Interpol Virus blockiert Laptop

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-11-2013 01
Ran by SYSTEM on MINWINPC on 25-11-2013 20:11:46
Running from D:\
Windows Vista (TM) Home Basic Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [217088 2009-03-31] (Alps Electric Co., Ltd.)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Windows\System32\WLTRAY.EXE [3810304 2008-11-17] (Dell Inc.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\quickset.exe [1735760 2009-01-09] (Dell Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [178712 2008-05-07] (Intel Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM\...\Run: [Dell DataSafe Online] - C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe [1762032 2009-04-09] ()
HKLM\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [128232 2009-02-05] (CyberLink Corp.)
HKLM\...\Run: [dellsupportcenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [483428 2009-03-31] (IDT, Inc.)
HKLM\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1278064 2013-03-13] (McAfee, Inc.)
Winlogon\Notify\GoToAssist: C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
HKU\Keß\...\Run: [SightSpeed] - C:\Program Files\Dell Video Chat\DellVideoChat.exe [ 2008-12-18] (Dell Inc. and SightSpeed Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Keß\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tj6rjllw.lnk
ShortcutTarget: tj6rjllw.lnk -> C:\ProgramData\wlljr6jt.dss (Корпорация Майкрософт)

========================== Services (Whitelisted) =================

S2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [81920 2009-03-31] (Andrea Electronics Corporation)
S2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-12-18] (Stardock Corporation)
S2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [279048 2012-11-16] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [203840 2013-02-19] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169320 2013-02-19] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [172416 2013-02-19] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.)
S2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe [254042 2009-03-31] (IDT, Inc.)
S2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [199600 2010-11-11] (Telefónica I+D)
S2 Winmgmt; C:\ProgramData\wlljr6jt.dss [205312 2013-11-25] (Корпорация Майкрософт)
S2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2809856 2008-11-17] (Dell Inc.)
S2 yksvc; RUNDLL32.EXE ykx32coinst,serviceStartProc [x]

==================== Drivers (Whitelisted) ====================

S3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2008-11-17] (Broadcom Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [60920 2013-02-19] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [146872 2012-04-20] (McAfee, Inc.)
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [133416 2013-02-19] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [235264 2013-02-19] (McAfee, Inc.)
S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [65928 2013-02-19] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [363080 2013-02-19] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [565888 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [92632 2013-02-19] (McAfee, Inc.)
S1 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [210608 2013-02-19] (McAfee, Inc.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 mfeavfk01; No ImagePath
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 PCD5SRVC{3F6A8B78-EC003E00-05040104}; \??\C:\PROGRA~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-25 20:11 - 2013-11-25 20:11 - 00000000 ____D C:\FRST
2013-11-25 01:53 - 2013-11-25 01:54 - 00000285 _____ C:\ProgramData\tj6rjllw.reg
2013-11-25 01:53 - 2013-11-25 01:53 - 01305088 ____T C:\ProgramData\tj6rjllw.fdd
2013-11-25 01:52 - 2013-11-25 19:56 - 95025368 ____T C:\ProgramData\tj6rjllw.bxx
2013-11-25 01:52 - 2013-11-25 19:51 - 00000000 _____ C:\ProgramData\tj6rjllw.fvv
2013-11-25 01:52 - 2013-11-25 01:52 - 00205312 _____ (Корпорация Майкрософт) C:\ProgramData\wlljr6jt.dss
2013-11-14 09:10 - 2013-11-25 19:57 - 00001737 _____ C:\Users\Public\Desktop\McAfee Security Center.lnk
2013-11-14 08:54 - 2013-10-13 11:42 - 12344832 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-14 08:54 - 2013-10-13 11:08 - 09739264 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-14 08:54 - 2013-10-13 10:48 - 01806848 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-14 08:54 - 2013-10-13 10:37 - 01104896 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-14 08:54 - 2013-10-13 10:35 - 01427968 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-11-14 08:54 - 2013-10-13 10:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-14 08:54 - 2013-10-13 10:33 - 00231936 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-11-14 08:54 - 2013-10-13 10:32 - 00065024 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-14 08:54 - 2013-10-13 10:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-14 08:54 - 2013-10-13 10:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-11-14 08:54 - 2013-10-13 10:29 - 00420864 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-11-14 08:54 - 2013-10-13 10:27 - 01796096 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-14 08:54 - 2013-10-13 10:27 - 00607744 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-14 08:54 - 2013-10-13 10:26 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-11-14 08:54 - 2013-10-13 10:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-14 08:54 - 2013-10-13 10:20 - 00176640 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-13 20:37 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL
2013-11-13 20:37 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL
2013-11-13 20:37 - 2013-10-11 01:39 - 00218228 _____ C:\Windows\System32\WFP.TMF
2013-11-13 20:37 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-11-13 20:37 - 2013-10-03 13:45 - 00297984 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll

==================== One Month Modified Files and Folders =======

2013-11-25 20:11 - 2013-11-25 20:11 - 00000000 ____D C:\FRST
2013-11-25 19:57 - 2013-11-14 09:10 - 00001737 _____ C:\Users\Public\Desktop\McAfee Security Center.lnk
2013-11-25 19:56 - 2013-11-25 01:52 - 95025368 ____T C:\ProgramData\tj6rjllw.bxx
2013-11-25 19:51 - 2013-11-25 01:52 - 00000000 _____ C:\ProgramData\tj6rjllw.fvv
2013-11-25 19:51 - 2006-11-02 13:45 - 00003616 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-25 19:51 - 2006-11-02 13:45 - 00003616 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-25 19:44 - 2009-12-12 08:59 - 00006080 _____ C:\Users\Keß\AppData\Local\d3d9caps.dat
2013-11-25 19:26 - 2009-06-24 09:12 - 01570575 _____ C:\Windows\WindowsUpdate.log
2013-11-25 01:59 - 2008-01-21 09:21 - 01445310 _____ C:\Windows\System32\PerfStringBackup.INI
2013-11-25 01:54 - 2013-11-25 01:53 - 00000285 _____ C:\ProgramData\tj6rjllw.reg
2013-11-25 01:53 - 2013-11-25 01:53 - 01305088 ____T C:\ProgramData\tj6rjllw.fdd
2013-11-25 01:52 - 2013-11-25 01:52 - 00205312 _____ (Корпорация Майкрософт) C:\ProgramData\wlljr6jt.dss
2013-11-15 09:14 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2013-11-14 09:02 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-11-14 08:52 - 2013-08-24 06:16 - 00000000 ____D C:\Windows\System32\MRT
2013-11-14 08:46 - 2006-11-02 11:24 - 80340640 _____ (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-11-13 06:18 - 2008-01-21 04:02 - 00531466 _____ C:\Windows\PFRO.log

Files to move or delete:
====================
C:\ProgramData\tj6rjllw.bxx
C:\ProgramData\tj6rjllw.fdd
C:\ProgramData\tj6rjllw.fvv
C:\ProgramData\tj6rjllw.reg
C:\ProgramData\wlljr6jt.dss


Some content of TEMP:
====================
C:\Users\Keß\AppData\Local\Temp\card_setup.exe
C:\Users\Keß\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Keß\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Keß\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Keß\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Keß\AppData\Local\Temp\~tmf7420825837366457857.dll


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

11
Restore point made on: 2013-10-10 17:34:15
Restore point made on: 2013-10-11 18:16:36
Restore point made on: 2013-10-19 20:58:24
Restore point made on: 2013-10-30 11:51:57
Restore point made on: 2013-10-31 13:21:30
Restore point made on: 2013-11-05 08:45:32
Restore point made on: 2013-11-06 18:11:06
Restore point made on: 2013-11-07 09:57:41
Restore point made on: 2013-11-09 09:33:59
Restore point made on: 2013-11-14 08:44:59
Restore point made on: 2013-11-24 17:37:49

==================== Memory info =========================== 

Percentage of memory in use: 12%
Total physical RAM: 2009.63 MB
Available physical RAM: 1767.27 MB
Total Pagefile: 1945.27 MB
Available Pagefile: 1821.77 MB
Total Virtual: 2047.88 MB
Available Virtual: 1963.07 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:134.36 GB) (Free:88.39 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Removable) (Total:7.42 GB) (Free:7.42 GB) FAT32
Drive x: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:9.38 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149 GB) (Disk ID: 4B9B8497)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=134 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)


LastRegBack: 2013-11-25 01:29

==================== End Of Log ============================