Troj.gen.zlob in C:\windows\system32\asfar.exe

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-01-2015
Ran by SYSTEM at 2015-01-12 09:00:56 Run:2
Running from K:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
2014-12-22 17:02 - 2014-12-22 17:02 - 00000000 ____D () C:\Users\Bonkers\AppData\Local\Desktop_Dock
2014-12-22 17:01 - 2014-12-22 17:01 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\qjnhzepq
Emptytemp:
         
*****************

C:\Users\Bonkers\AppData\Local\Desktop_Dock => Moved successfully.
C:\Users\Bonkers\AppData\Roaming\qjnhzepq => Moved successfully.
Emptytemp: => Error: This directive works only outside recovery mode.

==== End of Fixlog 09:00:57 ====
         

Ran by SYSTEM on MININT-V194UIF on 12-01-2015 09:09:18
Running from K:\
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7202520 2013-08-19] (Realtek Semiconductor)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-11] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BF2Hub Client] => C:\Program Files (x86)\BF2Hub Client\bf2hub.exe [1521664 2014-07-17] (BF2Hub Systems)
HKU\Bonkers\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\Bonkers\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\Bonkers\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-20] (Advanced Micro Devices, Inc.)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-11] (Avira Operations GmbH & Co. KG)
S2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-12-06] ()
S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-12-16] (Advanced Micro Devices)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-23] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-23] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-11-21] (Disc Soft Ltd)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-09 15:51 - 2015-01-09 15:51 - 00358595 _____ () C:\Users\Bonkers\Desktop\bookmarks-2015-01-09.json
2015-01-09 10:20 - 2015-01-09 20:38 - 00037624 _____ () C:\Windows\System32\Drivers\TrueSight.sys
2015-01-09 10:20 - 2015-01-09 10:20 - 00000000 ____D () C:\ProgramData\RogueKiller
2015-01-09 10:15 - 2015-01-07 11:38 - 18467928 _____ () C:\Users\Bonkers\Desktop\RogueKillerX64.exe
2015-01-08 20:41 - 2015-01-08 20:41 - 00003886 _____ () C:\Windows\System32\.crusader
2015-01-08 17:51 - 2015-01-08 17:51 - 00008926 _____ () C:\Users\Bonkers\Desktop\HitmanPro_20150108_1751.log
2015-01-08 17:38 - 2015-01-08 20:41 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-01-08 17:34 - 2015-01-08 17:35 - 11222744 _____ (SurfRight B.V.) C:\Users\Bonkers\Desktop\HitmanPro_x64.exe
2015-01-07 17:13 - 2015-01-12 08:38 - 00000000 ____D () C:\Users\Bonkers\AppData\Local\JDownloader 2.0
2015-01-07 16:45 - 2015-01-07 16:45 - 00001594 _____ () C:\Users\Bonkers\Desktop\Fixlist.txt
2015-01-07 12:33 - 2015-01-12 09:09 - 00000000 ____D () C:\FRST
2015-01-07 12:18 - 2015-01-07 12:18 - 00017589 _____ () C:\Windows\DirectX.log
2015-01-07 08:53 - 2015-01-07 11:58 - 00000000 ____D () C:\Users\Bonkers\AppData\Local\JDownloader v2.0
2015-01-06 18:06 - 2015-01-06 18:06 - 00000000 ____H () C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2015-01-06 17:35 - 2015-01-06 18:10 - 00000000 ____D () C:\Users\Bonkers\Desktop\Usedom 14 15
2015-01-05 10:29 - 2015-01-05 10:29 - 00001452 _____ () C:\DelFix.txt
2015-01-05 10:28 - 2015-01-05 10:28 - 00352076 _____ () C:\Users\Bonkers\Desktop\bookmarks-2015-01-05.json
2015-01-05 10:17 - 2015-01-05 10:19 - 00000000 ____D () C:\ProgramData\Max Secure
2015-01-05 10:12 - 2015-01-05 10:13 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\GetRightToGo
2015-01-05 10:12 - 2015-01-05 10:12 - 00000000 ____D () C:\Users\Bonkers\AppData\Local\Max Secure Software
2015-01-04 12:06 - 2015-01-08 09:32 - 00000000 ____D () C:\Users\Bonkers\Desktop\Bewerbung aktuell
2015-01-02 20:26 - 2015-01-05 10:29 - 00000000 ____D () C:\Windows\ERUNT
2014-12-27 10:14 - 2014-12-27 10:22 - 00000000 ____D () C:\Windows\erdnt
2014-12-26 11:11 - 2015-01-12 09:06 - 00003949 _____ () C:\Windows\setupact.log
2014-12-26 11:11 - 2014-12-26 11:11 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-26 11:10 - 2015-01-07 16:49 - 00051744 _____ () C:\Windows\PFRO.log
2014-12-26 10:09 - 2015-01-02 20:23 - 00000000 ____D () C:\Windows\System32\log
2014-12-26 09:53 - 2014-12-26 09:53 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-12-26 09:53 - 2014-12-26 09:53 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-24 12:30 - 2014-12-24 12:30 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-24 11:58 - 2015-01-07 12:38 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-12-24 11:58 - 2014-12-27 19:51 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-24 11:58 - 2014-12-24 11:58 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-24 11:58 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2014-12-24 11:58 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys
2014-12-24 11:58 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2014-12-22 20:29 - 2014-12-27 10:10 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-12-22 18:23 - 2014-12-22 18:23 - 00000000 _____ () C:\autoexec.bat
2014-12-22 16:47 - 2014-12-22 16:47 - 00002290 _____ () C:\Windows\patsearch.bin
2014-12-22 16:46 - 2014-12-22 16:55 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\StormFall
2014-12-22 16:46 - 2014-12-22 16:51 - 00000000 ____D () C:\Users\Bonkers\AppData\Local\Sparta
2014-12-22 16:46 - 2014-12-22 16:46 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\sparta111
2014-12-22 16:46 - 2014-12-22 16:46 - 00000000 ____D () C:\Users\Bonkers\AppData\Local\StormFall
2014-12-19 12:38 - 2014-12-19 12:40 - 00000000 ____D () C:\Users\Bonkers\Desktop\MGS V
2014-12-18 08:03 - 2014-12-18 08:18 - 00000000 ____D () C:\Users\Bonkers\Desktop\Stick
2014-12-18 07:36 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-12-18 07:36 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-17 08:42 - 2014-12-17 09:44 - 00000000 ____D () C:\ProgramData\Origin
2014-12-17 08:42 - 2014-12-17 08:42 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\Origin
2014-12-17 08:42 - 2014-12-17 08:42 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-12-16 17:41 - 2014-12-17 08:42 - 00000000 ____D () C:\ProgramData\Electronic Arts
2014-12-16 16:56 - 2014-12-16 17:41 - 00000000 ____D () C:\Users\Bonkers\Documents\FUSSBALL MANAGER 10
2014-12-16 16:56 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-12-16 16:53 - 2014-12-17 08:42 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts
2014-12-16 16:52 - 2014-12-16 16:52 - 00003044 _____ () C:\Windows\System32\Tasks\{A32FE87B-45CE-4AA7-B6DF-40C336FD7AF3}
2014-12-16 08:18 - 2014-12-16 08:18 - 03951038 _____ () C:\Users\Bonkers\Desktop\rld-f0u5.7z
2014-12-15 14:45 - 2014-12-15 14:46 - 00000000 ____D () C:\Users\Bonkers\Downloads\Trance Zen Dental Spa
2014-12-15 14:44 - 2015-01-07 08:55 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\uTorrent

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-12 09:06 - 2014-11-21 18:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-12 09:06 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-12 09:05 - 2014-11-21 18:25 - 01355104 _____ () C:\Windows\WindowsUpdate.log
2015-01-12 09:05 - 2009-07-14 05:45 - 00026352 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-12 09:05 - 2009-07-14 05:45 - 00026352 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-12 08:54 - 2014-11-21 21:26 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\vlc
2015-01-12 08:43 - 2014-11-21 21:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-10 20:27 - 2014-11-21 21:38 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\AIMP3
2015-01-09 20:52 - 2014-11-22 18:07 - 00000000 ____D () C:\Users\Bonkers\AppData\Local\CrashDumps
2015-01-07 17:21 - 2011-03-07 12:10 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2015-01-07 16:47 - 2014-11-21 18:26 - 00000000 ____D () C:\Windows\System32\Tasks\ASUS
2015-01-07 13:00 - 2014-11-23 12:24 - 00000000 ____D () C:\Users\Bonkers\Documents\My Games
2015-01-07 12:23 - 2014-11-21 19:58 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-07 11:57 - 2014-11-21 20:52 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\DAEMON Tools Lite
2015-01-06 17:37 - 2014-11-21 19:39 - 00111912 _____ () C:\Users\Bonkers\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-05 10:30 - 2009-07-14 05:45 - 00435528 _____ () C:\Windows\System32\FNTCACHE.DAT
2015-01-04 12:03 - 2014-11-29 10:07 - 00000000 ____D () C:\Users\Bonkers\Desktop\Bewerbung
2014-12-28 07:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-27 10:20 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-12-26 09:58 - 2014-11-22 01:17 - 00000000 ____D () C:\Windows\Panther
2014-12-25 11:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-12-24 15:17 - 2014-11-21 20:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-24 12:31 - 2014-12-09 15:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-22 18:23 - 2014-11-21 18:25 - 00000000 ____D () C:\users\Bonkers
2014-12-22 17:47 - 2014-11-21 20:37 - 00000000 ____D () C:\ProgramData\Avira
2014-12-22 17:47 - 2014-11-21 20:37 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-22 17:45 - 2014-11-21 21:38 - 00000000 ____D () C:\Program Files (x86)\AIMP3
2014-12-22 17:44 - 2014-11-21 20:48 - 00000000 ____D () C:\Windows\System32\appmgmt
2014-12-22 17:12 - 2014-11-21 18:45 - 00000000 ____D () C:\ProgramData\Norton
2014-12-22 16:52 - 2014-12-01 13:58 - 00000000 ____D () C:\Program Files (x86)\BF2Hub Client
2014-12-22 16:52 - 2014-11-23 09:34 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\ICQM
2014-12-21 20:48 - 2014-12-02 19:33 - 00000000 ____D () C:\Users\Bonkers\AppData\Roaming\Skype
2014-12-15 16:16 - 2014-11-21 21:13 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-15 16:16 - 2014-11-21 21:13 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-15 16:16 - 2014-11-21 21:13 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-15 16:16 - 2014-11-21 21:07 - 00000000 ____D () C:\Users\Bonkers\AppData\Local\Adobe
2014-12-13 11:05 - 2014-11-21 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-13 11:05 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

Some content of TEMP:
====================
C:\Users\Bonkers\AppData\Local\Temp\avgnt.exe
C:\Users\Bonkers\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Bonkers\AppData\Local\Temp\proxy_vole9047108747479824946.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2015-01-08 12:37:42
Restore point made on: 2015-01-08 20:40:25
Restore point made on: 2015-01-08 20:41:30

==================== Memory info =========================== 

Percentage of memory in use: 10%
Total physical RAM: 8093.13 MB
Available physical RAM: 7240.61 MB
Total Pagefile: 8091.32 MB
Available Pagefile: 7229.53 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:102.44 GB) (Free:42.31 GB) NTFS
Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Schule) (Fixed) (Total:293.43 GB) (Free:293.24 GB) NTFS
Drive f: (Download) (Fixed) (Total:442.38 GB) (Free:352.29 GB) NTFS
Drive h: (Welten) (Fixed) (Total:200.2 GB) (Free:195.19 GB) NTFS
Drive j: (GSP1RMCULXFRER_DE_DVD) (CDROM) (Total:3.04 GB) (Free:0 GB) UDF
Drive k: (FLASH DRIVE) (Removable) (Total:1.85 GB) (Free:1.62 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (Spiele) (Fixed) (Total:489.13 GB) (Free:314.64 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: BBCC6936)
Partition 1: (Not Active) - (Size=489.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=442.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 80B6AAAC)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=102.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=200.2 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=293.4 GB) - (Type=OF Extended)

========================================================
Disk: 3 (Size: 1.9 GB) (Disk ID: AC4EABA7)
Partition 1: (Not Active) - (Size=1.9 GB) - (Type=0E)


LastRegBack: 2015-01-05 16:29

==================== End Of Log ============================