GVU Trojaner Vista 32bit, abgesicherter Modus nicht möglich

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-12-2013 03
Ran by SYSTEM on MININT-QQ36VLD on 09-12-2013 18:03:27
Running from F:\
Windows Vista (TM) Home Premium (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4423680 2007-04-07] (Realtek Semiconductor)
HKLM\...\Run: [ISBMgr.exe] - C:\Program Files\Sony\ISB Utility\ISBMgr.exe [311296 2007-09-19] (Sony Corporation)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe [620152 2006-10-22] (Adobe Systems Inc.)
HKLM\...\Run: [Nokia FastStart] - "C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart
HKLM\...\Run: [SunJavaUpdateSched] - "C:\Program Files\Java\jre6\bin\jusched.exe"
HKLM\...\Run: [] - [x]
HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [1574176 2012-12-20] (Ask)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-14] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [FromDocToPDF Search Scope Monitor] - C:\Program Files\FromDocToPDF_65\bar\1.bin\65SrchMn.exe [44784 2013-11-06] (MindSpark)
HKLM\...\Run: [FromDocToPDF_65 Browser Plugin Loader] - C:\Program Files\FromDocToPDF_65\bar\1.bin\65brmon.exe [30096 2013-11-06] (VER_COMPANY_NAME)
Winlogon\Notify\VESWinlogon: C:\Windows\system32\VESWinlogon.dll (Sony Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\Run: [Picasa Media Detector] - C:\Program Files\Picasa2\PicasaMediaDetector.exe
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [Picasa Media Detector] - C:\Program Files\Picasa2\PicasaMediaDetector.exe
HKU\schott\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2008-01-18] (Microsoft Corporation)
HKU\schott\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\wmpnscfg.exe [ 2008-01-18] (Microsoft Corporation)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CCC.lnk
ShortcutTarget: CCC.lnk -> C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (No File)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CCC.lnk
ShortcutTarget: CCC.lnk -> C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (No File)
Startup: C:\Users\schott\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18zrlrjt.lnk
ShortcutTarget: 18zrlrjt.lnk -> C:\ProgramData\tjrlrz81.jss (Microsoft Corporation)
Startup: C:\Users\schott\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

========================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-11-14] (Avira Operations GmbH & Co. KG)
S2 BitGuard; C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [3780064 2013-11-18] ()
S2 FromDocToPDF_65Service; C:\Program Files\FromDocToPDF_65\bar\1.bin\65barsvc.exe [44752 2013-11-06] (COMPANYVERS_NAME)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe [73728 2007-06-27] (Sony Corporation)
S2 VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [182392 2007-08-14] (Sony Corporation)
S3 VAIOMediaPlatform-IntegratedServer-AppServer; C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe [2523136 2007-06-20] (Sony Corporation)
S3 VAIOMediaPlatform-IntegratedServer-UPnP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [1089536 2007-06-20] (Sony Corporation)
S3 VAIOMediaPlatform-UCLS-AppServer; C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe [745472 2007-01-10] (Sony Corporation)
S3 VAIOMediaPlatform-UCLS-UPnP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [1089536 2007-06-20] (Sony Corporation)
S2 VcmIAlzMgr; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [292128 2007-09-28] (Sony Corporation)
S3 Vcsw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [274432 2007-06-27] (Sony Corporation)
S2 VzCdbSvc; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [192512 2007-08-28] (Sony Corporation)
S2 VzFw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe [131072 2007-08-28] (Sony Corporation)
S2 Winmgmt; C:\ProgramData\tjrlrz81.jss [208896 2013-12-07] (Microsoft Corporation)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
S3 VAIOMediaPlatform-IntegratedServer-HTTP; "C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP" [x]
S3 VAIOMediaPlatform-Mobile-Gateway; "C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server" [x]
S3 VAIOMediaPlatform-UCLS-HTTP; "C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-UCLS-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\UCLS\HTTP" [x]

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-07] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-11-14] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-14] (Avira Operations GmbH & Co. KG)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [818688 2007-11-15] (Texas Instruments)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [x]
S3 HSXHWAZL; system32\DRIVERS\HSXHWAZL.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 massfilter; system32\drivers\massfilter.sys [x]
S2 mdmxsdk; system32\DRIVERS\mdmxsdk.sys [x]
S3 nmwcd; system32\drivers\ccdcmb.sys [x]
S3 nmwcdc; system32\drivers\ccdcmbo.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S4 UIUSys; system32\DRIVERS\UIUSYS.SYS [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]
S3 UsbserFilt; system32\DRIVERS\usbser_lowerfltj.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-09 18:03 - 2013-12-09 18:03 - 00000000 ____D C:\FRST
2013-12-07 02:27 - 2013-12-07 02:27 - 00000285 _____ C:\ProgramData\18zrlrjt.reg
2013-12-07 02:26 - 2013-12-09 08:47 - 95025368 ____T C:\ProgramData\18zrlrjt.fee
2013-12-07 02:26 - 2013-12-09 08:47 - 00000000 _____ C:\ProgramData\18zrlrjt.odd
2013-12-07 02:26 - 2013-12-07 02:26 - 00208896 _____ (Microsoft Corporation) C:\ProgramData\tjrlrz81.jss
2013-12-07 02:23 - 2013-12-07 02:23 - 00016127 _____ C:\Users\schott\Desktop\hs_err_pid2844.log
2013-11-21 07:21 - 2013-11-21 07:46 - 00000000 ____D C:\Users\schott\Documents\Vistaprint Fotobücher
2013-11-21 07:21 - 2013-11-21 07:21 - 00001792 _____ C:\Users\schott\Desktop\Vistaprint Fotobücher.lnk
2013-11-21 07:21 - 2013-11-21 07:21 - 00000000 ____D C:\Users\schott\AppData\Local\Vistaprint Fotobücher
2013-11-14 08:52 - 2013-10-13 02:42 - 12344832 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-14 08:52 - 2013-10-13 02:08 - 09739264 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-14 08:52 - 2013-10-13 01:48 - 01806848 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-14 08:52 - 2013-10-13 01:37 - 01104896 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-14 08:52 - 2013-10-13 01:35 - 01427968 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-11-14 08:52 - 2013-10-13 01:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-14 08:52 - 2013-10-13 01:33 - 00231936 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-11-14 08:52 - 2013-10-13 01:32 - 00065024 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-14 08:52 - 2013-10-13 01:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-14 08:52 - 2013-10-13 01:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-11-14 08:52 - 2013-10-13 01:29 - 00420864 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-11-14 08:52 - 2013-10-13 01:27 - 01796096 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-14 08:52 - 2013-10-13 01:27 - 00607744 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-14 08:52 - 2013-10-13 01:26 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-11-14 08:52 - 2013-10-13 01:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-14 08:52 - 2013-10-13 01:20 - 00176640 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-14 04:47 - 2013-10-10 18:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL
2013-11-14 04:47 - 2013-10-10 18:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL
2013-11-14 04:47 - 2013-10-10 16:39 - 00218228 _____ C:\Windows\System32\WFP.TMF
2013-11-14 04:47 - 2013-10-03 04:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-11-14 04:47 - 2013-10-03 04:45 - 00297984 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-11-11 03:50 - 2013-12-07 04:14 - 00011888 _____ C:\Windows\PFRO.log

==================== One Month Modified Files and Folders =======

2013-12-09 18:03 - 2013-12-09 18:03 - 00000000 ____D C:\FRST
2013-12-09 08:47 - 2013-12-07 02:26 - 95025368 ____T C:\ProgramData\18zrlrjt.fee
2013-12-09 08:47 - 2013-12-07 02:26 - 00000000 _____ C:\ProgramData\18zrlrjt.odd
2013-12-09 08:47 - 2006-11-02 04:47 - 00003568 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-09 08:47 - 2006-11-02 04:47 - 00003568 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-09 08:46 - 2011-06-10 02:58 - 00065536 _____ C:\Windows\System32\Ikeext.etl
2013-12-09 08:34 - 2008-07-23 00:21 - 01445907 _____ C:\Windows\WindowsUpdate.log
2013-12-09 08:30 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\tracing
2013-12-07 04:53 - 2007-11-26 07:32 - 00000012 _____ C:\Windows\bthservsdp.dat
2013-12-07 04:14 - 2013-11-11 03:50 - 00011888 _____ C:\Windows\PFRO.log
2013-12-07 02:27 - 2013-12-07 02:27 - 00000285 _____ C:\ProgramData\18zrlrjt.reg
2013-12-07 02:26 - 2013-12-07 02:26 - 00208896 _____ (Microsoft Corporation) C:\ProgramData\tjrlrz81.jss
2013-12-07 02:23 - 2013-12-07 02:23 - 00016127 _____ C:\Users\schott\Desktop\hs_err_pid2844.log
2013-12-07 02:23 - 2006-11-02 02:33 - 01427212 _____ C:\Windows\System32\PerfStringBackup.INI
2013-12-07 02:22 - 2013-01-26 11:50 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-11-25 02:56 - 2013-09-19 04:25 - 00000000 ____D C:\ProgramData\BitGuard
2013-11-21 07:46 - 2013-11-21 07:21 - 00000000 ____D C:\Users\schott\Documents\Vistaprint Fotobücher
2013-11-21 07:21 - 2013-11-21 07:21 - 00001792 _____ C:\Users\schott\Desktop\Vistaprint Fotobücher.lnk
2013-11-21 07:21 - 2013-11-21 07:21 - 00000000 ____D C:\Users\schott\AppData\Local\Vistaprint Fotobücher
2013-11-21 07:00 - 2008-07-23 00:31 - 00000000 ____D C:\users\schott
2013-11-21 06:55 - 2008-07-29 05:54 - 00000000 ___RD C:\Users\schott\03b_Schuhschmiede
2013-11-21 06:45 - 2008-07-23 00:32 - 00039936 _____ C:\Users\schott\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-21 06:37 - 2013-10-30 06:44 - 00000000 ____D C:\Users\schott\AppData\Local\Thunderbird
2013-11-21 06:37 - 2013-10-30 06:43 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-11-15 07:07 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\rescache
2013-11-15 06:18 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-11-14 08:51 - 2013-08-30 22:19 - 00000000 ____D C:\Windows\System32\MRT
2013-11-14 08:48 - 2006-11-02 02:24 - 80340640 _____ (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-11-14 04:55 - 2013-01-26 11:50 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-11-14 04:55 - 2013-01-26 11:50 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-11-11 03:50 - 2013-10-30 06:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-10 20:50 - 2010-12-13 06:04 - 00230048 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

Files to move or delete:
====================
C:\ProgramData\18zrlrjt.reg


Some content of TEMP:
====================
C:\Users\schott\AppData\Local\Temp\avgnt.exe
C:\Users\schott\AppData\Local\Temp\~tmf8773793149047124240.dll


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

18
Restore point made on: 2013-10-21 02:43:20
Restore point made on: 2013-10-24 04:22:11
Restore point made on: 2013-10-24 05:43:43
Restore point made on: 2013-10-24 05:47:44
Restore point made on: 2013-10-30 06:36:33
Restore point made on: 2013-11-04 01:16:18
Restore point made on: 2013-11-11 03:58:25
Restore point made on: 2013-11-14 04:47:58
Restore point made on: 2013-11-14 08:48:16
Restore point made on: 2013-11-21 06:35:17
Restore point made on: 2013-11-25 03:04:30
Restore point made on: 2013-11-25 06:11:29
Restore point made on: 2013-11-25 06:11:36
Restore point made on: 2013-12-02 01:44:01
Restore point made on: 2013-12-07 02:23:01
Restore point made on: 2013-12-07 03:51:41
Restore point made on: 2013-12-07 03:51:48
Restore point made on: 2013-12-07 04:32:03

==================== Memory info =========================== 

Percentage of memory in use: 17%
Total physical RAM: 3070.43 MB
Available physical RAM: 2524.93 MB
Total Pagefile: 3068.71 MB
Available Pagefile: 2538.51 MB
Total Virtual: 2047.88 MB
Available Virtual: 1933.98 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:139.63 GB) (Free:73.17 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Recovery) (Fixed) (Total:9.42 GB) (Free:0.82 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (RDVDW7P00M02) (CDROM) (Total:3.47 GB) (Free:0 GB) CDFS
Drive f: (STICK) (Removable) (Total:0.48 GB) (Free:0.48 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: E1AB99A4)
Partition 1: (Not Active) - (Size=9 GB) - (Type=27)
Partition 2: (Active) - (Size=140 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 495 MB) (Disk ID: D71C5009)
Partition 1: (Active) - (Size=495 MB) - (Type=0B)


LastRegBack: 2013-12-09 08:10

==================== End Of Log ============================