GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by SYSTEM on MININT-1QF141C on 07-10-2013 15:39:33
Running from H:\
WIN_7 (X86) OS Language: German Standard
Boot Mode: Recovery
Attention: Could not load system hive.
==================== Registry (Whitelisted) ==================

ATTENTION: Software hive is not loaded.


========================== Services (Whitelisted) =================


==================== Drivers (Whitelisted) ====================


========================== Drivers MD5 =======================


==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-07 15:35 - 2013-10-07 15:35 - 00000000 ____D C:\FRST
2013-10-03 21:10 - 2013-10-03 21:10 - 01084739 _____ C:\Users\Benutzername\AppData\Local\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084711 _____ C:\ProgramData\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084674 _____ C:\Users\Benutzername\AppData\Roaming\2433f433
2013-10-02 07:43 - 2013-10-02 07:43 - 00000000 ____D C:\Users\Benutzername\AppData\Local\KB2815875
2013-09-12 06:59 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-12 06:58 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-12 06:58 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-12 06:58 - 2013-08-10 04:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-09-12 06:58 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-09-12 06:58 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-09-12 05:22 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-09-12 05:22 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-09-12 05:21 - 2013-08-08 02:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-09-12 05:21 - 2013-08-05 02:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2013-09-12 05:21 - 2013-08-02 02:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2013-09-12 05:21 - 2013-08-02 02:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-09-12 05:21 - 2013-08-02 02:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 01:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2013-09-12 05:20 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

==================== One Month Modified Files and Folders =======

2013-10-07 15:35 - 2013-10-07 15:35 - 00000000 ____D C:\FRST
2013-10-07 14:10 - 2011-10-16 18:45 - 01446123 _____ C:\Windows\WindowsUpdate.log
2013-10-07 10:20 - 2009-07-14 05:34 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:20 - 2009-07-14 05:34 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:12 - 2013-07-21 15:46 - 00065536 _____ C:\Windows\System32\Ikeext.etl
2013-10-07 10:12 - 2009-07-14 05:39 - 00156841 _____ C:\Windows\setupact.log
2013-10-07 10:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\tracing
2013-10-03 21:10 - 2013-10-03 21:10 - 01084739 _____ C:\Users\Benutzername\AppData\Local\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084711 _____ C:\ProgramData\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084674 _____ C:\Users\Benutzername\AppData\Roaming\2433f433
2013-10-03 11:58 - 2013-03-12 12:29 - 00491150 _____ C:\test.xml
2013-10-03 11:23 - 2012-01-14 13:40 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Windows Live
2013-10-02 07:43 - 2013-10-02 07:43 - 00000000 ____D C:\Users\Benutzername\AppData\Local\KB2815875
2013-10-02 06:55 - 2011-10-16 19:50 - 00015392 _____ C:\Windows\PFRO.log
2013-10-02 06:55 - 2011-10-16 19:10 - 00000000 ____D C:\Program Files\McAfee
2013-09-27 08:47 - 2011-10-17 08:59 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Skype
2013-09-23 13:57 - 2010-09-24 21:49 - 01498742 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-23 13:47 - 2013-07-17 14:55 - 00000000 ____D C:\Users\Benutzername\Desktop\15 07 2013
2013-09-20 16:09 - 2013-02-10 12:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-09-20 16:09 - 2013-02-10 12:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-09-20 15:26 - 2012-12-20 10:38 - 00927744 ___SH C:\Users\Benutzername\Desktop\Thumbs.db
2013-09-18 16:23 - 2013-03-10 21:17 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Bico
2013-09-18 12:13 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
2013-09-17 15:18 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-09-16 23:40 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-13 10:11 - 2011-10-21 13:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 11:37 - 2009-07-14 05:33 - 00434488 _____ C:\Windows\System32\FNTCACHE.DAT
2013-09-12 11:34 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-09-12 06:55 - 2013-07-21 21:51 - 00000000 ____D C:\Windows\System32\MRT
2013-09-12 06:50 - 2011-10-23 09:11 - 76725432 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a

Some content of TEMP:
====================
C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll
C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll
C:\Users\Benutzername\AppData\Local\Temp\converter.exe
C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe
C:\Users\Benutzername\AppData\Local\Temp\generka.exe
C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Benutzername\AppData\Local\Temp\jre7.exe
C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe
C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe
C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll
C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe
C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll
C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll
C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe
C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll
C:\Users\Benutzername\AppData\Local\Temp\SCC.dll
C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll
C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll
C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll
C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: <===== ATTENTION!
HKLM\...\exefile\DefaultIcon:  <===== ATTENTION!
HKLM\...\exefile\open\command:  <===== ATTENTION!

==================== Restore Points  =========================

39
Restore point made on: 2013-08-26 20:26:00
Restore point made on: 2013-08-28 09:08:52
Restore point made on: 2013-08-31 09:23:28
Restore point made on: 2013-08-31 11:54:10
Restore point made on: 2013-09-02 08:03:01
Restore point made on: 2013-09-03 12:02:43
Restore point made on: 2013-09-04 08:01:16
Restore point made on: 2013-09-06 11:44:52
Restore point made on: 2013-09-09 10:04:46
Restore point made on: 2013-09-12 05:00:12
Restore point made on: 2013-09-12 06:50:06
Restore point made on: 2013-09-13 10:06:06
Restore point made on: 2013-09-15 14:59:42
Restore point made on: 2013-09-16 21:32:10
Restore point made on: 2013-09-16 23:54:08
Restore point made on: 2013-09-18 08:02:24
Restore point made on: 2013-09-18 08:19:08
Restore point made on: 2013-09-18 09:00:57
Restore point made on: 2013-09-20 14:45:14
Restore point made on: 2013-09-20 21:23:51
Restore point made on: 2013-09-21 16:52:58
Restore point made on: 2013-09-26 16:41:26
Restore point made on: 2013-09-26 18:03:20
Restore point made on: 2013-09-27 07:55:41
Restore point made on: 2013-09-28 17:06:52
Restore point made on: 2013-09-29 19:34:30
Restore point made on: 2013-10-02 07:03:07
Restore point made on: 2013-10-03 10:52:28
Restore point made on: 2013-10-03 12:09:15
Restore point made on: 2013-10-04 11:01:03
Restore point made on: 2013-10-04 11:02:13
Restore point made on: 2013-10-07 10:17:25
Restore point made on: 2013-10-07 11:02:08
Restore point made on: 2013-10-07 14:10:42
Restore point made on: 2013-10-07 14:10:48
Restore point made on: 2013-10-07 14:10:50
Restore point made on: 2013-10-07 14:10:54
Restore point made on: 2013-10-07 14:10:56
Restore point made on: 2013-10-07 14:10:58

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=Y:
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {default}
resumeobject            {6b41e77b-f826-11e0-ae2c-8723679cab14}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {current}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {6b41e77b-f826-11e0-ae2c-8723679cab14}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {6b41e77b-f826-11e0-ae2c-8723679cab14}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
pae                     Yes
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=Y:
path                    \boot\memtest.exe
description             Windows-Speicherdiagnose
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                 Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                 {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {6b41e77e-f826-11e0-ae2c-8723679cab14}
description             Ramdisk Options
ramdisksdidevice        partition=E:
ramdisksdipath          \Recovery\WindowsRE\boot.sdi


==================== Memory info =========================== 

Percentage of memory in use: 21%
Total physical RAM: 1642.9 MB
Available physical RAM: 1292.73 MB
Total Pagefile: 1642.9 MB
Available Pagefile: 1291.9 MB
Total Virtual: 2047.88 MB
Available Virtual: 1943.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:287.64 GB) (Free:217.95 GB) NTFS
Drive e: (Recovery) (Fixed) (Total:10.36 GB) (Free:1.11 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (SWIVEL) (Removable) (Total:7.46 GB) (Free:0.71 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 89BA91F6)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=288 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: ECC810A9)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0C)


LastRegBack: 2013-10-07 10:44

==================== End Of Log ============================