Interpol Trojaner, Windows 7

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by SYSTEM on MININT-NHOCOLV on 13-10-2013 15:33:32
Running from H:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11369576 2010-08-10] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2586504 2010-08-05] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2011-06-07] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-15] (Apple Inc.)
HKU\Florian\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
HKU\Florian\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)
HKU\Florian\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\Florian\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3549528 2013-08-27] (Electronic Arts)
HKU\Tanja\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1tlfbg.lnk
ShortcutTarget: 1tlfbg.lnk -> C:\PROGRA~3\gbflt1.plz ()
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ShortcutTarget: ctfmon.lnk -> C:\ProgramData\lsass.exe (Microsoft Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Internet.lnk
ShortcutTarget: DSL Internet.lnk -> C:\Program Files (x86)\1&1\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk
ShortcutTarget: DSL Protect.lnk -> C:\Program Files (x86)\1&1\FwebProt.exe (AVM Berlin)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Tanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S2 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [247608 2010-11-21] ()
S2 IGDCTRL; C:\Program Files (x86)\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin)
S2 N360; C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe [130008 2011-04-16] (Symantec Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-05-31] (Symantec Corporation)
S2 serviceIEConfig; C:\Windows\SysWOW64\ieconfig_1und1_svc.exe [1053848 2012-04-10] ()
S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [60512 2013-10-10] (Microsoft Corporation)
S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [60512 2013-10-10] (Microsoft Corporation)
S2 WTGService; C:\Program Files (x86)\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-06-19] ()
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20130924.001\BHDrvx64.sys [1525848 2013-09-23] (Symantec Corporation)
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20130924.001\BHDrvx64.sys [1525848 2013-09-23] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-28] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131010.001\IDSvia64.sys [520280 2013-10-07] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131010.001\IDSvia64.sys [520280 2013-10-07] (Symantec Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-06-19] ()
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131010.007\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131010.007\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131010.007\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131010.007\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)
S3 SRTSP; C:\Windows\System32\Drivers\N360x64\0502020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\N360x64\0502020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\N360x64\0502020.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\N360x64\0502020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-06-21] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-13 15:33 - 2013-10-13 15:33 - 00000000 ____D C:\FRST
2013-10-10 11:55 - 2013-10-12 08:44 - 95025368 ____T C:\ProgramData\1tlfbg.pff
2013-10-10 11:55 - 2013-10-12 08:39 - 00000000 _____ C:\ProgramData\1tlfbg.ctrl
2013-10-10 11:55 - 2013-10-10 11:55 - 00115712 _____ C:\ProgramData\gbflt1.plz
2013-10-10 11:55 - 2013-10-10 11:55 - 00060512 ____T (Microsoft Corporation) C:\ProgramData\1tlfbg.pzz

==================== One Month Modified Files and Folders =======

2013-10-13 15:33 - 2013-10-13 15:33 - 00000000 ____D C:\FRST
2013-10-12 08:44 - 2013-10-10 11:55 - 95025368 ____T C:\ProgramData\1tlfbg.pff
2013-10-12 08:44 - 2010-11-19 11:16 - 00000000 ____D C:\Users\Florian\AppData\Local\CrashDumps
2013-10-12 08:40 - 2013-01-20 11:13 - 00000000 ___RD C:\Users\Florian\Dropbox
2013-10-12 08:40 - 2013-01-20 11:11 - 00000000 ____D C:\Users\Florian\AppData\Roaming\Dropbox
2013-10-12 08:40 - 2012-11-15 11:51 - 00000000 ____D C:\Program Files (x86)\Origin
2013-10-12 08:39 - 2013-10-10 11:55 - 00000000 _____ C:\ProgramData\1tlfbg.ctrl
2013-10-12 08:39 - 2011-04-26 11:12 - 00000000 ____D C:\Users\Florian\Tracing
2013-10-12 08:38 - 2012-01-01 11:38 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-12 08:38 - 2010-10-30 09:20 - 00000000 ____D C:\users\Florian
2013-10-12 08:37 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-12 08:37 - 2009-07-13 20:51 - 00211593 _____ C:\Windows\setupact.log
2013-10-12 00:44 - 2013-03-13 01:48 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-12 00:44 - 2013-03-13 01:48 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-12 00:44 - 2011-01-07 11:52 - 00000000 ____D C:\users\Tanja
2013-10-12 00:44 - 2010-08-31 20:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-10-12 00:44 - 2010-08-31 15:11 - 00000000 ____D C:\ProgramData\Norton
2013-10-12 00:44 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-10-12 00:43 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration
2013-10-10 17:04 - 2013-08-16 00:29 - 00000000 ____D C:\Windows\System32\MRT
2013-10-10 17:00 - 2010-08-31 15:01 - 01748722 _____ C:\Windows\WindowsUpdate.log
2013-10-10 16:48 - 2012-04-03 12:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-10 16:23 - 2012-01-01 11:38 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-10 11:55 - 2013-10-10 11:55 - 00115712 _____ C:\ProgramData\gbflt1.plz
2013-10-10 11:55 - 2013-10-10 11:55 - 00060512 ____T (Microsoft Corporation) C:\ProgramData\1tlfbg.pzz
2013-10-09 09:43 - 2010-11-03 21:32 - 00000000 ____D C:\Users\Florian\AppData\Roaming\Apple Computer
2013-10-09 09:18 - 2012-01-01 11:38 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-09 09:18 - 2012-01-01 11:38 - 00003856 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-09 08:53 - 2010-08-31 20:23 - 03672184 _____ C:\Windows\System32\perfh007.dat
2013-10-09 08:53 - 2010-08-31 20:23 - 01100778 _____ C:\Windows\System32\perfc007.dat
2013-10-09 08:53 - 2009-07-13 21:13 - 00006468 _____ C:\Windows\System32\PerfStringBackup.INI
2013-10-09 08:52 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-09 08:52 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-09 08:48 - 2012-04-03 12:16 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-09 08:48 - 2012-04-03 12:16 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-09 08:48 - 2012-04-03 12:16 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-05 11:21 - 2013-05-04 12:34 - 00000000 ____D C:\Users\Tanja\AppData\Local\CrashDumps
2013-10-05 11:00 - 2012-01-01 11:56 - 00002143 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-10-05 10:05 - 2011-09-23 07:08 - 00000000 ____D C:\Users\Tanja\Tracing
2013-10-05 10:04 - 2010-10-30 22:43 - 00479076 _____ C:\Windows\PFRO.log
2013-09-26 13:15 - 2013-08-02 11:12 - 00000000 ____D C:\Users\Florian\AppData\Roaming\Skype
2013-09-25 11:44 - 2012-10-17 11:11 - 00000000 ____D C:\Users\Public\Downloads\Norton

Files to move or delete:
====================
C:\ProgramData\1tlfbg.ctrl
C:\ProgramData\1tlfbg.pff
C:\ProgramData\dsgsdgdsgdsgw.pad
C:\ProgramData\gbflt1.plz
C:\ProgramData\lsass.exe


Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Florian\AppData\Local\Temp\ResetDevice.exe
C:\Users\Florian\AppData\Local\Temp\~tmf3076241574389329529.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

1
Restore point made on: 2013-10-10 17:00:42

==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 4060.61 MB
Available physical RAM: 3446.82 MB
Total Pagefile: 4058.76 MB
Available Pagefile: 3431.09 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:113 GB) (Free:12.44 GB) NTFS
Drive d: () (Fixed) (Total:167.1 GB) (Free:0 GB) NTFS
Drive f: (SAMSUNG_REC) (Fixed) (Total:17.89 GB) (Free:0.94 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (Lexar) (Removable) (Total:29.21 GB) (Free:22.46 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 8074A547)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=113 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=167 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=18 GB) - (Type=27)

========================================================
Disk: 1 (Size: 29 GB) (Disk ID: 672E53E2)
Partition 1: (Not Active) - (Size=29 GB) - (Type=0B)


LastRegBack: 2013-10-01 13:26

==================== End Of Log ============================