Windows Vista - Interpol Trojaner mit Sperrschirm

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=43151618479b99488e63655d0f14b53d
# engine=15590
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-22 09:11:45
# local_time=2013-10-22 11:11:45 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5121 16776573 100 96 135572256 197205007 0 0
# compatibility_mode=5892 16776573 100 95 80736357 220009077 0 0
# scanned=141524
# found=1
# cleaned=0
# scan_time=5510
sh=A1699F1D0593A448E2C0C780BFE74E48BE93DF15 ft=1 fh=321774e882ff7911 vn="Win32/TrojanDownloader.Zurgop.AV trojan" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\18abbe2e-2958dc32"
         

 UNSUPPORTED OPERATING SYSTEM! ABORTED!
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-10-2013
Ran by Andreas (administrator) on ANDREAS-PC on 22-10-2013 23:56:30
Running from C:\Users\Andreas\Downloads
Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(McAfee, Inc.) c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
(McAfee, Inc.) C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
(McAfee, Inc.) C:\Program Files\McAfee\MPF\MPFSrv.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSK\MskSrver.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba TEMPRO\TempoSVC.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
(Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(McAfee, Inc.) C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
(McAfee, Inc.) c:\PROGRA~1\mcafee.com\agent\mcagent.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
(TOSHIBA) C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(McAfee, Inc.) C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(TOSHIBA) C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(McAfee, Inc.) c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
(McAfee, Inc.) c:\PROGRA~1\mcafee\msc\mcuimgr.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Program Files\windows defender\MSASCui.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Farbar) C:\Users\Andreas\Downloads\FRST (1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)
HKLM\...\Run: [NDSTray.exe] - NDSTray.exe
HKLM\...\Run: [Google Desktop Search] - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-08-08] (Google)
HKLM\...\Run: [Google EULA Launcher] - c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe [20480 2008-05-28] ( )
HKLM\...\Run: [Toshiba TEMPO] - C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe [103824 2008-04-24] (Toshiba Europe GmbH)
HKLM\...\Run: [topi] - C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [581632 2007-07-10] (TOSHIBA)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [6037504 2008-04-08] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [431456 2008-01-17] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [509816 2008-06-24] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [716800 2008-05-09] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe [574864 2008-01-11] (Toshiba)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKCU\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2008-04-24] (TOSHIBA)
HKCU\...\Run: [Update Service] - C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe [19456 2009-08-09] (Teknum Systems AS)
HKCU\...\Run: [Treepack] - C:\Users\Andreas\AppData\Roaming\Servpack\atladv.exe [1 2011-06-19] ()
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2008-04-24] (TOSHIBA)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2008-04-24] (TOSHIBA)
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll [ 2010-08-08] (Google)
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: McAfee Phishing Filter - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll ()
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll (McAfee, Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} https://webmail.kendle.com/iNotes6W.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 195.234.128.7 195.234.128.16

========================== Services (Whitelisted) =================

R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2008-04-17] (TOSHIBA CORPORATION)
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-08-08] (Google)
S3 jswpsapi; C:\Program Files\Jumpstart\jswpsapi.exe [954368 2008-04-16] (Atheros Communications, Inc.)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 mcmscsvc; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [767976 2008-01-09] (McAfee, Inc.)
R2 McNASvc; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2458128 2008-01-25] (McAfee, Inc.)
S3 McODS; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [378184 2007-11-07] (McAfee, Inc.)
R2 McProxy; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [359248 2007-08-15] (McAfee, Inc.)
R2 McShield; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [144704 2007-07-24] (McAfee, Inc.)
R3 McSysmon; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [695624 2007-12-05] (McAfee, Inc.)
R2 MpfService; C:\Program Files\McAfee\MPF\MPFSrv.exe [856864 2007-07-18] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\McAfee\MSK\MskSrver.exe [23880 2007-11-26] (McAfee, Inc.)
R2 TempoMonitoringService; C:\Program Files\Toshiba TEMPRO\TempoSVC.exe [99720 2008-04-24] (Toshiba Europe GmbH)
R2 TOSHIBA SMART Log Service; C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [126976 2008-02-06] (TOSHIBA Corporation)
R2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-23] (Ulead Systems, Inc.)

==================== Drivers (Whitelisted) ====================

R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [79304 2007-11-22] (McAfee, Inc.)
R3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [35240 2007-11-22] (McAfee, Inc.)
R1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [201320 2007-11-22] (McAfee, Inc.)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [33832 2007-11-22] (McAfee, Inc.)
R3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [40488 2007-12-02] (McAfee, Inc.)
R1 MPFP; C:\Windows\System32\Drivers\Mpfp.sys [125728 2007-07-13] (McAfee, Inc.)
S3 USB_RNDIS; C:\Windows\System32\DRIVERS\usb8023.sys [15872 2013-02-12] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Andreas\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-22 23:55 - 2013-10-22 23:55 - 01087503 _____ (Farbar) C:\Users\Andreas\Downloads\FRST (1).exe
2013-10-22 23:37 - 2013-10-22 23:37 - 00000041 _____ C:\Users\Andreas\Desktop\checkup.txt
2013-10-22 23:36 - 2013-10-22 23:35 - 00891167 _____ C:\Users\Andreas\Desktop\SecurityCheck.exe
2013-10-22 21:42 - 2013-09-03 14:35 - 00238872 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-10-21 20:12 - 2013-10-21 20:12 - 00000713 _____ C:\Users\Andreas\Desktop\JRT.txt
2013-10-21 20:07 - 2013-10-21 20:07 - 00000000 ____D C:\Windows\ERUNT
2013-10-21 20:05 - 2013-10-21 20:04 - 01033335 _____ (Thisisu) C:\Users\Andreas\Desktop\JRT.exe
2013-10-21 19:38 - 2013-10-21 19:40 - 00000000 ____D C:\AdwCleaner
2013-10-21 19:36 - 2013-10-21 19:35 - 01060070 _____ C:\Users\Andreas\Desktop\adwcleaner.exe
2013-10-21 18:22 - 2013-10-21 18:22 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Malwarebytes
2013-10-21 18:21 - 2013-10-21 18:21 - 00000911 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-21 18:21 - 2013-10-21 18:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-21 18:21 - 2013-10-21 18:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-21 18:21 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-21 03:12 - 2013-09-22 12:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-21 03:12 - 2013-09-22 12:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-21 03:12 - 2013-09-22 12:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-21 03:12 - 2013-09-22 12:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-21 03:12 - 2013-09-22 12:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-21 03:12 - 2013-09-22 12:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-21 03:12 - 2013-09-22 12:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-21 03:12 - 2013-09-22 12:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-21 03:12 - 2013-09-22 12:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-21 03:12 - 2013-09-22 12:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-21 03:12 - 2013-09-22 12:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-21 03:12 - 2013-09-22 12:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-21 03:12 - 2013-09-22 12:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-21 03:12 - 2013-09-22 12:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-21 03:12 - 2013-09-22 12:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-21 03:12 - 2013-09-22 11:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-20 20:31 - 2013-10-20 20:31 - 00011367 _____ C:\ComboFix.txt
2013-10-20 20:14 - 2013-10-20 20:31 - 00000000 ____D C:\ComboFix
2013-10-20 19:58 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-20 19:58 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-20 19:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-20 19:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-20 19:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-20 19:58 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-20 19:58 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-20 19:58 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-20 19:43 - 2013-10-20 20:31 - 00000000 ____D C:\Qoobox
2013-10-20 19:42 - 2013-10-20 20:29 - 00000000 ____D C:\Windows\erdnt
2013-10-20 19:41 - 2013-10-20 19:41 - 05135479 ____R (Swearware) C:\Users\Andreas\Desktop\ComboFix.exe
2013-10-20 14:33 - 2013-08-29 09:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-20 14:33 - 2013-08-27 04:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-20 14:33 - 2013-08-27 04:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-20 14:33 - 2013-08-27 04:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-20 14:33 - 2013-08-27 04:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-20 14:33 - 2013-08-27 03:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-20 14:33 - 2013-08-27 03:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-20 14:33 - 2013-08-27 03:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-20 14:33 - 2013-08-27 03:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-20 14:33 - 2013-08-27 03:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-20 14:33 - 2013-08-01 05:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-20 14:33 - 2013-08-01 04:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-20 14:33 - 2013-07-20 12:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-20 14:31 - 2013-07-12 11:04 - 00134272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-20 14:31 - 2013-06-29 04:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-20 14:31 - 2013-06-29 04:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-20 14:31 - 2013-06-29 04:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-20 14:31 - 2013-06-29 04:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-20 14:31 - 2013-06-27 01:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-20 14:31 - 2011-05-05 15:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-20 14:31 - 2011-05-05 15:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-20 14:30 - 2013-07-04 06:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-20 14:30 - 2013-07-03 04:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-20 14:30 - 2013-07-03 04:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-20 14:30 - 2013-06-04 06:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-20 14:30 - 2013-06-04 03:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-20 14:27 - 2013-10-21 20:23 - 00013655 _____ C:\Users\Andreas\Downloads\Addition.txt
2013-10-20 14:16 - 2013-10-20 14:16 - 00000000 ____D C:\FRST
2013-10-20 13:18 - 2013-10-20 13:20 - 00000000 ____D C:\sh4ldr
2013-10-20 13:18 - 2013-10-20 13:18 - 00000000 ____D C:\Program Files\Enigma Software Group

==================== One Month Modified Files and Folders =======

2013-10-22 23:55 - 2013-10-22 23:55 - 01087503 _____ (Farbar) C:\Users\Andreas\Downloads\FRST (1).exe
2013-10-22 23:37 - 2013-10-22 23:37 - 00000041 _____ C:\Users\Andreas\Desktop\checkup.txt
2013-10-22 23:35 - 2013-10-22 23:36 - 00891167 _____ C:\Users\Andreas\Desktop\SecurityCheck.exe
2013-10-22 23:01 - 2012-04-03 00:13 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-22 22:38 - 2006-11-02 14:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-22 22:38 - 2006-11-02 14:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-22 21:42 - 2009-06-29 15:31 - 01782802 _____ C:\Windows\WindowsUpdate.log
2013-10-22 20:42 - 2008-01-21 10:21 - 01445546 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-21 20:23 - 2013-10-20 14:27 - 00013655 _____ C:\Users\Andreas\Downloads\Addition.txt
2013-10-21 20:12 - 2013-10-21 20:12 - 00000713 _____ C:\Users\Andreas\Desktop\JRT.txt
2013-10-21 20:07 - 2013-10-21 20:07 - 00000000 ____D C:\Windows\ERUNT
2013-10-21 20:04 - 2013-10-21 20:05 - 01033335 _____ (Thisisu) C:\Users\Andreas\Desktop\JRT.exe
2013-10-21 20:01 - 2008-08-13 14:15 - 00019259 _____ C:\Windows\system32\Config.MPF
2013-10-21 19:42 - 2006-11-02 14:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-21 19:41 - 2006-11-02 14:58 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-21 19:40 - 2013-10-21 19:38 - 00000000 ____D C:\AdwCleaner
2013-10-21 19:35 - 2013-10-21 19:36 - 01060070 _____ C:\Users\Andreas\Desktop\adwcleaner.exe
2013-10-21 18:22 - 2013-10-21 18:22 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Malwarebytes
2013-10-21 18:21 - 2013-10-21 18:21 - 00000911 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-21 18:21 - 2013-10-21 18:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-21 18:21 - 2013-10-21 18:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-21 03:54 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-21 03:46 - 2006-11-02 14:44 - 00405480 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-21 03:45 - 2008-01-21 05:02 - 00030128 _____ C:\Windows\PFRO.log
2013-10-21 03:25 - 2008-08-13 14:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-21 03:18 - 2013-08-17 13:43 - 00000000 ____D C:\Windows\system32\MRT
2013-10-21 03:15 - 2006-11-02 12:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-20 20:31 - 2013-10-20 20:31 - 00011367 _____ C:\ComboFix.txt
2013-10-20 20:31 - 2013-10-20 20:14 - 00000000 ____D C:\ComboFix
2013-10-20 20:31 - 2013-10-20 19:43 - 00000000 ____D C:\Qoobox
2013-10-20 20:31 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default
2013-10-20 20:31 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-10-20 20:29 - 2013-10-20 19:42 - 00000000 ____D C:\Windows\erdnt
2013-10-20 20:28 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2013-10-20 19:41 - 2013-10-20 19:41 - 05135479 ____R (Swearware) C:\Users\Andreas\Desktop\ComboFix.exe
2013-10-20 14:16 - 2013-10-20 14:16 - 00000000 ____D C:\FRST
2013-10-20 14:10 - 2006-11-02 14:49 - 00104843 _____ C:\Windows\setupact.log
2013-10-20 14:04 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-10-20 14:04 - 2006-11-02 12:22 - 48758784 _____ C:\Windows\system32\config\software_previous
2013-10-20 14:04 - 2006-11-02 12:22 - 42729472 _____ C:\Windows\system32\config\components_previous
2013-10-20 14:04 - 2006-11-02 12:22 - 22020096 _____ C:\Windows\system32\config\system_previous
2013-10-20 14:04 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-10-20 14:04 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-10-20 14:04 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-10-20 14:03 - 2009-06-29 15:49 - 00000000 ____D C:\Users\Andreas
2013-10-20 14:03 - 2006-11-02 13:18 - 00000000 __RSD C:\Windows\Media
2013-10-20 14:03 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2013-10-20 14:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\registration
2013-10-20 13:20 - 2013-10-20 13:18 - 00000000 ____D C:\sh4ldr
2013-10-20 13:18 - 2013-10-20 13:18 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-10-20 13:16 - 2008-08-13 14:16 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-10-20 12:56 - 2009-06-29 15:53 - 00000000 ____D C:\Users\Andreas\AppData\Local\Google
2013-10-20 11:30 - 2013-05-26 18:19 - 03172352 _____ C:\Users\Andreas\Desktop\CD.xls
2013-10-20 11:30 - 2013-05-26 18:19 - 00286208 _____ C:\Users\Andreas\Desktop\Verkauf 2012 u. 2013.xls
2013-10-09 13:01 - 2012-04-03 00:13 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-09 13:01 - 2011-10-03 21:13 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-09 12:14 - 2013-02-26 15:49 - 00012078 _____ C:\Users\Andreas\Desktop\ThatsEntertainment_130226.xlsx
2013-09-22 12:29 - 2013-10-21 03:12 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-22 12:22 - 2013-10-21 03:12 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-22 12:22 - 2013-10-21 03:12 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-22 12:14 - 2013-10-21 03:12 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-22 12:13 - 2013-10-21 03:12 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-22 12:13 - 2013-10-21 03:12 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-22 12:12 - 2013-10-21 03:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-22 12:09 - 2013-10-21 03:12 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-22 12:08 - 2013-10-21 03:12 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-22 12:07 - 2013-10-21 03:12 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-22 12:06 - 2013-10-21 03:12 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-22 12:05 - 2013-10-21 03:12 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-22 12:03 - 2013-10-21 03:12 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-22 12:03 - 2013-10-21 03:12 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-22 12:03 - 2013-10-21 03:12 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-22 11:59 - 2013-10-21 03:12 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

Some content of TEMP:
====================
C:\Users\Andreas\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-21 19:47

==================== End Of Log ============================