Interpol Virus und dessen Bekämpfung (Logfiles)
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-05-2014 02
Ran by SYSTEM on MININT-BVBH42G on 26-05-2014 11:45:40
Running from G:\
Platform: Windows 7 Ultimate (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [] => [X]
HKLM\...\Run: [ApnUpdater] => C:\Program Files\Ask.com\Updater\Updater.exe [1573584 2012-10-29] (Ask)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Nvtmru] => C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKU\Justin\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [18706176 2013-01-08] (Skype Technologies S.A.)
Startup: C:\Users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
========================== Services (Whitelisted) =================
S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-08-20] (Avira Operations GmbH & Co. KG)
S2 IBUpdaterService; C:\ProgramData\IBUpdaterService\ibsvc.exe [721688 2013-02-26] ()
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14573856 2013-08-27] (NVIDIA Corporation)
==================== Drivers (Whitelisted) ====================
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-04] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-08-20] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-28] (Avira Operations GmbH & Co. KG)
S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [33568 2013-08-20] (NVIDIA Corporation)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-26 11:45 - 2014-05-26 11:45 - 00000000 ____D () C:\FRST
==================== One Month Modified Files and Folders =======
2014-05-26 11:45 - 2014-05-26 11:45 - 00000000 ____D () C:\FRST
2014-04-29 20:39 - 2012-12-23 18:08 - 00000000 ____D () C:\Users\Justin\Desktop\Fotos
Some content of TEMP:
====================
C:\Users\Justin\AppData\Local\Temp\nvStInst.exe
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== Restore Points =========================
Restore point made on: 2013-10-31 16:29:51
Restore point made on: 2013-11-08 17:17:21
Restore point made on: 2013-11-15 01:35:51
Restore point made on: 2013-11-22 10:04:29
Restore point made on: 2013-11-29 11:01:46
Restore point made on: 2013-12-06 12:37:59
Restore point made on: 2013-12-11 23:08:13
Restore point made on: 2013-12-11 23:24:48
==================== Memory info ===========================
Percentage of memory in use: 6%
Total physical RAM: 8136.07 MB
Available physical RAM: 7580.82 MB
Total Pagefile: 8134.34 MB
Available Pagefile: 7594.33 MB
Total Virtual: 2047.88 MB
Available Virtual: 1944.43 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.66 GB) (Free:325.28 GB) NTFS
Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: () (Fixed) (Total:111.69 GB) (Free:38.68 GB) NTFS
Drive g: (INTENSO) (Removable) (Total:7.26 GB) (Free:7.26 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 1E8354E8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 8A55CDBB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 7 GB) (Disk ID: 8C5CCAAB)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)
LastRegBack: 2013-11-30 16:07
==================== End Of Log ============================ --- --- ---
Hallo Gemeinde,
ich bin das erste Mal hier und hab wie oben beschrieben ein riesen Problem mit dem Interpol Virus. Ich kann meinen PC nicht mehr hochfahren geschweige sonst irgendetwas tun. Ich habe in diesem Forum einen Beitrag gefunden, der erklärt wie man mit FRST die Logfiles erstellt. Nun hoffe ich weitere Infos zu erhalten, die dazubeitragen, das Problem zu bekämpfen.
MfG, Azar |