Trojaner-Board - Interpol Trojaner Windows 7

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Interpol Trojaner Windows 7 (https://www.trojaner-board.de/146830-interpol-trojaner-windows-7-a.html)

Interpol Trojaner Windows 7

Ich habe ein Problem mit einem Trojaner...

Mein Pc lässt sich nicht im abgesicherten Modus starten.

Anbei schonmal das erste Logfile.

Bitte um Hilfe!!!

[
FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013 (ATTENTION: ====> FRST version is 50 days old and could be outdated)

Ran by SYSTEM on MININT-TP0B6KJ on 21-11-2013 22:25:38

Running from H:\

Windows 7 Home Premium (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11369576 2010-08-10] (Realtek Semiconductor)

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2586504 2010-08-05] (ELAN Microelectronics Corp.)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-13] (Microsoft Corporation)

HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2011-06-07] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] ()

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-01] (Apple Inc.)

HKU\Florian\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)

HKU\Florian\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)

HKU\Florian\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe

HKU\Florian\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3561816 2013-10-16] (Electronic Arts)

HKU\Tanja\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk

ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk ->  (No File)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Internet.lnk

ShortcutTarget: DSL Internet.lnk -> C:\Program Files (x86)\1&1\FritzDsl.exe (AVM Berlin)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk

ShortcutTarget: DSL Protect.lnk -> C:\Program Files (x86)\1&1\FwebProt.exe (AVM Berlin)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

Startup: C:\Users\Tanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Services (Whitelisted) =================
 

S2 IGDCTRL; C:\Program Files (x86)\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin)

S2 N360; C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe [130008 2011-04-16] (Symantec Corporation)

S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-05-31] (Symantec Corporation)

S2 WTGService; C:\Program Files (x86)\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()

S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x]
 

==================== Drivers (Whitelisted) ====================
 

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-06-19] ()

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)

S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)

S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)

S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-28] (Symantec Corporation)

S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)

S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-06-19] ()

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)

S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)

S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)

S3 SRTSP; C:\Windows\System32\Drivers\N360x64\0502020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation)

S1 SRTSPX; C:\Windows\system32\drivers\N360x64\0502020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation)

S0 SymDS; C:\Windows\System32\drivers\N360x64\0502020.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation)

S0 SymEFA; C:\Windows\System32\drivers\N360x64\0502020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation)

S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-06-21] (Symantec Corporation)

S1 SymIRON; C:\Windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation)

S1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-11-15 13:15 - 2009-07-13 17:14 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe

2013-11-15 13:14 - 2010-05-06 05:00 - 01026048 _____ (Microsoft Corporation) C:\Windows\System32\mstime.dll

2013-11-15 13:14 - 2010-05-06 04:41 - 00606208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll

2013-11-15 13:14 - 2009-07-13 17:41 - 00267776 _____ (Microsoft Corporation) C:\Windows\System32\ieaksie.dll

2013-11-15 13:14 - 2009-07-13 17:41 - 00156160 _____ (Microsoft Corporation) C:\Windows\System32\ieakeng.dll

2013-11-15 13:14 - 2009-07-13 17:40 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\admparse.dll

2013-11-15 13:14 - 2009-07-13 17:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\corpol.dll

2013-11-15 13:14 - 2009-07-13 17:27 - 00163840 _____ (Microsoft Corporation) C:\Windows\System32\ieakui.dll

2013-11-15 13:14 - 2009-07-13 17:15 - 00229376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll

2013-11-15 13:14 - 2009-07-13 17:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll

2013-11-15 13:14 - 2009-07-13 17:15 - 00018432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\corpol.dll

2013-11-15 13:14 - 2009-07-13 17:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll

2013-11-15 13:14 - 2009-07-13 17:05 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll

2013-11-15 13:14 - 2009-06-10 12:45 - 00000003 _____ C:\Windows\System32\Drivers\MsftWdf_Kernel_01009_Inbox_Critical.Wdf

2013-11-15 13:13 - 2013-11-15 13:13 - 00274904 _____ C:\Windows\Minidump\111513-28470-01.dmp

2013-11-15 04:22 - 2013-11-15 13:13 - 492919575 _____ C:\Windows\MEMORY.DMP

2013-11-15 04:22 - 2013-11-15 04:22 - 00274904 _____ C:\Windows\Minidump\111513-30607-01.dmp

2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx

2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv

2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss

2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss

2013-11-13 12:35 - 2013-11-13 12:35 - 00001743 _____ C:\Users\Public\Desktop\iTunes.lnk

2013-11-13 12:34 - 2013-11-13 12:35 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-11-13 12:34 - 2013-11-13 12:35 - 00000000 ____D C:\Program Files\iTunes

2013-11-13 12:34 - 2013-11-13 12:35 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-11-13 12:34 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files\iPod

2013-10-22 09:11 - 2013-10-22 09:17 - 00000000 ____D C:\Users\Florian\Desktop\Serien
 

==================== One Month Modified Files and Folders =======
 

2013-11-15 13:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\com

2013-11-15 13:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\oobe

2013-11-15 13:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\com

2013-11-15 13:14 - 2013-11-14 13:05 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx

2013-11-15 13:14 - 2013-11-14 13:05 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv

2013-11-15 13:14 - 2013-01-20 11:11 - 00000000 ____D C:\Users\Florian\AppData\Roaming\Dropbox

2013-11-15 13:14 - 2012-11-15 11:51 - 00000000 ____D C:\Program Files (x86)\Origin

2013-11-15 13:14 - 2012-01-01 11:38 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-11-15 13:14 - 2011-04-26 11:12 - 00000000 ____D C:\Users\Florian\Tracing

2013-11-15 13:13 - 2013-11-15 13:13 - 00274904 _____ C:\Windows\Minidump\111513-28470-01.dmp

2013-11-15 13:13 - 2013-11-15 04:22 - 492919575 _____ C:\Windows\MEMORY.DMP

2013-11-15 13:13 - 2011-11-10 09:38 - 00000000 ____D C:\Windows\Minidump

2013-11-15 13:13 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-11-15 13:13 - 2009-07-13 20:51 - 00218260 _____ C:\Windows\setupact.log

2013-11-15 04:23 - 2012-01-01 11:38 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-11-15 04:22 - 2013-11-15 04:22 - 00274904 _____ C:\Windows\Minidump\111513-30607-01.dmp

2013-11-14 13:10 - 2010-08-31 15:01 - 02029567 _____ C:\Windows\WindowsUpdate.log

2013-11-14 13:07 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-11-14 13:07 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-11-14 13:06 - 2010-11-19 11:16 - 00000000 ____D C:\Users\Florian\AppData\Local\CrashDumps

2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss

2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss

2013-11-14 13:01 - 2013-01-20 11:13 - 00000000 ___RD C:\Users\Florian\Dropbox

2013-11-13 12:48 - 2012-04-03 12:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-11-13 12:35 - 2013-11-13 12:35 - 00001743 _____ C:\Users\Public\Desktop\iTunes.lnk

2013-11-13 12:35 - 2013-11-13 12:34 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-11-13 12:35 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files\iTunes

2013-11-13 12:35 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-11-13 12:34 - 2013-11-13 12:34 - 00000000 ____D C:\Program Files\iPod

2013-10-23 12:56 - 2012-01-01 11:57 - 00000000 ____D C:\Users\Florian\AppData\Roaming\DivX

2013-10-23 08:16 - 2009-07-13 21:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2013-10-22 09:17 - 2013-10-22 09:11 - 00000000 ____D C:\Users\Florian\Desktop\Serien
 

Some content of TEMP:

====================

C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll
 
 

==================== Known DLLs (Whitelisted) ================
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 

2

Restore point made on: 2013-11-11 13:05:29

Restore point made on: 2013-11-13 12:32:52
 

==================== Memory info =========================== 
 

Percentage of memory in use: 15%

Total physical RAM: 4060.61 MB

Available physical RAM: 3448.56 MB

Total Pagefile: 4058.76 MB

Available Pagefile: 3436.22 MB

Total Virtual: 8192 MB

Available Virtual: 8191.88 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:113 GB) (Free:10.67 GB) NTFS

Drive d: () (Fixed) (Total:167.1 GB) (Free:0 GB) NTFS

Drive f: (SAMSUNG_REC) (Fixed) (Total:17.89 GB) (Free:0.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive h: (Lexar) (Removable) (Total:29.21 GB) (Free:5.42 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 298 GB) (Disk ID: 8074A547)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=113 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=167 GB) - (Type=OF Extended)

Partition 4: (Not Active) - (Size=18 GB) - (Type=27)
 

========================================================

Disk: 1 (Size: 29 GB) (Disk ID: 672E53E2)

Partition 1: (Not Active) - (Size=29 GB) - (Type=0B)
 
 

LastRegBack: 2013-11-10 01:33
 

==================== End Of Log ============================

--- --- ---
]

Hallo,

startet der Rechner nach diesem Fix wieder normal?

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk

ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation)

S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x]

2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx

2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv

2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss

2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss

C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Hallo,

Rechner startet nicht normal, auch nicht im abgesicherten Modus...

Auch nach dem Fix nicht?
Poste bitte das Fixlog wie angegeben.

Wie soll ich denn den Text kopieren und da rein bekommen? Wenn ich den Rechner normal starte wird der Bildschirm nach ein paar Sekunden blau und startet sich dann automatisch neu

Hast du den Fix wie angegeben durchgeführt?

Zitat:

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Mach bitte einen neuen Scan mit FRST in den Reperaturoptionen.

Hallo Leo,

danke schonmal für deine Hilfe.
Habe den Scan nochmal durchgeführt

Hier das neue Protokoll

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013 (ATTENTION: ====> FRST version is 88 days old and could be outdated)

Ran by SYSTEM on MININT-PQ1FHFR on 29-12-2013 18:59:36

Running from H:\

Windows 7 Home Premium (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11369576 2010-08-10] (Realtek Semiconductor)

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2586504 2010-08-05] (ELAN Microelectronics Corp.)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-13] (Microsoft Corporation)

HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2011-06-07] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] ()

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-01] (Apple Inc.)

HKU\Florian\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)

HKU\Florian\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)

HKU\Florian\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe

HKU\Florian\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3561816 2013-10-16] (Electronic Arts)

HKU\Tanja\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk

ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk ->  (No File)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Internet.lnk

ShortcutTarget: DSL Internet.lnk -> C:\Program Files (x86)\1&1\FritzDsl.exe (AVM Berlin)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk

ShortcutTarget: DSL Protect.lnk -> C:\Program Files (x86)\1&1\FwebProt.exe (AVM Berlin)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

Startup: C:\Users\Tanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Services (Whitelisted) =================
 

S2 IGDCTRL; C:\Program Files (x86)\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin)

S2 N360; C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe [130008 2011-04-16] (Symantec Corporation)

S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-05-31] (Symantec Corporation)

S2 WTGService; C:\Program Files (x86)\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()

S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x]
 

==================== Drivers (Whitelisted) ====================
 

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-06-19] ()

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)

S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)

S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)

S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-28] (Symantec Corporation)

S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)

S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-06-19] ()

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)

S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)

S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)

S3 SRTSP; C:\Windows\System32\Drivers\N360x64\0502020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation)

S1 SRTSPX; C:\Windows\system32\drivers\N360x64\0502020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation)

S0 SymDS; C:\Windows\System32\drivers\N360x64\0502020.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation)

S0 SymEFA; C:\Windows\System32\drivers\N360x64\0502020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation)

S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-06-21] (Symantec Corporation)

S1 SymIRON; C:\Windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation)

S1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-12-28 13:23 - 2013-12-28 13:23 - 00274904 _____ C:\Windows\Minidump\122813-24460-01.dmp
 

==================== One Month Modified Files and Folders =======
 

2013-12-28 13:23 - 2013-12-28 13:23 - 00274904 _____ C:\Windows\Minidump\122813-24460-01.dmp

2013-12-28 13:23 - 2011-11-10 09:38 - 00000000 ____D C:\Windows\Minidump

2013-12-28 13:22 - 2013-11-14 13:05 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx

2013-12-28 13:22 - 2013-11-14 13:05 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv

2013-12-28 13:22 - 2011-04-26 11:12 - 00000000 ____D C:\Users\Florian\Tracing

2013-12-28 13:21 - 2012-11-15 11:51 - 00000000 ____D C:\Program Files (x86)\Origin

2013-12-28 13:21 - 2012-01-01 11:38 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-12-28 13:20 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-12-28 13:20 - 2009-07-13 20:51 - 00218372 _____ C:\Windows\setupact.log
 

Some content of TEMP:

====================

C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll
 
 

==================== Known DLLs (Whitelisted) ================
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 

2

Restore point made on: 2013-11-11 13:05:29

Restore point made on: 2013-11-13 12:32:52
 

==================== Memory info =========================== 
 

Percentage of memory in use: 14%

Total physical RAM: 4060.61 MB

Available physical RAM: 3452.24 MB

Total Pagefile: 4058.76 MB

Available Pagefile: 3446.75 MB

Total Virtual: 8192 MB

Available Virtual: 8191.88 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:113 GB) (Free:11.09 GB) NTFS

Drive d: () (Fixed) (Total:167.1 GB) (Free:0 GB) NTFS

Drive f: (SAMSUNG_REC) (Fixed) (Total:17.89 GB) (Free:0.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive h: (Lexar) (Removable) (Total:29.21 GB) (Free:8.33 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 298 GB) (Disk ID: 8074A547)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=113 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=167 GB) - (Type=OF Extended)

Partition 4: (Not Active) - (Size=18 GB) - (Type=27)
 

========================================================

Disk: 1 (Size: 29 GB) (Disk ID: 672E53E2)

Partition 1: (Not Active) - (Size=29 GB) - (Type=0B)
 
 

LastRegBack: 2013-11-10 01:33
 

==================== End Of Log ============================

--- --- ---

Du hast den Fix offenbar nicht wie angegeben ausgeführt - das Zeugs ist alles noch da.
Wiederhole den zuvor angegebenen Fix bitte. Die erstellte fixlist.txt sollte auf neben der frst64.exe auf dem gleichen USB-Stick gespeichert werden.

Kannst du hiermit was anfangen?

Code:

 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2013

Ran by SYSTEM at 2013-12-30 15:17:10 Run:2

Running from H:\

Boot Mode: Recovery

==============================================
 

Content of fixlist:

*****************

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation) S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x] 2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx 2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv 2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss 2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll

*****************
 

C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation) S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x] 2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx 2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv 2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss 2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation) C:\ProgramData\4mqrbn7tlf.pss C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll not found.

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk C:\PROGRA~3\flt7nbrqm4.dss C:\ProgramData\4mqrbn7tlf.pss C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll not found.

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation) Winmgmt => Service not found.
 

==== End of Fixlog ====

Zitat:

Kannst du hiermit was anfangen?

Ja, jetzt sehe ich, warum das nicht klappt: Dir gehen im Fixskript die Zeilenumbrüche verloren! Wiederhole den Fix bitte und achte darauf, dass deine fixlist.txt genau so aussieht wie die Vorgabe in der Codebox. Also 8 Zeilen und nicht eine einzige.

so, hier noch einmal neu...
danke für deine geduld ;-)
bin leider in so sachen nicht so begabt...

Code:

 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2013

Ran by SYSTEM at 2014-01-02 14:54:19 Run:3

Running from H:\

Boot Mode: Recovery

==============================================
 

Content of fixlist:

*****************

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk

ShortcutTarget: 4mqrbn7tlf.lnk -> C:\PROGRA~3\flt7nbrqm4.dss (Sato Corporation)

S2 Winmgmt; C:\PROGRA~3\1tlfbg.pzz [x]

2013-11-14 13:05 - 2013-11-15 13:14 - 95025368 ____T C:\ProgramData\4mqrbn7tlf.bxx

2013-11-14 13:05 - 2013-11-15 13:14 - 00000000 _____ C:\ProgramData\4mqrbn7tlf.fvv

2013-11-14 13:05 - 2013-11-14 13:05 - 00177152 _____ (Sato Corporation) C:\ProgramData\flt7nbrqm4.dss

2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation)

C:\ProgramData\4mqrbn7tlf.pss C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll 

*****************
 

C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4mqrbn7tlf.lnk => Moved successfully.

C:\PROGRA~3\flt7nbrqm4.dss => Moved successfully.

Winmgmt => Service restored successfully.

C:\ProgramData\4mqrbn7tlf.bxx => Moved successfully.

C:\ProgramData\4mqrbn7tlf.fvv => Moved successfully.

"C:\ProgramData\flt7nbrqm4.dss" => File/Directory not found.

"2013-11-14 13:05 - 2013-11-14 13:05 - 00061536 ____T (Microsoft Corporation)" => File/Directory not found.

"C:\ProgramData\4mqrbn7tlf.pss C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll " => File/Directory not found.
 

==== End of Fixlog ====

So, jetzt hat nur noch ein Zeilenumbruch gefehlt.. ;) (in deiner letzten Zeile)
Aber das spielt möglicherweise keine Rolle. Startet der Rechner jetzt wieder normal ohne den Sperrbildschirm?

nein, fahre den rechner normal hoch,
und nach ein paar sekunden erscheint zwar nicht mehr der interpol sperrbildschirm,
dafür erscheint ein blauer bildschirm für ein paar sekunden,
danach startet der rechner neu

Dann mach bitte einen frischen FRST-Scan.

hier das neue scan protokoll

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013 (ATTENTION: ====> FRST version is 92 days old and could be outdated)

Ran by SYSTEM on MININT-VRU6Q77 on 02-01-2014 19:05:21

Running from H:\

Windows 7 Home Premium (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Recovery
 

The current controlset is ControlSet002
 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11369576 2010-08-10] (Realtek Semiconductor)

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2586504 2010-08-05] (ELAN Microelectronics Corp.)

HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-13] (Microsoft Corporation)

HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)

HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2011-06-07] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] ()

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-01] (Apple Inc.)

HKU\Florian\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)

HKU\Florian\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)

HKU\Florian\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe

HKU\Florian\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3561816 2013-10-16] (Electronic Arts)

HKU\Tanja\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk ->  (No File)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Internet.lnk

ShortcutTarget: DSL Internet.lnk -> C:\Program Files (x86)\1&1\FritzDsl.exe (AVM Berlin)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk

ShortcutTarget: DSL Protect.lnk -> C:\Program Files (x86)\1&1\FwebProt.exe (AVM Berlin)

Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

Startup: C:\Users\Tanja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Services (Whitelisted) =================
 

S2 IGDCTRL; C:\Program Files (x86)\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin)

S2 N360; C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe [130008 2011-04-16] (Symantec Corporation)

S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-05-31] (Symantec Corporation)

S2 WTGService; C:\Program Files (x86)\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()
 

==================== Drivers (Whitelisted) ====================
 

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-06-19] ()

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-10-01] (Symantec Corporation)

S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)

S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)

S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-28] (Symantec Corporation)

S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)

S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20131018.001\IDSvia64.sys [521816 2013-10-15] (Symantec Corporation)

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-06-19] ()

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\ENG64.SYS [126040 2013-08-30] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20131019.005\EX64.SYS [2099288 2013-08-30] (Symantec Corporation)

S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)

S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-09-28] (Windows (R) 2003 DDK 3790 provider)

S3 SRTSP; C:\Windows\System32\Drivers\N360x64\0502020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation)

S1 SRTSPX; C:\Windows\system32\drivers\N360x64\0502020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation)

S0 SymDS; C:\Windows\System32\drivers\N360x64\0502020.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation)

S0 SymEFA; C:\Windows\System32\drivers\N360x64\0502020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation)

S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-06-21] (Symantec Corporation)

S1 SymIRON; C:\Windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation)

S1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-02 06:24 - 2014-01-02 06:25 - 00274904 _____ C:\Windows\Minidump\010214-24304-01.dmp

2014-01-02 06:21 - 2014-01-02 06:21 - 00274904 _____ C:\Windows\Minidump\010214-42369-01.dmp

2014-01-02 06:02 - 2014-01-02 06:02 - 00274904 _____ C:\Windows\Minidump\010214-36941-01.dmp

2013-12-30 06:59 - 2013-12-30 06:59 - 00274904 _____ C:\Windows\Minidump\123013-37097-01.dmp

2013-12-30 06:34 - 2013-12-30 06:35 - 00274904 _____ C:\Windows\Minidump\123013-44085-01.dmp

2013-12-30 06:27 - 2013-12-30 06:28 - 00274904 _____ C:\Windows\Minidump\123013-54506-01.dmp

2013-12-30 05:44 - 2013-12-30 05:44 - 00270608 _____ C:\Windows\Minidump\123013-104099-01.dmp

2013-12-28 13:23 - 2013-12-28 13:23 - 00274904 _____ C:\Windows\Minidump\122813-24460-01.dmp
 

==================== One Month Modified Files and Folders =======
 

2014-01-02 06:33 - 2012-01-01 11:38 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-01-02 06:33 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2014-01-02 06:33 - 2009-07-13 20:51 - 00218764 _____ C:\Windows\setupact.log

2014-01-02 06:25 - 2014-01-02 06:24 - 00274904 _____ C:\Windows\Minidump\010214-24304-01.dmp

2014-01-02 06:24 - 2011-11-10 09:38 - 00000000 ____D C:\Windows\Minidump

2014-01-02 06:22 - 2012-11-15 11:51 - 00000000 ____D C:\Program Files (x86)\Origin

2014-01-02 06:22 - 2011-04-26 11:12 - 00000000 ____D C:\Users\Florian\Tracing

2014-01-02 06:21 - 2014-01-02 06:21 - 00274904 _____ C:\Windows\Minidump\010214-42369-01.dmp

2014-01-02 06:04 - 2013-01-20 11:11 - 00000000 ____D C:\Users\Florian\AppData\Roaming\Dropbox

2014-01-02 06:02 - 2014-01-02 06:02 - 00274904 _____ C:\Windows\Minidump\010214-36941-01.dmp

2013-12-30 06:59 - 2013-12-30 06:59 - 00274904 _____ C:\Windows\Minidump\123013-37097-01.dmp

2013-12-30 06:35 - 2013-12-30 06:34 - 00274904 _____ C:\Windows\Minidump\123013-44085-01.dmp

2013-12-30 06:28 - 2013-12-30 06:27 - 00274904 _____ C:\Windows\Minidump\123013-54506-01.dmp

2013-12-30 05:44 - 2013-12-30 05:44 - 00270608 _____ C:\Windows\Minidump\123013-104099-01.dmp

2013-12-28 13:23 - 2013-12-28 13:23 - 00274904 _____ C:\Windows\Minidump\122813-24460-01.dmp
 

Some content of TEMP:

====================

C:\Users\Florian\AppData\Local\Temp\~tmf1053072901840174725.dll
 
 

==================== Known DLLs (Whitelisted) ================
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 

1

Restore point made on: 2013-11-13 12:32:52
 

==================== Memory info =========================== 
 

Percentage of memory in use: 15%

Total physical RAM: 4060.61 MB

Available physical RAM: 3437.43 MB

Total Pagefile: 4058.76 MB

Available Pagefile: 3430.36 MB

Total Virtual: 8192 MB

Available Virtual: 8191.88 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:113 GB) (Free:11.36 GB) NTFS

Drive d: () (Fixed) (Total:167.1 GB) (Free:0 GB) NTFS

Drive f: (SAMSUNG_REC) (Fixed) (Total:17.89 GB) (Free:0.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive h: (Lexar) (Removable) (Total:29.21 GB) (Free:8.33 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 298 GB) (Disk ID: 8074A547)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=113 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=167 GB) - (Type=OF Extended)

Partition 4: (Not Active) - (Size=18 GB) - (Type=27)
 

========================================================

Disk: 1 (Size: 29 GB) (Disk ID: 672E53E2)

Partition 1: (Not Active) - (Size=29 GB) - (Type=0B)
 
 

LastRegBack: 2013-11-10 01:33
 

==================== End Of Log ============================

--- --- ---