\System32\sdclt.exe [2010-12-14] (Microsoft Corporation)
Task: {8A08BCB7-297C-4B18-BF1F-8C6E9B9CF23F} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\System32\sdclt.exe [2010-12-14] (Microsoft Corporation)
Task: {8B60A065-F9A8-4A6B-98B3-4AA572ABD0CB} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {9D05A594-F6C1-4075-AE82-342602E698E0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-24] (Adobe Systems Incorporated)
Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation)
Task: {CC98C3D3-2C3E-44AC-B4B8-37B6002A2631} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-13] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {F0C6DE9A-261B-41E2-B5B5-EC8C3BE2B935} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Tim => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (whitelisted) =============
 
2008-02-05 17:36 - 2008-06-11 11:21 - 00204800 _____ () C:\Windows\System32\SysHook.dll
2012-05-29 15:50 - 2012-05-29 15:50 - 00026968 ____R (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll
2013-01-31 18:20 - 2012-06-09 20:20 - 00167936 _____ (Alexander Roshal) C:\Program Files\WinRAR\rarext.dll
2008-05-14 18:04 - 2008-05-14 18:04 - 00304688 _____ (Egis Incorporated.) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSshellExt.dll
2008-09-02 09:09 - 2008-07-11 03:56 - 00274432 _____ (Intel Corporation) C:\Windows\system32\igfxrDEU.lrc
2013-05-27 10:56 - 2013-05-27 10:56 - 00382976 _____ () C:\Windows\System32\jmdp\lmrn.dll
2013-02-05 09:25 - 2013-02-05 09:25 - 00362029 _____ () C:\Windows\System32\jmdp\sqlite3.dll
2008-02-05 17:32 - 2008-02-05 17:32 - 00036864 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3006.0__4df5dcab8860d239\Framework.Utility.dll
2008-02-05 17:32 - 2008-02-05 17:32 - 00061440 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3006.0__3036420f80dd6947\Framework.Library.dll
2008-02-05 17:32 - 2008-02-05 17:32 - 00020480 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3006.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll
2008-05-14 18:04 - 2008-05-14 18:04 - 00254000 _____ (Egis Incorporated.) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ADMIN_CLASS_LIB.dll
2008-05-14 18:04 - 2008-05-14 18:04 - 00272944 _____ (Egis Incorporated) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\keyManager.dll
2008-05-14 18:04 - 2008-05-14 18:04 - 00551472 _____ (Egis inc.) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\CryptoAPI.dll
2008-05-14 18:05 - 2008-05-14 18:05 - 00240176 _____ (Egis Incorporated.) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
2008-05-14 18:05 - 2008-05-14 18:05 - 00199216 _____ (Egis Incorporated.) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDUtil.dll
2008-05-14 18:05 - 2008-05-14 18:05 - 00227888 _____ () C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ShowErrMsg.dll
2008-05-14 18:04 - 2008-05-14 18:04 - 00103472 _____ (Egis Incorporated) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSop.dll
2008-05-14 18:04 - 2008-05-14 18:04 - 04966960 _____ (Egis Incorporated.) C:\Program Files\Acer\Empowering Technology\eDataSecurity\EDS.Windows.Forms.dll
2008-04-28 10:49 - 2008-04-28 10:49 - 00003072 _____ () C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTrayLOC.dll
2008-06-05 11:07 - 2008-06-05 11:07 - 00163840 _____ (Synaptics, Inc.) C:\Windows\system32\Syncom.dll
2008-06-05 11:07 - 2008-06-05 11:07 - 00163840 _____ (Synaptics, Inc.) C:\Windows\system32\SynCOM.dll
2010-02-13 13:48 - 2008-06-05 11:07 - 00147456 _____ (Synaptics, Inc.) C:\Windows\system32\SynTPAPI.dll
2012-05-29 15:50 - 2012-05-29 15:50 - 00299352 ____R (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Messenger\mgUpdateSupport.dll
2012-05-29 15:50 - 2012-05-29 15:50 - 00098648 ____R (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Messenger\mgsimcommon.dll
2012-05-29 15:50 - 2012-05-29 15:50 - 00315736 ____R (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Messenger\mgcommon.dll
2012-05-29 15:50 - 2012-05-29 15:50 - 00036696 ____R (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Messenger\mgcommunication.dll
2012-05-29 15:50 - 2012-05-29 15:50 - 00168280 ____R (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Messenger\mghooking.dll
2012-05-29 15:50 - 2012-05-29 15:50 - 00074072 ____R (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Messenger\mgxml_wrapper.dll
2012-05-29 15:50 - 2012-05-29 15:50 - 00065880 ____R (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Messenger\mgconfig.dll
2012-08-15 19:08 - 2012-08-15 19:08 - 00650584 ____R (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Communicator\mgcommon.dll
2012-08-15 19:08 - 2012-08-15 19:08 - 00061272 _____ (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Communicator\mgxml_wrapper.dll
2012-08-15 19:08 - 2012-08-15 19:08 - 00041304 _____ (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Communicator\mgcommunication.dll
2012-08-15 19:08 - 2012-08-15 19:08 - 00071512 _____ (SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Communicator\mgsimcommon.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00103936 _____ () C:\Program Files\HTC\HTC Sync 3.0\OutputLog.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00176128 _____ (FutureDial) C:\Program Files\HTC\HTC Sync 3.0\UPCT_DB.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00516599 _____ () C:\Program Files\HTC\HTC Sync 3.0\sqlite3.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00151552 _____ (FutureDial) C:\Program Files\HTC\HTC Sync 3.0\PIMAccess.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00047104 _____ (FutureDial LTD.) C:\Program Files\HTC\HTC Sync 3.0\UpdateHelper.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00094208 _____ () C:\Program Files\HTC\HTC Sync 3.0\fdHttpd.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00389120 _____ () C:\Program Files\HTC\HTC Sync 3.0\HtcDetect.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00151552 _____ () C:\Program Files\HTC\HTC Sync 3.0\htcDisk.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00011776 _____ (FutureDial Ltd.) C:\Program Files\HTC\HTC Sync 3.0\AutoplayControl.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00172032 _____ () C:\Program Files\HTC\HTC Sync 3.0\htcDetectLegend.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00159744 _____ (TODO: <Company name>) C:\Program Files\HTC\HTC Sync 3.0\FileSyncEngine.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00176128 _____ (FutureDial Ltd.) C:\Program Files\HTC\HTC Sync 3.0\Utility.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00559244 _____ () C:\Program Files\HTC\HTC Sync 3.0\sqlite3.7.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00577536 _____ (FutureDial) C:\Program Files\HTC\HTC Sync 3.0\ItemSyncEngine.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00217088 _____ (FutureDial) C:\Program Files\HTC\HTC Sync 3.0\MsgSyncEngine.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 01515520 _____ () C:\Program Files\HTC\HTC Sync 3.0\Maps\R66Api.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00165376 _____ (ROUTE 66) C:\Program Files\HTC\HTC Sync 3.0\Maps\SyncEngine.API.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00510976 _____ (ROUTE 66) C:\Program Files\HTC\HTC Sync 3.0\Maps\SyncEngine.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00074752 _____ (ROUTE 66) C:\Program Files\HTC\HTC Sync 3.0\Maps\ApplicationUtils.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00027136 _____ (ROUTE 66) C:\Program Files\HTC\HTC Sync 3.0\Maps\DevicesCommon.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00029184 _____ (ROUTE 66) C:\Program Files\HTC\HTC Sync 3.0\Maps\DeviceScanning.dll
2012-04-17 15:05 - 2012-04-17 15:05 - 00249856 _____ (FutureDial) C:\Program Files\HTC\HTC Sync 3.0\HtcUpctApi.dll
2006-11-02 14:35 - 2006-11-02 14:35 - 00116736 _____ (Microsoft Corporation) C:\Windows\eHome\ehProxy.dll
2013-09-09 11:58 - 2013-09-02 22:35 - 04053456 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.66\pdf.dll
2013-09-09 11:58 - 2013-09-02 22:35 - 00410576 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll
2013-09-09 11:58 - 2013-09-02 22:35 - 01604560 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.66\ffmpegsumo.dll
2013-09-09 11:58 - 2013-09-02 22:35 - 13599184 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll
 
==================== Alternate Data Streams (whitelisted) ==========
 
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (09/18/2013 01:40:41 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/14/2013 10:17:17 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/14/2013 10:16:23 AM) (Source: PostgreSQL) (User: )
Description: 2013-09-14 10:16:23 CESTFATAL: the database system is starting up
 
Error: (09/10/2013 04:52:53 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/10/2013 04:52:46 PM) (Source: PostgreSQL) (User: )
Description: 2013-09-10 16:52:46 CESTFATAL: the database system is starting up
 
Error: (09/09/2013 11:11:34 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/09/2013 11:11:05 AM) (Source: PostgreSQL) (User: )
Description: 2013-09-09 11:11:05 CESTFATAL: the database system is starting up
 
Error: (09/05/2013 07:51:52 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/05/2013 07:51:25 PM) (Source: PostgreSQL) (User: )
Description: 2013-09-05 19:51:25 CESTFATAL: the database system is starting up
 
Error: (09/05/2013 03:22:02 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
System errors:
=============
Error: (09/14/2013 10:20:14 AM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{92ECCD73-3691-41A6-8106-001219538A-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
 
Error: (09/10/2013 04:56:53 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{92ECCD73-3691-41A6-8106-001219538A-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
 
Error: (09/09/2013 01:04:30 PM) (Source: Schannel) (User: )
Description: Eine SSL-Verbindungsanforderung wurde von einer Remoteclientanwendung übermittelt, aber keine der Verschlüsselungssammlungen, die von der Clientanwendung unterstützt werden, werden vom Server unterstützt. Die SSL-Verbindungsanforderung ist fehlgeschlagen.
 
Error: (09/09/2013 11:15:06 AM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{92ECCD73-3691-41A6-8106-001219538A-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
 
Error: (08/30/2013 06:29:18 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{92ECCD73-3691-41A6-8106-001219538A-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
 
Error: (08/30/2013 00:35:01 PM) (Source: Dhcp) (User: )
Description: Die IP-Adresslease 192.168.2.7 für die Netzwerkkarte mit der Netzwerkadresse 00234E51C108 wurde durch den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).
 
Error: (08/30/2013 02:20:43 AM) (Source: Dhcp) (User: )
Description: Die IP-Adresslease 192.168.2.101 für die Netzwerkkarte mit der Netzwerkadresse 00234E51C108 wurde durch den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).
 
Error: (08/30/2013 01:46:07 AM) (Source: Service Control Manager) (User: )
Description: AFD
avipbb
avkmgr
DfsC
NetBIOS
netbt
nsiproxy
PSched
RasAcd
rdbss
Smb
spldr
ssmdrv
tdx
Wanarpv6
 
Error: (08/30/2013 01:46:07 AM) (Source: Service Control Manager) (User: )
Description: NetzwerklistendienstNLA (Network Location Awareness)%%1068
 
Error: (08/30/2013 01:46:07 AM) (Source: Service Control Manager) (User: )
Description: NLA (Network Location Awareness)Netzwerkspeicher-Schnittstellendienst%%1068
 
 
Microsoft Office Sessions:
=========================
Error: (09/18/2013 01:40:41 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/14/2013 10:17:17 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/14/2013 10:16:23 AM) (Source: PostgreSQL)(User: )
Description: 2013-09-14 10:16:23 CESTFATAL: the database system is starting up
 
Error: (09/10/2013 04:52:53 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/10/2013 04:52:46 PM) (Source: PostgreSQL)(User: )
Description: 2013-09-10 16:52:46 CESTFATAL: the database system is starting up
 
Error: (09/09/2013 11:11:34 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/09/2013 11:11:05 AM) (Source: PostgreSQL)(User: )
Description: 2013-09-09 11:11:05 CESTFATAL: the database system is starting up
 
Error: (09/05/2013 07:51:52 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (09/05/2013 07:51:25 PM) (Source: PostgreSQL)(User: )
Description: 2013-09-05 19:51:25 CESTFATAL: the database system is starting up
 
Error: (09/05/2013 03:22:02 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 43%
Total physical RAM: 3000.13 MB
Available physical RAM: 1688.4 MB
Total Pagefile: 6234.52 MB
Available Pagefile: 4460.16 MB
Total Virtual: 2047.88 MB
Available Virtual: 1925.72 MB
 
==================== Drives ================================
 
Drive c: (ACER) (Fixed) (Total:111.44 GB) (Free:29.45 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: () (Fixed) (Total:111.44 GB) (Free:91.25 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 233 GB) (Disk ID: 125A3CA8)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=111 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=111 GB) - (Type=07 NTFS)
 
==================== End Of Log ============================

--- --- ---

3.
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-09-2013 03
Ran by Tim (administrator) on TIM-PC on 18-09-2013 14:10:41
Running from C:\Users\Tim\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
 
==================== Processes (Whitelisted) ===================
 
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Agere Systems) C:\Windows\system32\agrsmsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
() C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
(Egis Incorporated) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
() C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
() C:\Windows\system32\dmwu.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Acer\Mobility Center\MobilityService.exe
(NewTech InfoSystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
() C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
(PostgreSQL Global Development Group) c:\postgreSQL\bin\pg_ctl.exe
() C:\Program Files\Cyberlink\Shared files\RichVideo.exe
(PostgreSQL Global Development Group) c:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) c:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) c:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) c:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) c:\postgreSQL\bin\postgres.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
() C:\Windows\System32\jmdp\stij.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Acer Inc.) C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Egis Incorporated) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
() C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\QtZgAcer.EXE
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Messenger\SweetIM.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(SweetIM Technologies Ltd.) C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Ask) C:\Program Files\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Realtek Semiconductor Corp.) C:\Users\Tim\AppData\Local\Temp\RtkBtMnt.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [6111232 2008-04-28] (Realtek Semiconductor)
HKLM\...\Run: [ePower_DMC] - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [409600 2008-06-11] (Acer Inc.)
HKLM\...\Run: [eDataSecurity Loader] - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe [526896 2008-05-14] (Egis Incorporated)
HKLM\...\Run: [BkupTray] - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe [28672 2008-04-25] ()
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [178712 2008-04-15] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [ProductReg] - C:\Program Files\Acer\WR_PopUp\ProductReg.exe [6144 2008-09-23] (Acer)
HKLM\...\Run: [LManager] - C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE [821768 2008-07-02] (Dritek System Inc.)
HKLM\...\Run: [Google Desktop Search] - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [24064 2009-01-08] (Google)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1033512 2008-06-05] (Synaptics, Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
HKLM\...\Run: [SweetIM] - C:\Program Files\SweetIM\Messenger\SweetIM.exe [115032 2012-05-29] (SweetIM Technologies Ltd.)
HKLM\...\Run: [Sweetpacks Communicator] - C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe [231768 2012-08-15] (SweetIM Technologies Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [1644680 2013-02-08] (Ask)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [HTC Sync Loader] - C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe [651264 2012-04-17] ()
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
HKCU\...\Command Processor: <======= ATTENTION
MountPoints2: {3ea71e95-d843-11e2-92f9-00238b376914} - H:\HTC_Sync_Manager_PC.exe
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=5b933d0b-7128-4fdc-988b-9c33662cd8fb&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/home
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://go.web.de/tab2
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=5b933d0b-7128-4fdc-988b-9c33662cd8fb&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0109&m=aspire_7730z
URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=5b933d0b-7128-4fdc-988b-9c33662cd8fb&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=5b933d0b-7128-4fdc-988b-9c33662cd8fb&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}
SearchScopes: HKCU - {2DD5EC60-A03B-4882-97C8-26546B6EC508} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=718b07da-5053-4056-876e-c64f6ccb46b4&apn_sauid=D757540A-BB4F-4D01-9A70-B39B250CDD9F
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: SweetPacks Browser Helper - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
Toolbar: HKLM - No Name - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No File
Toolbar: HKLM - SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -&Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU -Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 
Chrome: 
=======
CHR HomePage: hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
CHR Extension: (YouTube) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 
========================== Services (Whitelisted) =================
 
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [81504 2008-01-16] ()
R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-03-21] ()
S3 GoogleDesktopManager-080708-050100; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [24064 2009-01-08] (Google)
R2 IBUpdaterService; C:\Windows\system32\dmwu.exe [1167152 2013-05-21] ()
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] ()
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072 2008-04-25] ()
R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
R2 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [272024 2007-01-09] ()
R2 postgresql-8.4; c:/postgreSQL/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "c:/postgreSQL/data" -w [x]
 
==================== Drivers (Whitelisted) ====================
 
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-28] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
S3 GMER; C:\Users\Tim\AppData\Roaming\Microsoft\system.sys [8704 2013-03-06] ()
R2 int15; C:\Windows\system32\drivers\int15.sys [15392 2008-03-21] (Acer, Inc.)
R2 NTIPPKernel; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [122368 2008-01-16] (Cyberlink Corp.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-02-25] (Avira GmbH)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [61424 2008-05-09] (Cyberlink Corp.)
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [x]
U1 usb3jrcv; \??\C:\Windows\system32\drivers\usb3jrcv.sys [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2013-09-18 14:10 - 2013-09-18 14:10 - 00000000 ____D C:\FRST
2013-09-18 14:08 - 2013-09-18 14:08 - 01083437 _____ (Farbar) C:\Users\Tim\Desktop\FRST.exe
2013-09-18 14:07 - 2013-09-18 14:07 - 00000000 _____ C:\Windows\setuperr.log
2013-09-18 14:07 - 2013-09-18 14:07 - 00000000 _____ C:\Windows\setupact.log
2013-09-18 14:06 - 2013-09-18 14:06 - 00000468 _____ C:\Users\Tim\Desktop\defogger_disable.log
2013-09-18 14:06 - 2013-09-18 14:06 - 00000000 _____ C:\Users\Tim\defogger_reenable
2013-09-18 14:04 - 2013-09-18 14:04 - 00050477 _____ C:\Users\Tim\Desktop\Defogger.exe
2013-09-18 13:39 - 2013-09-18 13:39 - 00000446 _____ C:\Windows\PFRO.log
2013-09-05 20:08 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
 
==================== One Month Modified Files and Folders =======
 
2013-09-18 14:10 - 2013-09-18 14:10 - 00000000 ____D C:\FRST
2013-09-18 14:08 - 2013-09-18 14:08 - 01083437 _____ (Farbar) C:\Users\Tim\Desktop\FRST.exe
2013-09-18 14:07 - 2013-09-18 14:07 - 00000000 _____ C:\Windows\setuperr.log
2013-09-18 14:07 - 2013-09-18 14:07 - 00000000 _____ C:\Windows\setupact.log
2013-09-18 14:07 - 2006-11-02 14:47 - 00002000 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-18 14:07 - 2006-11-02 14:47 - 00002000 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-18 14:06 - 2013-09-18 14:06 - 00000468 _____ C:\Users\Tim\Desktop\defogger_disable.log
2013-09-18 14:06 - 2013-09-18 14:06 - 00000000 _____ C:\Users\Tim\defogger_reenable
2013-09-18 14:06 - 2012-09-24 16:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-18 14:06 - 2009-01-10 20:02 - 00000000 ____D C:\Users\Tim
2013-09-18 14:04 - 2013-09-18 14:04 - 00050477 _____ C:\Users\Tim\Desktop\Defogger.exe
2013-09-18 13:51 - 2011-09-13 23:56 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-18 13:50 - 2012-03-05 16:43 - 01590701 _____ C:\Windows\WindowsUpdate.log
2013-09-18 13:42 - 2013-06-15 23:48 - 00000000 ____D C:\Users\Tim\AppData\Local\Htc
2013-09-18 13:39 - 2013-09-18 13:39 - 00000446 _____ C:\Windows\PFRO.log
2013-09-18 13:39 - 2011-09-13 23:56 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-18 13:39 - 2008-02-05 17:55 - 00000147 _____ C:\Windows\system32\agent.log
2013-09-18 13:39 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-14 16:07 - 2006-11-02 15:01 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-09 13:03 - 2009-01-12 19:36 - 00000000 ____D C:\Users\Tim\AppData\Local\PokerStars.EU
2013-09-09 11:59 - 2012-11-15 19:43 - 00001935 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-05 20:12 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-05 20:05 - 2008-01-21 09:16 - 01540222 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-05 19:59 - 2013-02-25 20:00 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-05 19:59 - 2013-02-25 20:00 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-24 12:07 - 2012-09-24 16:20 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-08-24 12:07 - 2012-09-24 16:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
 
Files to move or delete:
====================
ZeroAccess:
C:\Users\Tim\AppData\Local\Google\Desktop\Install
C:\Users\Tim\5423241.exe
 
 
Some content of TEMP:
====================
C:\Users\Tim\AppData\Local\Temp\RtkBtMnt.exe
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 
LastRegBack: 2013-09-18 13:46
 
==================== End Of Log ============================

--- --- ---

4.
GMER Logfile:

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-18 14:39:15
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD25 rev.11.0 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Tim\AppData\Local\Temp\kxtdipow.sys
 
 
---- System - GMER 2.1 ----
 
SSDT 8C9F83E6 ZwCreateSection
SSDT 8C9F83F0 ZwRequestWaitReplyPort
SSDT 8C9F83EB ZwSetContextThread
SSDT 8C9F83F5 ZwSetSecurityObject
SSDT 8C9F83FA ZwSystemDebugControl
SSDT 8C9F8387 ZwTerminateProcess
 
---- Kernel code sections - GMER 2.1 ----
 
.text ntkrnlpa.exe!KeSetEvent + 215 824EE860 4 Bytes [E6, 83, 9F, 8C]
.text ntkrnlpa.exe!KeSetEvent + 539 824EEB84 4 Bytes [F0, 83, 9F, 8C]
.text ntkrnlpa.exe!KeSetEvent + 56D 824EEBB8 4 Bytes [EB, 83, 9F, 8C]
.text ntkrnlpa.exe!KeSetEvent + 5D1 824EEC1C 4 Bytes [F5, 83, 9F, 8C]
.text ntkrnlpa.exe!KeSetEvent + 619 824EEC64 4 Bytes [FA, 83, 9F, 8C]
.text ... 
C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl entry point in "" section [0xB013241C]
.clc C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl unknown last code section [0xB0133000, 0x1000, 0xE0000020]
 
---- Devices - GMER 2.1 ----
 
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
 
---- Disk sectors - GMER 2.1 ----
 
Disk \Device\Harddisk0\DR0 unknown MBR code
 
---- EOF - GMER 2.1 ----

--- --- ---

Ende der Durchsage.

Windows Vista (Laptop) Gvu-Trojaner; vermutlich noch mehr

Log-Analyse und Auswertung: Windows Vista (Laptop) Gvu-Trojaner; vermutlich noch mehr

Windows Vista (Laptop) Gvu-Trojaner; vermutlich noch mehr

Ähnliche Themen: Windows Vista (Laptop) Gvu-Trojaner; vermutlich noch mehr