GVU Trojaner 2.12

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
Ran by SYSTEM on MININT-35J7H12 on 30-01-2014 10:54:39
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9955872 2010-01-12] (Realtek Semiconductor)
HKLM\...\Run: [fspuip] - C:\Program Files\FSP\fspuip.exe [3770368 2010-01-06] (Sentelic Corporation)
HKLM\...\Run: [Bdagent] - C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1575192 2013-10-24] (Bitdefender)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-11-20] (Intel Corporation)
HKLM-x32\...\Run: [HotKeyOSD] - C:\Program Files (x86)\Hotkey OSD Driver\HotKeyOSD.exe [232528 2010-01-18] (Dritek System Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LexwareInfoService] - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339312 2010-09-15] (Haufe-Lexware GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

==================== Services (Whitelisted) =================

S2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [67320 2013-10-24] (Bitdefender)
S2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1645256 2013-10-24] (Bitdefender)
S2 Winmgmt; C:\Users\Sandra\AppData\Local\Temp\8zbodqg9.zvv [x]

==================== Drivers (Whitelisted) ====================

S0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-10-24] (BitDefender)
S3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-12-19] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-10-24] (BitDefender)
S1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-10-24] (BitDefender SRL)
S0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-10-24] (BitDefender LLC)
S0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-10-24] (BitDefender S.R.L.)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-30 10:54 - 2014-01-30 10:54 - 00000000 ____D C:\FRST
2014-01-30 00:07 - 2014-01-30 00:07 - 00000000 ____D C:\Windows\LastGood
2014-01-29 23:20 - 2014-01-29 23:20 - 00000000 ____D C:\Medion
2014-01-29 22:52 - 2014-01-29 22:52 - 00000000 ____D C:\Windows\ERUNT
2014-01-29 19:54 - 2014-01-29 22:42 - 00000000 ____D C:\AdwCleaner
2014-01-29 17:50 - 2014-01-29 17:50 - 00000282 ____H C:\Windows\Tasks\User_Feed_Synchronization-{CED04B67-25C1-42D5-A176-8E52FEFC339D}.job
2014-01-13 16:26 - 2014-01-13 16:26 - 00000000 ____D C:\Users\Sandra\AppData\Local\Haufe-Lexware_GmbH_&_Co._
2014-01-13 16:25 - 2014-01-13 16:25 - 00002773 _____ C:\Users\Public\Desktop\Lexware zeitmanagement.lnk
2014-01-13 16:25 - 2014-01-13 16:25 - 00000000 ____D C:\Users\Sandra\AppData\Roaming\Lexware
2014-01-13 16:25 - 2014-01-13 16:25 - 00000000 ____D C:\ProgramData\Lexware
2014-01-13 16:20 - 2014-01-15 15:32 - 00000000 ____D C:\Users\Sandra\AppData\Local\Lexware
2014-01-13 16:20 - 2014-01-13 16:25 - 00000000 ____D C:\Program Files (x86)\lexware
2014-01-13 16:17 - 2014-01-13 16:17 - 110063680 _____ C:\Users\Sandra\Downloads\Zeitmanagement2011.exe

==================== One Month Modified Files and Folders =======

2014-01-30 10:54 - 2014-01-30 10:54 - 00000000 ____D C:\FRST
2014-01-30 00:12 - 2012-07-04 16:25 - 01634941 _____ C:\Windows\WindowsUpdate.log
2014-01-30 00:12 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-30 00:12 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-30 00:07 - 2014-01-30 00:07 - 00000000 ____D C:\Windows\LastGood
2014-01-30 00:06 - 2012-07-10 14:15 - 00076603 _____ C:\Windows\setupact.log
2014-01-30 00:06 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-29 23:54 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\NDF
2014-01-29 23:23 - 2013-11-06 11:24 - 00000000 ____D C:\Users\Sandra\Documents\TimePanic
2014-01-29 23:20 - 2014-01-29 23:20 - 00000000 ____D C:\Medion
2014-01-29 22:52 - 2014-01-29 22:52 - 00000000 ____D C:\Windows\ERUNT
2014-01-29 22:42 - 2014-01-29 19:54 - 00000000 ____D C:\AdwCleaner
2014-01-29 22:29 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-29 17:50 - 2014-01-29 17:50 - 00000282 ____H C:\Windows\Tasks\User_Feed_Synchronization-{CED04B67-25C1-42D5-A176-8E52FEFC339D}.job
2014-01-27 19:29 - 2012-12-08 11:27 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{CED04B67-25C1-42D5-A176-8E52FEFC339D}
2014-01-26 19:10 - 2010-11-21 07:50 - 00654166 _____ C:\Windows\System32\perfh007.dat
2014-01-26 19:10 - 2010-11-21 07:50 - 00130006 _____ C:\Windows\System32\perfc007.dat
2014-01-26 19:10 - 2009-07-14 06:13 - 01498506 _____ C:\Windows\System32\PerfStringBackup.INI
2014-01-15 15:32 - 2014-01-13 16:20 - 00000000 ____D C:\Users\Sandra\AppData\Local\Lexware
2014-01-13 16:26 - 2014-01-13 16:26 - 00000000 ____D C:\Users\Sandra\AppData\Local\Haufe-Lexware_GmbH_&_Co._
2014-01-13 16:25 - 2014-01-13 16:25 - 00002773 _____ C:\Users\Public\Desktop\Lexware zeitmanagement.lnk
2014-01-13 16:25 - 2014-01-13 16:25 - 00000000 ____D C:\Users\Sandra\AppData\Roaming\Lexware
2014-01-13 16:25 - 2014-01-13 16:25 - 00000000 ____D C:\ProgramData\Lexware
2014-01-13 16:25 - 2014-01-13 16:20 - 00000000 ____D C:\Program Files (x86)\lexware
2014-01-13 16:17 - 2014-01-13 16:17 - 110063680 _____ C:\Users\Sandra\Downloads\Zeitmanagement2011.exe

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-11-01 16:05:48
Restore point made on: 2013-11-06 11:21:26
Restore point made on: 2013-11-15 14:52:37
Restore point made on: 2013-12-03 13:18:26
Restore point made on: 2013-12-23 13:31:56
Restore point made on: 2014-01-03 19:24:33
Restore point made on: 2014-01-12 22:37:09
Restore point made on: 2014-01-13 16:21:59
Restore point made on: 2014-01-29 23:22:49

==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 3893.86 MB
Available physical RAM: 3285.54 MB
Total Pagefile: 3892.06 MB
Available Pagefile: 3272.26 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:250.01 GB) (Free:204.78 GB) NTFS
Drive e: (Volume) (Fixed) (Total:215.66 GB) (Free:215.53 GB) NTFS
Drive g: (STICK) (Removable) (Total:0.97 GB) (Free:0.97 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.04 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 29A7F6BB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=250 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=216 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 1000 MB) (Disk ID: 91F72D24)
Partition 1: (Active) - (Size=1000 MB) - (Type=0B)


LastRegBack: 2014-01-19 15:39

==================== End Of Log ============================