Interpol Trojaner Windows 7

BeGaBung · 28.12.2013, 20:55

Ich habe ein Problem mit einem Trojaner...

Mein Pc lässt sich nicht im abgesicherten Modus starten.

Anbei schonmal das erste Logfile.

Bitte um Hilfe!!!

[
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013 (ATTENTION: ====> FRST version is 50 days old and could be outdated)
Ran by SYSTEM on MININT-TP0B6KJ on 21-11-2013 22:25:38
Running from H:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11369576 2010-08-10] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2586504 2010-08-05] (ELAN Microelectronics Corp.)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-13] (Microsoft Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2011-06-07] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-01] (Apple Inc.)
HKU\Florian\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
HKU\Florian\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)
HKU\Florian\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\Florian\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3561816 2013-10-16] (Electronic Arts)
HKU\Tanja\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk
ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Internet.lnk
ShortcutTarget: DSL Internet.lnk -> C:\Program Files (x86)\1&1\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk
ShortcutTarget: DSL Protect.lnk -> C:\Program Files (x86)\1&1\FwebProt.exe (AVM Berlin)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Tanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S2 IGDCTRL; C:\Program Files (x86)\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin)
S2 N360; C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe [130008 2011-04-16] (Symantec Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-05-31] (Symantec Corporation)
S2 WTGService; C:\Program Files (x86)\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()
S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x]

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-06-19] ()
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-28] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-06-19] ()
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)
S3 SRTSP; C:\Windows\System32\Drivers\N360x64\0502020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\N360x64\0502020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\N360x64\0502020.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\N360x64\0502020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-06-21] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-15 13:15 - 2009-07-13 17:14 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2013-11-15 13:14 - 2010-05-06 05:00 - 01026048 _____ (Microsoft Corporation) C:\Windows\System32\mstime.dll
2013-11-15 13:14 - 2010-05-06 04:41 - 00606208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2013-11-15 13:14 - 2009-07-13 17:41 - 00267776 _____ (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2013-11-15 13:14 - 2009-07-13 17:41 - 00156160 _____ (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2013-11-15 13:14 - 2009-07-13 17:40 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\admparse.dll
2013-11-15 13:14 - 2009-07-13 17:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\corpol.dll
2013-11-15 13:14 - 2009-07-13 17:27 - 00163840 _____ (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2013-11-15 13:14 - 2009-07-13 17:15 - 00229376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2013-11-15 13:14 - 2009-07-13 17:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2013-11-15 13:14 - 2009-07-13 17:15 - 00018432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\corpol.dll
2013-11-15 13:14 - 2009-07-13 17:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2013-11-15 13:14 - 2009-07-13 17:05 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2013-11-15 13:14 - 2009-06-10 12:45 - 00000003 _____ C:\Windows\System32\Drivers\MsftWdf_Kernel_01009_Inbox_Critical.Wdf
2013-11-15 13:13 - 2013-11-15 13:13 - 00274904 _____ C:\Windows\Minidump\111513-28470-01.dmp
2013-11-15 04:22 - 2013-11-15 13:13 - 492919575 _____ C:\Windows\MEMORY.DMP
2013-11-15 04:22 - 2013-11-15 04:22 - 00274904 _____ C:\Windows\Minidump\111513-30607-01.dmp
2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx
2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv
2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss
2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss
2013-11-13 12:35 - 2013-11-13 12:35 - 00001743 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-13 12:34 - 2013-11-13 12:35 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-13 12:34 - 2013-11-13 12:35 - 00000000 ____D C:\Program Files\iTunes
2013-11-13 12:34 - 2013-11-13 12:35 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-13 12:34 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files\iPod
2013-10-22 09:11 - 2013-10-22 09:17 - 00000000 ____D C:\Users\Florian\Desktop\Serien

==================== One Month Modified Files and Folders =======

2013-11-15 13:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-11-15 13:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\oobe
2013-11-15 13:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\com
2013-11-15 13:14 - 2013-11-14 13:05 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx
2013-11-15 13:14 - 2013-11-14 13:05 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv
2013-11-15 13:14 - 2013-01-20 11:11 - 00000000 ____D C:\Users\Florian\AppData\Roaming\Dropbox
2013-11-15 13:14 - 2012-11-15 11:51 - 00000000 ____D C:\Program Files (x86)\Origin
2013-11-15 13:14 - 2012-01-01 11:38 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-15 13:14 - 2011-04-26 11:12 - 00000000 ____D C:\Users\Florian\Tracing
2013-11-15 13:13 - 2013-11-15 13:13 - 00274904 _____ C:\Windows\Minidump\111513-28470-01.dmp
2013-11-15 13:13 - 2013-11-15 04:22 - 492919575 _____ C:\Windows\MEMORY.DMP
2013-11-15 13:13 - 2011-11-10 09:38 - 00000000 ____D C:\Windows\Minidump
2013-11-15 13:13 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-15 13:13 - 2009-07-13 20:51 - 00218260 _____ C:\Windows\setupact.log
2013-11-15 04:23 - 2012-01-01 11:38 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-15 04:22 - 2013-11-15 04:22 - 00274904 _____ C:\Windows\Minidump\111513-30607-01.dmp
2013-11-14 13:10 - 2010-08-31 15:01 - 02029567 _____ C:\Windows\WindowsUpdate.log
2013-11-14 13:07 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-14 13:07 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-14 13:06 - 2010-11-19 11:16 - 00000000 ____D C:\Users\Florian\AppData\Local\CrashDumps
2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss
2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss
2013-11-14 13:01 - 2013-01-20 11:13 - 00000000 ___RD C:\Users\Florian\Dropbox
2013-11-13 12:48 - 2012-04-03 12:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-13 12:35 - 2013-11-13 12:35 - 00001743 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-13 12:35 - 2013-11-13 12:34 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-13 12:35 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files\iTunes
2013-11-13 12:35 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-13 12:34 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files\iPod
2013-10-23 12:56 - 2012-01-01 11:57 - 00000000 ____D C:\Users\Florian\AppData\Roaming\DivX
2013-10-23 08:16 - 2009-07-13 21:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-22 09:17 - 2013-10-22 09:11 - 00000000 ____D C:\Users\Florian\Desktop\Serien

Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

2
Restore point made on: 2013-11-11 13:05:29
Restore point made on: 2013-11-13 12:32:52

==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 4060.61 MB
Available physical RAM: 3448.56 MB
Total Pagefile: 4058.76 MB
Available Pagefile: 3436.22 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:113 GB) (Free:10.67 GB) NTFS
Drive d: () (Fixed) (Total:167.1 GB) (Free:0 GB) NTFS
Drive f: (SAMSUNG_REC) (Fixed) (Total:17.89 GB) (Free:0.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (Lexar) (Removable) (Total:29.21 GB) (Free:5.42 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 8074A547)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=113 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=167 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=18 GB) - (Type=27)

========================================================
Disk: 1 (Size: 29 GB) (Disk ID: 672E53E2)
Partition 1: (Not Active) - (Size=29 GB) - (Type=0B)


LastRegBack: 2013-11-10 01:33

==================== End Of Log ============================

--- --- ---
]

aharonov · 28.12.2013, 21:58

Hallo,

startet der Rechner nach diesem Fix wieder normal?

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk
ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation)
S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x]
2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx
2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv
2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss
2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss
C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

BeGaBung · 28.12.2013, 22:26

Hallo,

Rechner startet nicht normal, auch nicht im abgesicherten Modus...

aharonov · 28.12.2013, 23:39

Auch nach dem Fix nicht?
Poste bitte das Fixlog wie angegeben.

BeGaBung · 28.12.2013, 23:48

Wie soll ich denn den Text kopieren und da rein bekommen? Wenn ich den Rechner normal starte wird der Bildschirm nach ein paar Sekunden blau und startet sich dann automatisch neu

aharonov · 29.12.2013, 18:00

Hast du den Fix wie angegeben durchgeführt?

Zitat:

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Mach bitte einen neuen Scan mit FRST in den Reperaturoptionen.

BeGaBung · 29.12.2013, 19:07

Hallo Leo,

danke schonmal für deine Hilfe.
Habe den Scan nochmal durchgeführt

Hier das neue Protokoll

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013 (ATTENTION: ====> FRST version is 88 days old and could be outdated)
Ran by SYSTEM on MININT-PQ1FHFR on 29-12-2013 18:59:36
Running from H:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11369576 2010-08-10] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2586504 2010-08-05] (ELAN Microelectronics Corp.)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-13] (Microsoft Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2011-06-07] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-01] (Apple Inc.)
HKU\Florian\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
HKU\Florian\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)
HKU\Florian\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\Florian\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3561816 2013-10-16] (Electronic Arts)
HKU\Tanja\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk
ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Internet.lnk
ShortcutTarget: DSL Internet.lnk -> C:\Program Files (x86)\1&1\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk
ShortcutTarget: DSL Protect.lnk -> C:\Program Files (x86)\1&1\FwebProt.exe (AVM Berlin)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Tanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S2 IGDCTRL; C:\Program Files (x86)\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin)
S2 N360; C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe [130008 2011-04-16] (Symantec Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-05-31] (Symantec Corporation)
S2 WTGService; C:\Program Files (x86)\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()
S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x]

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-06-19] ()
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-28] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-06-19] ()
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)
S3 SRTSP; C:\Windows\System32\Drivers\N360x64\0502020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\N360x64\0502020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\N360x64\0502020.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\N360x64\0502020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-06-21] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-28 13:23 - 2013-12-28 13:23 - 00274904 _____ C:\Windows\Minidump\122813-24460-01.dmp

==================== One Month Modified Files and Folders =======

2013-12-28 13:23 - 2013-12-28 13:23 - 00274904 _____ C:\Windows\Minidump\122813-24460-01.dmp
2013-12-28 13:23 - 2011-11-10 09:38 - 00000000 ____D C:\Windows\Minidump
2013-12-28 13:22 - 2013-11-14 13:05 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx
2013-12-28 13:22 - 2013-11-14 13:05 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv
2013-12-28 13:22 - 2011-04-26 11:12 - 00000000 ____D C:\Users\Florian\Tracing
2013-12-28 13:21 - 2012-11-15 11:51 - 00000000 ____D C:\Program Files (x86)\Origin
2013-12-28 13:21 - 2012-01-01 11:38 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-28 13:20 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-28 13:20 - 2009-07-13 20:51 - 00218372 _____ C:\Windows\setupact.log

Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

2
Restore point made on: 2013-11-11 13:05:29
Restore point made on: 2013-11-13 12:32:52

==================== Memory info =========================== 

Percentage of memory in use: 14%
Total physical RAM: 4060.61 MB
Available physical RAM: 3452.24 MB
Total Pagefile: 4058.76 MB
Available Pagefile: 3446.75 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:113 GB) (Free:11.09 GB) NTFS
Drive d: () (Fixed) (Total:167.1 GB) (Free:0 GB) NTFS
Drive f: (SAMSUNG_REC) (Fixed) (Total:17.89 GB) (Free:0.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (Lexar) (Removable) (Total:29.21 GB) (Free:8.33 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 8074A547)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=113 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=167 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=18 GB) - (Type=27)

========================================================
Disk: 1 (Size: 29 GB) (Disk ID: 672E53E2)
Partition 1: (Not Active) - (Size=29 GB) - (Type=0B)


LastRegBack: 2013-11-10 01:33

==================== End Of Log ============================

--- --- ---

aharonov · 30.12.2013, 12:19

Du hast den Fix offenbar nicht wie angegeben ausgeführt - das Zeugs ist alles noch da.
Wiederhole den zuvor angegebenen Fix bitte. Die erstellte fixlist.txt sollte auf neben der frst64.exe auf dem gleichen USB-Stick gespeichert werden.

BeGaBung · 30.12.2013, 15:28

Kannst du hiermit was anfangen?

Code:

ATTFilter

 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2013
Ran by SYSTEM at 2013-12-30 15:17:10 Run:2
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation) S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x] 2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx 2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv 2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss 2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll
*****************

C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation) S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x] 2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx 2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv 2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss 2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll not found.
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk C:\PROGRA~3\flt7nbrqm4.dss C:\ProgramData\4mqrbn7tlf.pss C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll not found.
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation) Winmgmt => Service not found.

==== End of Fixlog ====

aharonov · 31.12.2013, 15:38

Zitat:

Kannst du hiermit was anfangen?

Ja, jetzt sehe ich, warum das nicht klappt: Dir gehen im Fixskript die Zeilenumbrüche verloren! Wiederhole den Fix bitte und achte darauf, dass deine fixlist.txt genau so aussieht wie die Vorgabe in der Codebox. Also 8 Zeilen und nicht eine einzige.

BeGaBung · 02.01.2014, 14:56

so, hier noch einmal neu...
danke für deine geduld ;-)
bin leider in so sachen nicht so begabt...

Code:

ATTFilter

 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2013
Ran by SYSTEM at 2014-01-02 14:54:19 Run:3
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk
ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation)
S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x]
2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx
2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv
2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss
2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation)
C:\ProgramData\4mqrbn7tlf.pss C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll 
*****************

C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk => Moved successfully.
C:\PROGRA~3\flt7nbrqm4.dss => Moved successfully.
Winmgmt => Service restored successfully.
C:\ProgramData\4mqrbn7tlf.bxx => Moved successfully.
C:\ProgramData\4mqrbn7tlf.fvv => Moved successfully.
"C:\ProgramData\flt7nbrqm4.dss" => File/Directory not found.
"2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation)" => File/Directory not found.
"C:\ProgramData\4mqrbn7tlf.pss C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll " => File/Directory not found.

==== End of Fixlog ====

aharonov · 02.01.2014, 14:58

So, jetzt hat nur noch ein Zeilenumbruch gefehlt..

(in deiner letzten Zeile)
Aber das spielt möglicherweise keine Rolle. Startet der Rechner jetzt wieder normal ohne den Sperrbildschirm?

BeGaBung · 02.01.2014, 15:05

nein, fahre den rechner normal hoch,
und nach ein paar sekunden erscheint zwar nicht mehr der interpol sperrbildschirm,
dafür erscheint ein blauer bildschirm für ein paar sekunden,
danach startet der rechner neu

aharonov · 02.01.2014, 16:35

Dann mach bitte einen frischen FRST-Scan.

BeGaBung · 02.01.2014, 19:12

hier das neue scan protokoll

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013 (ATTENTION: ====> FRST version is 92 days old and could be outdated)
Ran by SYSTEM on MININT-VRU6Q77 on 02-01-2014 19:05:21
Running from H:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11369576 2010-08-10] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2586504 2010-08-05] (ELAN Microelectronics Corp.)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-13] (Microsoft Corporation)
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2011-06-07] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-01] (Apple Inc.)
HKU\Florian\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
HKU\Florian\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)
HKU\Florian\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\Florian\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3561816 2013-10-16] (Electronic Arts)
HKU\Tanja\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Internet.lnk
ShortcutTarget: DSL Internet.lnk -> C:\Program Files (x86)\1&1\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk
ShortcutTarget: DSL Protect.lnk -> C:\Program Files (x86)\1&1\FwebProt.exe (AVM Berlin)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Tanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S2 IGDCTRL; C:\Program Files (x86)\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin)
S2 N360; C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe [130008 2011-04-16] (Symantec Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-05-31] (Symantec Corporation)
S2 WTGService; C:\Program Files (x86)\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-06-19] ()
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-28] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-06-19] ()
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)
S3 SRTSP; C:\Windows\System32\Drivers\N360x64\0502020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\N360x64\0502020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\N360x64\0502020.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\N360x64\0502020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-06-21] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-02 06:24 - 2014-01-02 06:25 - 00274904 _____ C:\Windows\Minidump\010214-24304-01.dmp
2014-01-02 06:21 - 2014-01-02 06:21 - 00274904 _____ C:\Windows\Minidump\010214-42369-01.dmp
2014-01-02 06:02 - 2014-01-02 06:02 - 00274904 _____ C:\Windows\Minidump\010214-36941-01.dmp
2013-12-30 06:59 - 2013-12-30 06:59 - 00274904 _____ C:\Windows\Minidump\123013-37097-01.dmp
2013-12-30 06:34 - 2013-12-30 06:35 - 00274904 _____ C:\Windows\Minidump\123013-44085-01.dmp
2013-12-30 06:27 - 2013-12-30 06:28 - 00274904 _____ C:\Windows\Minidump\123013-54506-01.dmp
2013-12-30 05:44 - 2013-12-30 05:44 - 00270608 _____ C:\Windows\Minidump\123013-104099-01.dmp
2013-12-28 13:23 - 2013-12-28 13:23 - 00274904 _____ C:\Windows\Minidump\122813-24460-01.dmp

==================== One Month Modified Files and Folders =======

2014-01-02 06:33 - 2012-01-01 11:38 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-02 06:33 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-02 06:33 - 2009-07-13 20:51 - 00218764 _____ C:\Windows\setupact.log
2014-01-02 06:25 - 2014-01-02 06:24 - 00274904 _____ C:\Windows\Minidump\010214-24304-01.dmp
2014-01-02 06:24 - 2011-11-10 09:38 - 00000000 ____D C:\Windows\Minidump
2014-01-02 06:22 - 2012-11-15 11:51 - 00000000 ____D C:\Program Files (x86)\Origin
2014-01-02 06:22 - 2011-04-26 11:12 - 00000000 ____D C:\Users\Florian\Tracing
2014-01-02 06:21 - 2014-01-02 06:21 - 00274904 _____ C:\Windows\Minidump\010214-42369-01.dmp
2014-01-02 06:04 - 2013-01-20 11:11 - 00000000 ____D C:\Users\Florian\AppData\Roaming\Dropbox
2014-01-02 06:02 - 2014-01-02 06:02 - 00274904 _____ C:\Windows\Minidump\010214-36941-01.dmp
2013-12-30 06:59 - 2013-12-30 06:59 - 00274904 _____ C:\Windows\Minidump\123013-37097-01.dmp
2013-12-30 06:35 - 2013-12-30 06:34 - 00274904 _____ C:\Windows\Minidump\123013-44085-01.dmp
2013-12-30 06:28 - 2013-12-30 06:27 - 00274904 _____ C:\Windows\Minidump\123013-54506-01.dmp
2013-12-30 05:44 - 2013-12-30 05:44 - 00270608 _____ C:\Windows\Minidump\123013-104099-01.dmp
2013-12-28 13:23 - 2013-12-28 13:23 - 00274904 _____ C:\Windows\Minidump\122813-24460-01.dmp

Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

1
Restore point made on: 2013-11-13 12:32:52

==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 4060.61 MB
Available physical RAM: 3437.43 MB
Total Pagefile: 4058.76 MB
Available Pagefile: 3430.36 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:113 GB) (Free:11.36 GB) NTFS
Drive d: () (Fixed) (Total:167.1 GB) (Free:0 GB) NTFS
Drive f: (SAMSUNG_REC) (Fixed) (Total:17.89 GB) (Free:0.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (Lexar) (Removable) (Total:29.21 GB) (Free:8.33 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 8074A547)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=113 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=167 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=18 GB) - (Type=27)

========================================================
Disk: 1 (Size: 29 GB) (Disk ID: 672E53E2)
Partition 1: (Not Active) - (Size=29 GB) - (Type=0B)


LastRegBack: 2013-11-10 01:33

==================== End Of Log ============================

--- --- ---

28.12.2013, 23:39	#4
aharonov /// TB-Ausbilder	Interpol Trojaner Windows 7 Auch nach dem Fix nicht? Poste bitte das Fixlog wie angegeben. __________________ cheers, Leo

30.12.2013, 12:19	#8
aharonov /// TB-Ausbilder	Interpol Trojaner Windows 7 Du hast den Fix offenbar nicht wie angegeben ausgeführt - das Zeugs ist alles noch da. Wiederhole den zuvor angegebenen Fix bitte. Die erstellte fixlist.txt sollte auf neben der frst64.exe auf dem gleichen USB-Stick gespeichert werden. __________________ cheers, Leo

02.01.2014, 14:58	#12
aharonov /// TB-Ausbilder	Interpol Trojaner Windows 7 So, jetzt hat nur noch ein Zeilenumbruch gefehlt.. (in deiner letzten Zeile) Aber das spielt möglicherweise keine Rolle. Startet der Rechner jetzt wieder normal ohne den Sperrbildschirm? __________________ cheers, Leo

02.01.2014, 16:35	#14
aharonov /// TB-Ausbilder	Interpol Trojaner Windows 7 Dann mach bitte einen frischen FRST-Scan. __________________ cheers, Leo

Interpol Trojaner Windows 7

Log-Analyse und Auswertung: Interpol Trojaner Windows 7