Vieren waren gestern, hier sind die ROOTKITS!

Jenner77 · 19.11.2013, 20:23

so männer, ich kämpf seit gut zwei monaten vergeblich um die alleinige kontrolle über meinen pc und geb nun auf, nun richt ich mich an euch und hoffe ihr könnt helfen. Hauptsyntome sind kopien meiner eigenen dateien die sich immer weiter vermehren, schreibgeschütz, unsichtbar und für meinen zugriff gesperrt sind. dieses symtom weitet sich auf immer mehr meiner dateien aus und überhäufen binnen kurzer zeit mein ganzes system so das mir nur eine komplette Neuinstallation bleibt. wenn es nur damit erledigt wäre kein problem aber das hilft nix. ich nehm an da versteckt sich ein übelst fieser Rootkit irgendwo in meiner kiste. aber wo? hab mehrmals schon die ram´s gezogen und entladen, bios auf werkseinstellung zurückgesetzt und auch de pille (notversorgungsbatterie) entfernt. selbst eine andere windowsversion draufgezogen aber umsonst. ich geb euch mal ein Farbar Recovery Scan log und hoff ihr könnt helfen. danke männer
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-11-2013
Ran by derJenner (administrator) on JENNERS-PC on 19-11-2013 16:26:25
Running from C:\Users\derJenner\Downloads
Microsoft® Windows Vista™ Home Premium (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal
 
==================== Processes (Whitelisted) ===================
 
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe
(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
(AVG) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcfgex.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [6139904 2008-05-07] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Windows\SkyTel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2014\avgui.exe [4908592 2013-10-07] (AVG Technologies CZ, s.r.o.)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 
FireFox:
========
FF ProfilePath: C:\Users\derJenner\AppData\Roaming\Mozilla\Firefox\Profiles\mg6pglr0.default
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\derJenner\AppData\Roaming\Mozilla\Firefox\Profiles\mg6pglr0.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: Adblock Plus - C:\Users\derJenner\AppData\Roaming\Mozilla\Firefox\Profiles\mg6pglr0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
 
========================== Services (Whitelisted) =================
 
S2 avgfws; C:\Program Files\AVG\AVG2014\avgfws.exe [1358944 2013-09-25] (AVG Technologies CZ, s.r.o.)
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3538480 2013-10-03] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [301152 2013-09-25] (AVG Technologies CZ, s.r.o.)
R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [1739064 2013-10-08] (AVG)
 
==================== Drivers (Whitelisted) ====================
 
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [120632 2013-09-25] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6x.sys [47928 2013-09-26] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [209208 2013-09-02] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [145720 2013-09-02] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22840 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [176952 2013-09-02] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [223032 2013-09-02] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [102200 2013-08-20] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27448 2013-09-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [193848 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 gdrv; C:\Windows\gdrv.sys [16608 2013-11-19] (Windows (R) 2000 DDK provider)
R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2013-09-18] (TuneUp Software)
U5 AppMgmt; C:\Windows\system32\svchost.exe [22016 2006-11-02] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\DERJEN~1\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2013-11-19 16:26 - 2013-11-19 16:26 - 00005012 _____ C:\Users\derJenner\Downloads\FRST.txt
2013-11-19 16:26 - 2013-11-19 16:26 - 00000000 ____D C:\FRST
2013-11-19 16:24 - 2013-11-19 16:25 - 00000480 _____ C:\Users\derJenner\Downloads\defogger_disable.log
2013-11-19 16:24 - 2013-11-19 16:24 - 00000000 _____ C:\Users\derJenner\defogger_reenable
2013-11-19 16:20 - 2013-11-19 16:20 - 00000798 _____ C:\Windows\PFRO.log
2013-11-19 16:18 - 2013-11-19 16:18 - 00377856 _____ C:\Users\derJenner\Downloads\uoq2o31h.exe
2013-11-19 16:17 - 2013-11-19 16:17 - 00000000 ____D C:\Users\derJenner\AppData\Roaming\AVG2014
2013-11-19 16:16 - 2013-11-19 16:16 - 01090881 _____ (Farbar) C:\Users\derJenner\Downloads\FRST.exe
2013-11-19 16:16 - 2013-11-19 16:16 - 00050477 _____ C:\Users\derJenner\Downloads\Defogger.exe
2013-11-19 16:16 - 2013-11-19 16:16 - 00000000 ____D C:\Users\derJenner\AppData\Roaming\TuneUp Software
2013-11-19 16:15 - 2013-11-19 16:17 - 00000000 ____D C:\ProgramData\AVG2014
2013-11-19 16:15 - 2013-11-19 16:15 - 00000000 ___HD C:\$AVG
2013-11-19 16:13 - 2013-11-19 16:18 - 00000000 ____D C:\ProgramData\MFAData
2013-11-19 16:13 - 2013-11-19 16:17 - 00000000 ____D C:\Users\derJenner\AppData\Local\Avg2014
2013-11-19 16:13 - 2013-11-19 16:13 - 00000000 ____D C:\Users\derJenner\AppData\Local\MFAData
2013-11-19 16:12 - 2013-11-19 16:12 - 04434976 _____ (AVG Technologies) C:\Users\derJenner\Downloads\avg_isct_stb_all_2014_4161.exe
2013-11-19 16:11 - 2013-09-03 13:35 - 00238872 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-19 15:03 - 2013-11-19 15:03 - 00004074 _____ C:\ComboFix.txt
2013-11-19 14:59 - 2013-11-19 15:03 - 00000000 ____D C:\Qoobox
2013-11-19 14:59 - 2013-11-19 15:03 - 00000000 ____D C:\ComboFix
2013-11-19 14:59 - 2013-11-19 15:02 - 00000000 ____D C:\Windows\erdnt
2013-11-19 14:59 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-19 14:59 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-19 14:59 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-19 14:59 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-19 14:59 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-19 14:59 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2013-11-19 14:59 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-19 14:59 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-19 14:59 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-19 14:58 - 2013-11-19 14:59 - 05146522 ____R (Swearware) C:\Users\derJenner\Downloads\ComboFix.exe
2013-11-19 14:56 - 2013-11-19 14:56 - 00000000 ____D C:\Users\derJenner\AppData\Roaming\Mozilla
2013-11-19 14:56 - 2013-11-19 14:56 - 00000000 ____D C:\Users\derJenner\AppData\Local\Mozilla
2013-11-19 11:12 - 2013-11-19 11:12 - 00000000 ____D C:\Program Files\7-Zip
2013-11-19 11:07 - 2013-11-19 11:07 - 00000000 ____D C:\Windows\Cache
2013-11-19 11:07 - 2013-11-19 11:07 - 00000000 ____D C:\ProgramData\Adobe
2013-11-19 11:07 - 2013-11-19 11:07 - 00000000 ____D C:\Program Files\Adobe
2013-11-19 10:06 - 2013-11-19 10:06 - 00000000 ____D C:\ProgramData\Mozilla
2013-11-19 10:06 - 2013-11-19 10:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-19 10:06 - 2013-11-19 10:06 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-19 10:01 - 2007-11-14 08:18 - 00000553 ____R C:\Windows\USetup.iss
2013-11-19 10:00 - 2013-11-19 10:00 - 00319456 _____ (Microsoft Corporation) C:\Windows\DIFxAPI.dll
2013-11-19 10:00 - 2013-11-19 10:00 - 00315392 _____ (Realtek Semiconductor Corp.) C:\Windows\HideWin.exe
2013-11-19 10:00 - 2013-11-19 10:00 - 00000000 ____D C:\Windows\system32\RTCOM
2013-11-19 10:00 - 2013-11-19 10:00 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2013-11-19 10:00 - 2008-05-07 12:22 - 02134424 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHDA.sys
2013-11-19 10:00 - 2008-05-07 09:19 - 06139904 _____ (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
2013-11-19 10:00 - 2008-05-07 09:19 - 00694784 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkPgExt.dll
2013-11-19 10:00 - 2008-05-07 09:17 - 02172928 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO.dll
2013-11-19 10:00 - 2008-05-06 08:29 - 00031232 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoInst.dll
2013-11-19 10:00 - 2008-04-30 05:18 - 00159744 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2013-11-19 10:00 - 2008-04-29 07:55 - 01933312 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll
2013-11-19 10:00 - 2008-04-29 07:55 - 01777664 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesLib.dll
2013-11-19 10:00 - 2008-04-21 09:21 - 00143360 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\system32\FMAPO.dll
2013-11-19 10:00 - 2008-04-02 02:27 - 01196032 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlUpd.exe
2013-11-19 10:00 - 2008-03-28 03:59 - 00285216 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApoApi.dll
2013-11-19 10:00 - 2008-03-05 11:07 - 00520192 ____R (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2013-11-19 10:00 - 2007-11-20 11:15 - 01826816 _____ (Realtek Semiconductor Corp.) C:\Windows\SkyTel.exe
2013-11-19 10:00 - 2007-11-13 05:35 - 00532480 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSndMgr.cpl
2013-11-19 10:00 - 2007-07-30 11:26 - 00126976 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO.dll
2013-11-19 10:00 - 2007-07-25 02:33 - 00135168 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW.dll
2013-11-19 10:00 - 2007-05-17 04:26 - 00185776 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSHD.dll
2013-11-19 10:00 - 2007-04-16 10:09 - 00167936 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP360.dll
2013-11-19 10:00 - 2006-12-13 03:30 - 00339968 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSXT.dll
2013-11-19 09:58 - 2013-11-19 09:58 - 00000000 ____D C:\Program Files\Intel
2013-11-19 09:58 - 2008-03-26 04:15 - 00053248 ____R (Windows XP Bundled build C-Centric Single User) C:\Windows\system32\CSVer.dll
2013-11-19 09:57 - 2013-11-19 10:00 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-11-19 09:57 - 2013-11-19 10:00 - 00000000 ____D C:\Program Files\Realtek
2013-11-19 09:57 - 2013-11-19 09:57 - 00000000 ____D C:\Users\derJenner\AppData\Roaming\InstallShield
2013-11-19 09:57 - 2013-11-19 09:57 - 00000000 ____D C:\Intel
2013-11-19 09:57 - 2008-02-14 07:56 - 00118784 _____ (Realtek Corporation ) C:\Windows\system32\Drivers\Rtlh86.sys
2013-11-19 09:56 - 2013-11-19 11:03 - 00016608 _____ (Windows (R) 2000 DDK provider) C:\Windows\gdrv.sys
2013-11-19 09:56 - 2013-11-19 11:03 - 00000010 _____ C:\Windows\GSetup.ini
2013-11-19 09:56 - 2007-06-21 07:34 - 00203328 ____R () C:\Windows\GSetup.exe
2013-11-19 09:49 - 2013-11-19 09:49 - 00000000 ____D C:\Users\derJenner\AppData\Roaming\AVG
2013-11-19 09:49 - 2013-10-08 13:46 - 00036152 _____ (AVG) C:\Windows\system32\TURegOpt.exe
2013-11-19 09:49 - 2013-10-08 13:46 - 00025400 _____ (AVG) C:\Windows\system32\authuitu.dll
2013-11-19 09:48 - 2013-11-19 16:15 - 00000000 ____D C:\Program Files\AVG
2013-11-19 09:47 - 2013-11-19 09:51 - 00000000 __SHD C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2013-11-19 09:47 - 2013-11-19 09:51 - 00000000 ____D C:\ProgramData\AVG
2013-11-19 09:46 - 2013-11-19 16:24 - 00000000 ____D C:\Users\derJenner
2013-11-19 09:46 - 2013-11-19 09:46 - 00048600 _____ C:\Users\derJenner\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-19 09:46 - 2013-11-19 09:46 - 00000949 _____ C:\Users\derJenner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-19 09:46 - 2013-11-19 09:46 - 00000944 _____ C:\Users\derJenner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2013-11-19 09:46 - 2013-11-19 09:46 - 00000915 _____ C:\Users\derJenner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2013-11-19 09:46 - 2013-11-19 09:46 - 00000020 ___SH C:\Users\derJenner\ntuser.ini
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\Startmenü
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\Netzwerkumgebung
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\Druckumgebung
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\Documents\Eigene Musik
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\Documents\Eigene Bilder
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\AppData\Local\Verlauf
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 ____D C:\Users\derJenner\AppData\Local\VirtualStore
2013-11-19 09:46 - 2006-11-02 13:54 - 00000000 ___RD C:\Users\derJenner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-19 09:46 - 2006-11-02 13:50 - 00000000 ___RD C:\Users\derJenner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Programme
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\ProgramData\Startmenü
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\ProgramData\Dokumente
2013-11-19 09:38 - 2013-11-19 09:38 - 00000000 _____ C:\Windows\system32\atiicdxx.dat
2013-11-19 09:36 - 2013-11-19 09:39 - 00001313 _____ C:\Windows\TSSysprep.log
2013-11-19 09:34 - 2013-11-19 09:39 - 00000000 ____D C:\Windows\Panther
2013-11-19 09:34 - 2013-11-19 09:34 - 00008192 ___RS C:\BOOTSECT.BAK
2013-11-19 09:34 - 2006-11-02 10:53 - 00438840 __RSH C:\bootmgr
2013-11-18 19:13 - 1999-10-15 07:50 - 01056768 _____ (Blue Sky Software Corporation.) C:\Windows\system32\Roboex32.dll
2013-11-18 19:13 - 1996-05-07 15:59 - 00047104 _____ (WexTech Systems, Inc.) C:\Windows\system32\D2htls32.dll
 
==================== One Month Modified Files and Folders =======
 
2013-11-19 16:26 - 2013-11-19 16:26 - 00005012 _____ C:\Users\derJenner\Downloads\FRST.txt
2013-11-19 16:26 - 2013-11-19 16:26 - 00000000 ____D C:\FRST
2013-11-19 16:26 - 2006-11-02 13:52 - 01089545 _____ C:\Windows\WindowsUpdate.log
2013-11-19 16:25 - 2013-11-19 16:24 - 00000480 _____ C:\Users\derJenner\Downloads\defogger_disable.log
2013-11-19 16:25 - 2006-11-02 11:33 - 01407444 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-19 16:24 - 2013-11-19 16:24 - 00000000 _____ C:\Users\derJenner\defogger_reenable
2013-11-19 16:24 - 2013-11-19 09:46 - 00000000 ____D C:\Users\derJenner
2013-11-19 16:21 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-19 16:21 - 2006-11-02 13:47 - 00003552 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-19 16:21 - 2006-11-02 13:47 - 00003552 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-19 16:20 - 2013-11-19 16:20 - 00000798 _____ C:\Windows\PFRO.log
2013-11-19 16:19 - 2006-11-02 14:01 - 00002610 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-19 16:18 - 2013-11-19 16:18 - 00377856 _____ C:\Users\derJenner\Downloads\uoq2o31h.exe
2013-11-19 16:18 - 2013-11-19 16:13 - 00000000 ____D C:\ProgramData\MFAData
2013-11-19 16:17 - 2013-11-19 16:17 - 00000000 ____D C:\Users\derJenner\AppData\Roaming\AVG2014
2013-11-19 16:17 - 2013-11-19 16:15 - 00000000 ____D C:\ProgramData\AVG2014
2013-11-19 16:17 - 2013-11-19 16:13 - 00000000 ____D C:\Users\derJenner\AppData\Local\Avg2014
2013-11-19 16:16 - 2013-11-19 16:16 - 01090881 _____ (Farbar) C:\Users\derJenner\Downloads\FRST.exe
2013-11-19 16:16 - 2013-11-19 16:16 - 00050477 _____ C:\Users\derJenner\Downloads\Defogger.exe
2013-11-19 16:16 - 2013-11-19 16:16 - 00000000 ____D C:\Users\derJenner\AppData\Roaming\TuneUp Software
2013-11-19 16:15 - 2013-11-19 16:15 - 00000000 ___HD C:\$AVG
2013-11-19 16:15 - 2013-11-19 09:48 - 00000000 ____D C:\Program Files\AVG
2013-11-19 16:13 - 2013-11-19 16:13 - 00000000 ____D C:\Users\derJenner\AppData\Local\MFAData
2013-11-19 16:12 - 2013-11-19 16:12 - 04434976 _____ (AVG Technologies) C:\Users\derJenner\Downloads\avg_isct_stb_all_2014_4161.exe
2013-11-19 15:03 - 2013-11-19 15:03 - 00004074 _____ C:\ComboFix.txt
2013-11-19 15:03 - 2013-11-19 14:59 - 00000000 ____D C:\Qoobox
2013-11-19 15:03 - 2013-11-19 14:59 - 00000000 ____D C:\ComboFix
2013-11-19 15:03 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Default
2013-11-19 15:03 - 2006-11-02 12:18 - 00000000 ___RD C:\Users\Public
2013-11-19 15:02 - 2013-11-19 14:59 - 00000000 ____D C:\Windows\erdnt
2013-11-19 15:02 - 2006-11-02 11:23 - 00000215 _____ C:\Windows\system.ini
2013-11-19 14:59 - 2013-11-19 14:58 - 05146522 ____R (Swearware) C:\Users\derJenner\Downloads\ComboFix.exe
2013-11-19 14:56 - 2013-11-19 14:56 - 00000000 ____D C:\Users\derJenner\AppData\Roaming\Mozilla
2013-11-19 14:56 - 2013-11-19 14:56 - 00000000 ____D C:\Users\derJenner\AppData\Local\Mozilla
2013-11-19 12:09 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2013-11-19 11:12 - 2013-11-19 11:12 - 00000000 ____D C:\Program Files\7-Zip
2013-11-19 11:07 - 2013-11-19 11:07 - 00000000 ____D C:\Windows\Cache
2013-11-19 11:07 - 2013-11-19 11:07 - 00000000 ____D C:\ProgramData\Adobe
2013-11-19 11:07 - 2013-11-19 11:07 - 00000000 ____D C:\Program Files\Adobe
2013-11-19 11:03 - 2013-11-19 09:56 - 00016608 _____ (Windows (R) 2000 DDK provider) C:\Windows\gdrv.sys
2013-11-19 11:03 - 2013-11-19 09:56 - 00000010 _____ C:\Windows\GSetup.ini
2013-11-19 10:06 - 2013-11-19 10:06 - 00000000 ____D C:\ProgramData\Mozilla
2013-11-19 10:06 - 2013-11-19 10:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-19 10:06 - 2013-11-19 10:06 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-19 10:00 - 2013-11-19 10:00 - 00319456 _____ (Microsoft Corporation) C:\Windows\DIFxAPI.dll
2013-11-19 10:00 - 2013-11-19 10:00 - 00315392 _____ (Realtek Semiconductor Corp.) C:\Windows\HideWin.exe
2013-11-19 10:00 - 2013-11-19 10:00 - 00000000 ____D C:\Windows\system32\RTCOM
2013-11-19 10:00 - 2013-11-19 10:00 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2013-11-19 10:00 - 2013-11-19 09:57 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-11-19 10:00 - 2013-11-19 09:57 - 00000000 ____D C:\Program Files\Realtek
2013-11-19 09:58 - 2013-11-19 09:58 - 00000000 ____D C:\Program Files\Intel
2013-11-19 09:57 - 2013-11-19 09:57 - 00000000 ____D C:\Users\derJenner\AppData\Roaming\InstallShield
2013-11-19 09:57 - 2013-11-19 09:57 - 00000000 ____D C:\Intel
2013-11-19 09:51 - 2013-11-19 09:47 - 00000000 __SHD C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2013-11-19 09:51 - 2013-11-19 09:47 - 00000000 ____D C:\ProgramData\AVG
2013-11-19 09:49 - 2013-11-19 09:49 - 00000000 ____D C:\Users\derJenner\AppData\Roaming\AVG
2013-11-19 09:47 - 2006-11-02 13:52 - 00018069 _____ C:\Windows\setupact.log
2013-11-19 09:47 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\system32\restore
2013-11-19 09:46 - 2013-11-19 09:46 - 00048600 _____ C:\Users\derJenner\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-19 09:46 - 2013-11-19 09:46 - 00000949 _____ C:\Users\derJenner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-19 09:46 - 2013-11-19 09:46 - 00000944 _____ C:\Users\derJenner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2013-11-19 09:46 - 2013-11-19 09:46 - 00000915 _____ C:\Users\derJenner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2013-11-19 09:46 - 2013-11-19 09:46 - 00000020 ___SH C:\Users\derJenner\ntuser.ini
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\Startmenü
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\Netzwerkumgebung
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\Druckumgebung
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\Documents\Eigene Musik
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\Documents\Eigene Bilder
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 _SHDL C:\Users\derJenner\AppData\Local\Verlauf
2013-11-19 09:46 - 2013-11-19 09:46 - 00000000 ____D C:\Users\derJenner\AppData\Local\VirtualStore
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\Programme
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\ProgramData\Startmenü
2013-11-19 09:43 - 2013-11-19 09:43 - 00000000 _SHDL C:\ProgramData\Dokumente
2013-11-19 09:43 - 2006-11-02 12:18 - 00000000 ____D C:\Program Files\Windows NT
2013-11-19 09:41 - 2006-11-02 13:47 - 00228840 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-19 09:39 - 2013-11-19 09:36 - 00001313 _____ C:\Windows\TSSysprep.log
2013-11-19 09:39 - 2013-11-19 09:34 - 00000000 ____D C:\Windows\Panther
2013-11-19 09:38 - 2013-11-19 09:38 - 00000000 _____ C:\Windows\system32\atiicdxx.dat
2013-11-19 09:36 - 2006-11-02 13:48 - 00001816 _____ C:\Windows\DtcInstall.log
2013-11-19 09:34 - 2013-11-19 09:34 - 00008192 ___RS C:\BOOTSECT.BAK
2013-11-19 09:34 - 2006-11-02 13:43 - 00037888 ____H C:\Windows\system32\config\BCD-Template.LOG
2013-11-19 09:34 - 2006-11-02 13:37 - 00262144 _____ C:\Windows\system32\config\BCD-Template
2013-11-19 09:34 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\de-DE
 
==================== Bamital & volsnap Check =================
 
C:\Windows\explorer.exe
[2006-11-02 09:47] - [2006-11-02 10:45] - 2923520 ____A (Microsoft Corporation) FD8C53FB002217F6F888BCF6F5D7084D
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll
[2006-11-02 09:38] - [2006-11-02 10:46] - 0633856 ____A (Microsoft Corporation) E698A5437B89A285ACA3FF022356810A
 
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2006-11-02 09:52] - [2006-11-02 10:51] - 0208488 ____A (Microsoft Corporation) 11EF6C1CAEF76B685233450A126125D6
 
 
 
LastRegBack: 2013-11-19 16:26
 
==================== End Of Log ============================

--- --- ---

Vieren waren gestern, hier sind die ROOTKITS!

Log-Analyse und Auswertung: Vieren waren gestern, hier sind die ROOTKITS!

Vieren waren gestern, hier sind die ROOTKITS!

Ähnliche Themen: Vieren waren gestern, hier sind die ROOTKITS!