Interpol Trojaner Windows 7

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013 (ATTENTION: ====> FRST version is 50 days old and could be outdated)
Ran by SYSTEM on MININT-TP0B6KJ on 21-11-2013 22:25:38
Running from H:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11369576 2010-08-10] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2586504 2010-08-05] (ELAN Microelectronics Corp.)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-13] (Microsoft Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2011-06-07] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-01] (Apple Inc.)
HKU\Florian\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
HKU\Florian\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)
HKU\Florian\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\Florian\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3561816 2013-10-16] (Electronic Arts)
HKU\Tanja\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk
ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Internet.lnk
ShortcutTarget: DSL Internet.lnk -> C:\Program Files (x86)\1&1\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk
ShortcutTarget: DSL Protect.lnk -> C:\Program Files (x86)\1&1\FwebProt.exe (AVM Berlin)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Tanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S2 IGDCTRL; C:\Program Files (x86)\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin)
S2 N360; C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe [130008 2011-04-16] (Symantec Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-05-31] (Symantec Corporation)
S2 WTGService; C:\Program Files (x86)\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()
S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x]

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-06-19] ()
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-28] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-06-19] ()
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)
S3 SRTSP; C:\Windows\System32\Drivers\N360x64\0502020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\N360x64\0502020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\N360x64\0502020.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\N360x64\0502020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-06-21] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-15 13:15 - 2009-07-13 17:14 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2013-11-15 13:14 - 2010-05-06 05:00 - 01026048 _____ (Microsoft Corporation) C:\Windows\System32\mstime.dll
2013-11-15 13:14 - 2010-05-06 04:41 - 00606208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2013-11-15 13:14 - 2009-07-13 17:41 - 00267776 _____ (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2013-11-15 13:14 - 2009-07-13 17:41 - 00156160 _____ (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2013-11-15 13:14 - 2009-07-13 17:40 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\admparse.dll
2013-11-15 13:14 - 2009-07-13 17:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\corpol.dll
2013-11-15 13:14 - 2009-07-13 17:27 - 00163840 _____ (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2013-11-15 13:14 - 2009-07-13 17:15 - 00229376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2013-11-15 13:14 - 2009-07-13 17:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2013-11-15 13:14 - 2009-07-13 17:15 - 00018432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\corpol.dll
2013-11-15 13:14 - 2009-07-13 17:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2013-11-15 13:14 - 2009-07-13 17:05 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2013-11-15 13:14 - 2009-06-10 12:45 - 00000003 _____ C:\Windows\System32\Drivers\MsftWdf_Kernel_01009_Inbox_Critical.Wdf
2013-11-15 13:13 - 2013-11-15 13:13 - 00274904 _____ C:\Windows\Minidump\111513-28470-01.dmp
2013-11-15 04:22 - 2013-11-15 13:13 - 492919575 _____ C:\Windows\MEMORY.DMP
2013-11-15 04:22 - 2013-11-15 04:22 - 00274904 _____ C:\Windows\Minidump\111513-30607-01.dmp
2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx
2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv
2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss
2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss
2013-11-13 12:35 - 2013-11-13 12:35 - 00001743 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-13 12:34 - 2013-11-13 12:35 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-13 12:34 - 2013-11-13 12:35 - 00000000 ____D C:\Program Files\iTunes
2013-11-13 12:34 - 2013-11-13 12:35 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-13 12:34 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files\iPod
2013-10-22 09:11 - 2013-10-22 09:17 - 00000000 ____D C:\Users\Florian\Desktop\Serien

==================== One Month Modified Files and Folders =======

2013-11-15 13:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-11-15 13:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\oobe
2013-11-15 13:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\com
2013-11-15 13:14 - 2013-11-14 13:05 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx
2013-11-15 13:14 - 2013-11-14 13:05 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv
2013-11-15 13:14 - 2013-01-20 11:11 - 00000000 ____D C:\Users\Florian\AppData\Roaming\Dropbox
2013-11-15 13:14 - 2012-11-15 11:51 - 00000000 ____D C:\Program Files (x86)\Origin
2013-11-15 13:14 - 2012-01-01 11:38 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-15 13:14 - 2011-04-26 11:12 - 00000000 ____D C:\Users\Florian\Tracing
2013-11-15 13:13 - 2013-11-15 13:13 - 00274904 _____ C:\Windows\Minidump\111513-28470-01.dmp
2013-11-15 13:13 - 2013-11-15 04:22 - 492919575 _____ C:\Windows\MEMORY.DMP
2013-11-15 13:13 - 2011-11-10 09:38 - 00000000 ____D C:\Windows\Minidump
2013-11-15 13:13 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-15 13:13 - 2009-07-13 20:51 - 00218260 _____ C:\Windows\setupact.log
2013-11-15 04:23 - 2012-01-01 11:38 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-15 04:22 - 2013-11-15 04:22 - 00274904 _____ C:\Windows\Minidump\111513-30607-01.dmp
2013-11-14 13:10 - 2010-08-31 15:01 - 02029567 _____ C:\Windows\WindowsUpdate.log
2013-11-14 13:07 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-14 13:07 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-14 13:06 - 2010-11-19 11:16 - 00000000 ____D C:\Users\Florian\AppData\Local\CrashDumps
2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss
2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss
2013-11-14 13:01 - 2013-01-20 11:13 - 00000000 ___RD C:\Users\Florian\Dropbox
2013-11-13 12:48 - 2012-04-03 12:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-13 12:35 - 2013-11-13 12:35 - 00001743 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-13 12:35 - 2013-11-13 12:34 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-13 12:35 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files\iTunes
2013-11-13 12:35 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-13 12:34 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files\iPod
2013-10-23 12:56 - 2012-01-01 11:57 - 00000000 ____D C:\Users\Florian\AppData\Roaming\DivX
2013-10-23 08:16 - 2009-07-13 21:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-22 09:17 - 2013-10-22 09:11 - 00000000 ____D C:\Users\Florian\Desktop\Serien

Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

2
Restore point made on: 2013-11-11 13:05:29
Restore point made on: 2013-11-13 12:32:52

==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 4060.61 MB
Available physical RAM: 3448.56 MB
Total Pagefile: 4058.76 MB
Available Pagefile: 3436.22 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:113 GB) (Free:10.67 GB) NTFS
Drive d: () (Fixed) (Total:167.1 GB) (Free:0 GB) NTFS
Drive f: (SAMSUNG_REC) (Fixed) (Total:17.89 GB) (Free:0.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (Lexar) (Removable) (Total:29.21 GB) (Free:5.42 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 8074A547)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=113 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=167 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=18 GB) - (Type=27)

========================================================
Disk: 1 (Size: 29 GB) (Disk ID: 672E53E2)
Partition 1: (Not Active) - (Size=29 GB) - (Type=0B)


LastRegBack: 2013-11-10 01:33

==================== End Of Log ============================