Interpol Trojaner - Rechner gesperrt - wie bekomme ich den weg ?
Moin,
mich hat es auch mal mit diesem fiesen Trojaner (Interpol) erwischt.
Dank einiger Meldungen meiner Mitleidenden, habe ich schon mal ein wenig versucht.
Habt ihr noch einen Tipp für mich ?
ADW Cleaner: Code:
# AdwCleaner v2.306 - Datei am 12/08/2013 um 22:17:17 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzer : Teske - TESKE-PC
# Bootmodus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\Teske\Downloads\adwcleaner06.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
[OK] Die Registrierungsdatenbank ist sauber.
*************************
AdwCleaner[R1].txt - [608 octets] - [12/08/2013 22:17:17]
########## EOF - C:\AdwCleaner[R1].txt - [667 octets] ##########
Malwarebytes: Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org
Datenbank Version: v2013.08.12.05
Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 10.0.9200.16635
Teske :: TESKE-PC [Administrator]
Schutz: Deaktiviert
12.08.2013 21:57:23
mbam-log-2013-08-12 (21-57-23).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 202300
Laufzeit: 2 Minute(n), 49 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 3
C:\Users\Teske\AppData\Local\Temp\1jfuweif.exe (Trojan.Agent.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Teske\AppData\Local\Temp\hovphsiiqlhcvjhebpl.bfg (Trojan.WinLock.RRE) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Teske\AppData\Local\Temp\jar_cache4824873794731091743.tmp (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende)
Spybot S&D Code:
Search results from Spybot - Search & Destroy
12.08.2013 21:49:46
Scan took 00:12:58.
12 items found.
Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Teske\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\VARN3LBZ\mpsnare.iesnare.com\stm.sol
Properties.size=79
Properties.md5=E7F70AD9C9510BE0D870EC8527F604D6
Properties.filedate=1376333895
Properties.filedatetext=2013-08-12 20:58:14
Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7] Text file (File, nothing done)
C:\Users\Teske\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\VARN3LBZ\heias.com\x\heias_sc.swf\heias.sol
Properties.size=62
Properties.md5=C9FFD1FA506EE1A3B1B92F221A0C2345
Properties.filedate=1376335745
Properties.filedatetext=2013-08-12 21:29:04
MediaPlex: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (User): Teske) (Browser: Cookie, nothing done)
DoubleClick: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (User): Teske) (Browser: Cookie, nothing done)
MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-272256979-2995323171-1074692639-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name
MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name
MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-272256979-2995323171-1074692639-1000\Software\Microsoft\DirectInput\MostRecentApplication\Name
MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-272256979-2995323171-1074692639-1000\Software\Microsoft\DirectInput\MostRecentApplication\Id
Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-272256979-2995323171-1074692639-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Cookie: [SBI $49804B54] Browser: Cookie (64) (Browser: Cookie, nothing done)
Cache: [SBI $49804B54] Browser: Cache (89) (Browser: Cache, nothing done)
--- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) ---
2013-05-16 SDBootCD.exe (2.1.18.109)
2013-05-16 SDCleaner.exe (2.1.18.110)
2013-05-16 SDDelFile.exe (2.1.18.94)
2013-05-16 SDFSSvc.exe (2.1.18.208)
2013-03-20 SDFileScanHelper.exe (2.1.16.1)
2013-05-16 SDFiles.exe (2.1.18.135)
2013-05-16 SDHookHelper.exe (2.1.18.2)
2013-05-16 SDHookInst32.exe (2.1.18.2)
2013-05-16 SDImmunize.exe (2.1.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-05-16 SDOnAccess.exe (2.1.18.4)
2013-05-16 SDPESetup.exe (2.1.18.3)
2013-05-16 SDPEStart.exe (2.1.18.86)
2013-05-16 SDPRE.exe (2.1.18.22)
2013-05-16 SDPhoneScan.exe (2.1.18.28)
2013-05-16 SDPrepPos.exe (2.1.18.10)
2013-05-16 SDQuarantine.exe (2.1.18.103)
2013-05-16 SDRootAlyzer.exe (2.1.18.116)
2013-05-16 SDSBIEdit.exe (2.1.18.39)
2013-05-16 SDScan.exe (2.1.18.177)
2013-05-16 SDScript.exe (2.1.18.53)
2013-05-16 SDSettings.exe (2.1.18.136)
2013-05-16 SDShell.exe (2.1.18.2)
2013-05-16 SDShred.exe (2.1.18.107)
2013-05-16 SDSysRepair.exe (2.1.18.101)
2013-05-16 SDTools.exe (2.1.18.150)
2013-05-16 SDTray.exe (2.1.18.127)
2013-05-16 SDUpdSvc.exe (2.1.18.76)
2013-05-16 SDUpdate.exe (2.1.18.91)
2013-05-15 SDWSCSvc.exe (2.1.18.2)
2013-05-16 SDWelcome.exe (2.1.18.129)
2013-05-16 blindman.exe (2.1.18.151)
2013-05-16 explorer.exe (2.1.18.177)
2013-05-24 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2013-06-18 SDDisableProxy.exe
2013-06-19 spybotsd2-translation-frx.exe
2012-09-05 DelZip190.dll (1.9.0.107)
2013-05-16 SDAV.dll
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDECon32.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-05-16 SDFileScanLibrary.dll (2.1.18.12)
2013-05-16 SDHook32.dll (2.1.18.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2013-05-16 Tools.dll (2.1.18.36)
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-12-18 Includes\Adware.sbi (*)
2013-07-30 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-08-06 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-08-06 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-05-13 Includes\TrojansC-02.sbi (*)
2013-07-31 Includes\TrojansC-03.sbi (*)
2013-08-06 Includes\TrojansC-04.sbi (*)
2013-05-08 Includes\TrojansC-05.sbi (*)
2013-08-06 Includes\TrojansC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
FRST Log: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-08-2013
Ran by Teske (administrator) on 12-08-2013 22:33:21
Running from H:\
Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Safe Mode (with Networking)
==================== Could not list processes ===============
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [LogitechQuickCamRibbon] - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [348664 2012-07-18] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9874024 2010-11-19] (Realtek Semiconductor)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [149280 2013-06-21] (Sun Microsystems, Inc.)
HKLM\...\Runonce: [GrpConv] - grpconv -o [x]
HKLM\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKLM\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [Logitech Vid] - C:\Program Files\Logitech\Logitech Vid\vid.exe [5458704 2009-07-16] (Logitech Inc.)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\RunOnce: [Report] - C:\AdwCleaner[S1].txt [796 2013-08-12] ()
Startup: C:\Users\Teske\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lpbehjvchlqiishpvoh.lnk
ShortcutTarget: lpbehjvchlqiishpvoh.lnk -> C:\Users\Teske\AppData\Local\Temp\hovphsiiqlhcvjhebpl.bfg (No File)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {60B8CC35-639C-4C2F-B1D0-373B79FC852D} URL = hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBox
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msdaipp - No CLSID Value -
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
========================== Services (Whitelisted) =================
S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86224 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110032 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 Winmgmt; C:\PROGRA~3\hovphsiiqlhcvjhebpl.bfg [x]
==================== Drivers (Whitelisted) ====================
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83392 2012-07-18] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137928 2012-07-18] (Avira GmbH)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36000 2012-07-18] (Avira GmbH)
R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [13216 2009-07-17] ()
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-12 22:26 - 2013-08-12 22:26 - 00000000 ____D C:\Windows\ERUNT
2013-08-12 22:21 - 2013-08-12 22:21 - 00959697 _____ (Oleg N. Scherbakov) C:\Users\Teske\Downloads\JRT_5.4.4.exe
2013-08-12 22:20 - 2013-08-12 22:17 - 00000735 _____ C:\Users\Teske\Desktop\AdwCleaner[R1].txt
2013-08-12 22:17 - 2013-08-12 22:17 - 00666633 _____ C:\Users\Teske\Downloads\adwcleaner06.exe
2013-08-12 22:17 - 2013-08-12 22:17 - 00000796 _____ C:\AdwCleaner[S1].txt
2013-08-12 22:17 - 2013-08-12 22:17 - 00000735 _____ C:\AdwCleaner[R1].txt
2013-08-12 21:51 - 2013-08-12 21:51 - 00001067 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\Users\Teske\AppData\Roaming\Malwarebytes
2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-12 21:51 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-12 21:28 - 2013-08-12 21:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Teske\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-12 21:08 - 2013-08-12 21:08 - 00000036 _____ C:\Users\Teske\AppData\Local\housecall.guid.cache
2013-08-12 21:04 - 2011-12-13 09:35 - 00031552 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2013-08-12 21:04 - 2011-12-13 09:29 - 00029504 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll
2013-08-12 21:04 - 2011-12-13 09:29 - 00021312 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2013-08-12 21:03 - 2013-08-12 21:03 - 00002155 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-08-12 21:02 - 2013-08-12 21:03 - 00000000 ____D C:\Program Files\TuneUp Utilities 2011
2013-08-12 21:02 - 2013-08-12 21:02 - 00000000 ____D C:\Users\Teske\AppData\Roaming\TuneUp Software
2013-08-12 21:01 - 2013-08-12 21:02 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-08-12 21:01 - 2013-08-12 21:01 - 00000000 __SHD C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2013-08-12 21:00 - 2013-08-12 21:01 - 24038304 _____ (TuneUp Software) C:\Users\Teske\Downloads\TuneUpUtilities2011_de-DE.exe
2013-08-12 19:43 - 2013-08-12 19:43 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-12 19:41 - 2013-08-12 21:47 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-08-12 19:41 - 2013-08-12 19:41 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-08-08 15:06 - 2013-08-08 15:06 - 00000000 ____D C:\FRST
2013-08-08 14:24 - 2013-08-08 14:48 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-08 14:24 - 2013-08-08 14:24 - 00000000 ____D C:\Users\Teske\Documents\ProcAlyzer Dumps
2013-08-08 14:04 - 2013-08-08 14:05 - 00031232 ___SH C:\Users\Teske\Documents\Thumbs.db
==================== One Month Modified Files and Folders =======
2013-08-12 22:26 - 2013-08-12 22:26 - 00000000 ____D C:\Windows\ERUNT
2013-08-12 22:21 - 2013-08-12 22:21 - 00959697 _____ (Oleg N. Scherbakov) C:\Users\Teske\Downloads\JRT_5.4.4.exe
2013-08-12 22:17 - 2013-08-12 22:20 - 00000735 _____ C:\Users\Teske\Desktop\AdwCleaner[R1].txt
2013-08-12 22:17 - 2013-08-12 22:17 - 00666633 _____ C:\Users\Teske\Downloads\adwcleaner06.exe
2013-08-12 22:17 - 2013-08-12 22:17 - 00000796 _____ C:\AdwCleaner[S1].txt
2013-08-12 22:17 - 2013-08-12 22:17 - 00000735 _____ C:\AdwCleaner[R1].txt
2013-08-12 22:12 - 2012-09-06 21:13 - 00098238 _____ C:\Windows\PFRO.log
2013-08-12 21:51 - 2013-08-12 21:51 - 00001067 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\Users\Teske\AppData\Roaming\Malwarebytes
2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-12 21:47 - 2013-08-12 19:41 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-08-12 21:29 - 2013-08-12 21:28 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Teske\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-12 21:08 - 2013-08-12 21:08 - 00000036 _____ C:\Users\Teske\AppData\Local\housecall.guid.cache
2013-08-12 21:03 - 2013-08-12 21:03 - 00002155 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-08-12 21:03 - 2013-08-12 21:02 - 00000000 ____D C:\Program Files\TuneUp Utilities 2011
2013-08-12 21:02 - 2013-08-12 21:02 - 00000000 ____D C:\Users\Teske\AppData\Roaming\TuneUp Software
2013-08-12 21:02 - 2013-08-12 21:01 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-08-12 21:01 - 2013-08-12 21:01 - 00000000 __SHD C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2013-08-12 21:01 - 2013-08-12 21:00 - 24038304 _____ (TuneUp Software) C:\Users\Teske\Downloads\TuneUpUtilities2011_de-DE.exe
2013-08-12 19:43 - 2013-08-12 19:43 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-12 19:41 - 2013-08-12 19:41 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-08-08 21:44 - 2012-09-06 21:03 - 00000000 ____D C:\Users\Teske\AppData\Roaming\Skype
2013-08-08 20:53 - 2012-09-06 19:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-08 20:53 - 2012-09-06 17:46 - 01633328 _____ C:\Windows\WindowsUpdate.log
2013-08-08 17:34 - 2009-07-14 06:34 - 00018624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-08 17:34 - 2009-07-14 06:34 - 00018624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-08 17:26 - 2012-09-06 18:52 - 00000000 _____ C:\Windows\system32\Drivers\lvuvc.hs
2013-08-08 17:26 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-08 17:26 - 2009-07-14 06:39 - 00053388 _____ C:\Windows\setupact.log
2013-08-08 15:06 - 2013-08-08 15:06 - 00000000 ____D C:\FRST
2013-08-08 14:54 - 2012-09-06 17:55 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-08 14:48 - 2013-08-08 14:24 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-08 14:24 - 2013-08-08 14:24 - 00000000 ____D C:\Users\Teske\Documents\ProcAlyzer Dumps
2013-08-08 14:18 - 2013-05-29 21:43 - 00000000 ____D C:\Users\Teske\AppData\Roaming\Dropbox
2013-08-08 14:05 - 2013-08-08 14:04 - 00031232 ___SH C:\Users\Teske\Documents\Thumbs.db
2013-08-08 13:28 - 2013-05-29 21:48 - 00000000 ___RD C:\Users\Teske\Dropbox
2013-08-08 07:47 - 2012-09-06 19:10 - 00000000 ____D C:\Users\Teske\AppData\Local\Windows Live
2013-08-08 07:15 - 2009-07-14 06:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-01 15:51 - 2012-09-17 19:17 - 00000000 ____D C:\Users\Teske\hob_jportal
2013-07-17 06:50 - 2013-03-07 09:47 - 00000000 ___RD C:\Program Files\Skype
2013-07-17 06:50 - 2012-09-06 21:03 - 00000000 ____D C:\ProgramData\Skype
2013-07-14 15:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-14 14:20 - 2012-09-06 20:09 - 00000000 ____D C:\Users\Teske\AppData\Local\Adobe
2013-07-14 14:19 - 2012-09-06 19:07 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-07-14 14:19 - 2012-09-06 19:07 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-02 16:19
==================== End Of Log ============================
Der SpyHunter hat gleich 278 Ergebnisse angezeigt.
Ich hoffe alle Infos soweit zusammengetragen zu haben. Wenn noch etwas fehlt, reiche ich das gerne nach. Danke schon mal im Voraus.
Seit den ersten Schritten fährt der Rechner wieder vernünftig hoch - er hat mir nur eine der gelöschten Dateien (hovphsiiqlhcvjhebpl.bfg) angemeckert. | 
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
FRST 32-Bit | FRST 64-Bit
SecurityCheck und: