Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Win7 64bit gesperrt von "schweizer Interpol" (https://www.trojaner-board.de/154576-win7-64bit-gesperrt-schweizer-interpol.html)

Verzweifler 30.05.2014 18:47
Win7 64bit gesperrt von "schweizer Interpol"
 
Hallo zusammen.

Ich brauche dringend eure Hilfe. Habe mir auch diesen Interpoltrojaner "schweizer Edition" eingefangen.
Könnt Ihr mir helfen?

Hier schon mal die txt von farbar.

Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-05-2014
Ran by SYSTEM on MININT-1S0KVFT on 30-05-2014 18:59:21
Running from H:\
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [489472 2011-07-07] (IDT, Inc.)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company)
HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2945080 2011-09-12] (Hewlett-Packard Company)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [Microsoft Default Manager] => C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)
HKLM-x32\...\Run: [File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11265536 2009-12-12] (Hewlett-Packard)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DTRun] => c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [518656 2009-11-19] (ArcSoft Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-07-05] (Apple Inc.)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-08-11] (PDF Complete Inc)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [334240 2012-09-12] (Hewlett-Packard Company)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\Christian\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2011-03-04] (Hewlett-Packard Company)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\895756E846256544D5B562561F226D75\ggcly8t7.cpp ()
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
S3 DEBridge; C:\Program Files\Hewlett-Packard\Drive Encryption\SbHpAuthenticatorService.exe [704512 2010-02-01] (McAfee, Inc.)
S2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462160 2010-07-16] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [362040 2009-11-17] (Hewlett-Packard Ltd)
S2 HP ProtectTools Service; C:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [32768 2010-10-19] (Hewlett-Packard Development Company, L.P)
S2 HpFkCryptService; C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2010-02-01] (McAfee, Inc.)
S2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [523680 2012-09-12] (Hewlett-Packard Company)
S2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)
S2 uArcCapture; C:\windows\system\uArcCapture.exe [506472 2009-12-04] (ArcSoft, Inc.)
S2 Winmgmt; C:\ProgramData\895756E846256544D5B562561F226D75\7t8ylcgg.dot [334588 2014-05-26] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S1 archlp; C:\Windows\System32\drivers\archlp.sys [142848 2010-01-13] ()
S3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32640 2009-12-04] (ArcSoft, Inc.)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [40760 2009-10-21] (Hewlett-Packard Development Company L.P.)
S1 RsvLock; C:\Windows\System32\Drivers\RsvLock.sys [58184 2010-02-01] (McAfee, Inc.)
S1 RsvLock; C:\Windows\SysWow64\Drivers\RsvLock.sys [40088 2010-02-01] (McAfee, Inc.)
S3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [96384 2010-05-21] (Realtek Semiconductor Corp.)
S0 SafeBoot; C:\Windows\System32\Drivers\SafeBoot.sys [56648 2010-02-01] (McAfee, Inc.)
S0 SafeBoot; C:\Windows\SysWow64\Drivers\SafeBoot.sys [110520 2010-02-01] (McAfee, Inc.)
S0 SbAlg; C:\Windows\System32\Drivers\SbAlg.sys [60160 2009-06-04] (McAfee, Inc.)
S0 SbAlg; C:\Windows\SysWow64\Drivers\SbAlg.sys [51800 2010-02-01] (McAfee, Inc.)
S0 SbFsLock; C:\Windows\System32\Drivers\SbFsLock.sys [15688 2010-02-01] (McAfee, Inc.)
S0 SbFsLock; C:\Windows\SysWow64\Drivers\SbFsLock.sys [13256 2010-02-01] (McAfee, Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-30 18:58 - 2014-05-30 18:59 - 00000000 ____D () C:\FRST
2014-05-30 16:12 - 2014-05-30 16:13 - 00000175 _____ () C:\ProgramData\RUNDLL32.EXE-1140-F.txt
2014-05-29 18:04 - 2014-05-29 18:13 - 00004308 _____ () C:\ProgramData\RUNDLL32.EXE-3780-F.txt
2014-05-26 23:55 - 2014-05-27 00:01 - 00003658 _____ () C:\ProgramData\RUNDLL32.EXE-692-F.txt
2014-05-26 23:32 - 2014-05-26 23:55 - 00000000 ____D () C:\ProgramData\895756E846256544D5B562561F226D75
2014-05-18 02:04 - 2014-05-06 05:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-18 02:04 - 2014-05-06 05:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-18 02:04 - 2014-05-06 04:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-18 02:04 - 2014-05-06 04:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-18 02:04 - 2014-05-06 04:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-05-18 02:04 - 2014-05-06 03:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-17 11:08 - 2014-05-17 11:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-17 10:29 - 2014-05-09 07:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-05-17 10:29 - 2014-05-09 07:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-05-17 10:29 - 2014-03-25 03:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2014-05-17 10:29 - 2014-03-25 03:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-17 10:28 - 2014-04-12 03:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2014-05-17 10:28 - 2014-04-12 03:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2014-05-17 10:28 - 2014-04-12 03:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2014-05-17 10:28 - 2014-04-12 03:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2014-05-17 10:28 - 2014-04-12 03:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2014-05-17 10:28 - 2014-04-12 03:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2014-05-17 10:28 - 2014-04-12 03:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2014-05-17 10:28 - 2014-04-12 03:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-17 10:28 - 2014-04-12 03:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-17 10:28 - 2014-03-04 10:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2014-05-17 10:28 - 2014-03-04 10:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2014-05-17 10:28 - 2014-03-04 10:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\System32\objsel.dll
2014-05-17 10:28 - 2014-03-04 10:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2014-05-17 10:28 - 2014-03-04 10:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2014-05-17 10:28 - 2014-03-04 10:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2014-05-17 10:28 - 2014-03-04 10:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2014-05-17 10:28 - 2014-03-04 10:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-05-17 10:28 - 2014-03-04 10:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\wincredprovider.dll
2014-05-17 10:28 - 2014-03-04 10:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-05-17 10:28 - 2014-03-04 10:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\System32\cngprovider.dll
2014-05-17 10:28 - 2014-03-04 10:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\System32\adprovider.dll
2014-05-17 10:28 - 2014-03-04 10:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\capiprovider.dll
2014-05-17 10:28 - 2014-03-04 10:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\dpapiprovider.dll
2014-05-17 10:28 - 2014-03-04 10:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\System32\dimsroam.dll
2014-05-17 10:28 - 2014-03-04 10:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-05-17 10:28 - 2014-03-04 10:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-17 10:28 - 2014-03-04 10:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-17 10:28 - 2014-03-04 10:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-17 10:28 - 2014-03-04 10:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-17 10:28 - 2014-03-04 10:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-07 21:34 - 2014-05-07 21:34 - 00000000 ____D () C:\Users\Christian\Documents\OneNote-Notizbücher
2014-05-07 02:00 - 2014-05-18 02:21 - 00000000 ___SD () C:\Windows\System32\CompatTel

==================== One Month Modified Files and Folders =======

2014-05-30 18:59 - 2014-05-30 18:58 - 00000000 ____D () C:\FRST
2014-05-30 16:17 - 2010-12-07 13:05 - 00000000 ____D () C:\ProgramData\PDFC
2014-05-30 16:17 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-30 16:17 - 2009-07-14 05:51 - 00136330 _____ () C:\Windows\setupact.log
2014-05-30 16:13 - 2014-05-30 16:12 - 00000175 _____ () C:\ProgramData\RUNDLL32.EXE-1140-F.txt
2014-05-30 16:12 - 2011-12-26 19:39 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-30 16:12 - 2011-06-07 17:47 - 00000000 ____D () C:\Users\Christian\AppData\Local\Temp
2014-05-30 16:09 - 2009-07-14 05:45 - 00019760 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-30 16:09 - 2009-07-14 05:45 - 00019760 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-30 16:06 - 2010-12-07 13:05 - 00000000 ____D () C:\ProgramData\HPQLOG
2014-05-29 18:13 - 2014-05-29 18:04 - 00004308 _____ () C:\ProgramData\RUNDLL32.EXE-3780-F.txt
2014-05-29 18:07 - 2011-03-23 08:06 - 01732768 _____ () C:\Windows\WindowsUpdate.log
2014-05-27 00:01 - 2014-05-26 23:55 - 00003658 _____ () C:\ProgramData\RUNDLL32.EXE-692-F.txt
2014-05-26 23:55 - 2014-05-26 23:32 - 00000000 ____D () C:\ProgramData\895756E846256544D5B562561F226D75
2014-05-26 23:42 - 2011-12-26 19:39 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-26 23:30 - 2010-12-07 13:06 - 00699682 _____ () C:\Windows\System32\perfh007.dat
2014-05-26 23:30 - 2010-12-07 13:06 - 00149790 _____ () C:\Windows\System32\perfc007.dat
2014-05-26 23:30 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-05-23 15:12 - 2011-10-27 17:19 - 00000000 _____ () C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-05-23 15:12 - 2011-06-08 19:12 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-05-20 23:17 - 2011-06-22 19:38 - 00000000 ____D () C:\Users\Christian\Documents\Outlook-Dateien
2014-05-20 23:09 - 2012-05-03 17:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-18 10:21 - 2014-01-04 14:09 - 00000600 _____ () C:\Users\Christian\AppData\Roaming\winscp.rnd
2014-05-18 03:13 - 2011-06-08 00:43 - 00000000 ____D () C:\Windows\rescache
2014-05-18 02:21 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-05-18 02:03 - 2014-02-25 19:53 - 00000000 ____D () C:\Windows\System32\MRT
2014-05-18 02:01 - 2011-06-08 19:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-05-17 23:13 - 2013-04-28 08:24 - 00003210 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForChristian
2014-05-17 23:13 - 2013-04-28 08:24 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForChristian.job
2014-05-17 11:09 - 2014-05-17 11:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-17 10:17 - 2012-04-11 07:21 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-17 10:17 - 2011-06-07 19:11 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-09 07:14 - 2014-05-17 10:29 - 00477184 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-05-09 07:11 - 2014-05-17 10:29 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-05-07 21:36 - 2011-12-26 19:39 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-07 21:36 - 2011-12-26 19:39 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-07 21:34 - 2014-05-07 21:34 - 00000000 ____D () C:\Users\Christian\Documents\OneNote-Notizbücher
2014-05-06 05:40 - 2014-05-18 02:04 - 23544320 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-06 05:17 - 2014-05-18 02:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-06 04:25 - 2014-05-18 02:04 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 04:07 - 2014-05-18 02:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 04:00 - 2014-05-18 02:04 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-05-06 03:10 - 2014-05-18 02:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

Files to move or delete:
====================
C:\ProgramData\q8zjf1d.fee
C:\ProgramData\q8zjf1d.zvv


Some content of TEMP:
====================
C:\Users\Christian\AppData\Local\Temp\AskSLib.dll
C:\Users\Christian\AppData\Local\Temp\AtpTimerInfo.dll
C:\Users\Christian\AppData\Local\Temp\avgnt.exe
C:\Users\Christian\AppData\Local\Temp\CWPCUNLR.dll
C:\Users\Christian\AppData\Local\Temp\Extract.exe
C:\Users\Christian\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\Christian\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Christian\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Christian\AppData\Local\Temp\HPQSi.exe
C:\Users\Christian\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Christian\AppData\Local\Temp\Quarantine.exe
C:\Users\Christian\AppData\Local\Temp\Resource.exe
C:\Users\Christian\AppData\Local\Temp\SP47594.exe
C:\Users\Christian\AppData\Local\Temp\SP48064.exe
C:\Users\Christian\AppData\Local\Temp\SP49408.exe
C:\Users\Christian\AppData\Local\Temp\SP49458.exe
C:\Users\Christian\AppData\Local\Temp\SP49638.exe
C:\Users\Christian\AppData\Local\Temp\SP50255.exe
C:\Users\Christian\AppData\Local\Temp\SP50261.exe
C:\Users\Christian\AppData\Local\Temp\SP50291.exe
C:\Users\Christian\AppData\Local\Temp\SP50370.exe
C:\Users\Christian\AppData\Local\Temp\SP50877.exe
C:\Users\Christian\AppData\Local\Temp\SP51129.exe
C:\Users\Christian\AppData\Local\Temp\SP51626.exe
C:\Users\Christian\AppData\Local\Temp\SP51810.exe
C:\Users\Christian\AppData\Local\Temp\sp52110.exe.exe
C:\Users\Christian\AppData\Local\Temp\SP52407.exe
C:\Users\Christian\AppData\Local\Temp\sp54373.exe
C:\Users\Christian\AppData\Local\Temp\SP54600.exe
C:\Users\Christian\AppData\Local\Temp\sp54620.exe
C:\Users\Christian\AppData\Local\Temp\SP54635.exe
C:\Users\Christian\AppData\Local\Temp\SP54890.exe
C:\Users\Christian\AppData\Local\Temp\SP54922.exe
C:\Users\Christian\AppData\Local\Temp\SP57752.exe
C:\Users\Christian\AppData\Local\Temp\sp58915.exe
C:\Users\Christian\AppData\Local\Temp\SP59346.exe
C:\Users\Christian\AppData\Local\Temp\TVersitybar.exe
C:\Users\Christian\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Christian\AppData\Local\Temp\UninstallHPTCA.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-04-23 19:54:04
Restore point made on: 2014-04-28 16:22:50
Restore point made on: 2014-04-29 21:24:20
Restore point made on: 2014-05-06 17:27:47
Restore point made on: 2014-05-06 17:30:02
Restore point made on: 2014-05-07 02:00:26
Restore point made on: 2014-05-17 10:21:43
Restore point made on: 2014-05-18 02:00:34
Restore point made on: 2014-05-20 23:16:45
Restore point made on: 2014-05-23 15:06:46

==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 3951.43 MB
Available physical RAM: 3320.06 MB
Total Pagefile: 3949.58 MB
Available Pagefile: 3315.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:448.47 GB) (Free:368.01 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_RECOVERY) (Fixed) (Total:15 GB) (Free:2.26 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.4 GB) FAT32
Drive h: (DRIVE-N-GO) (Fixed) (Total:596.02 GB) (Free:596.02 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.29 GB) (Free:0.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: EC9CDE1C)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=448 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)

========================================================
Disk: 1 (Size: 596 GB) (Disk ID: CC77EF8C)
Partition 1: (Not Active) - (Size=596 GB) - (Type=0C)


LastRegBack: 2014-05-18 23:49

==================== End Of Log ============================
Danke sehr schon mal

schrauber 30.05.2014 20:05
hi,

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\895756E846256544D5B562561F226D75\ggcly8t7.cpp ()
S2 Winmgmt; C:\ProgramData\895756E846256544D5B562561F226D75\7t8ylcgg.dot [334588 2014-05-26] (Microsoft Corporation)
C:\ProgramData\895756E846256544D5B562561F226D75
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.




Rechner normal starten.

Verzweifler 30.05.2014 20:27
Hier der Fixlog:
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 30-05-2014
Ran by SYSTEM at 2014-05-30 21:16:22 Run:1
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\895756E846256544D5B562561F226D75\ggcly8t7.cpp ()
S2 Winmgmt; C:\ProgramData\895756E846256544D5B562561F226D75\7t8ylcgg.dot [334588 2014-05-26] (Microsoft Corporation)
C:\ProgramData\895756E846256544D5B562561F226D75
       
*****************

C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk => Moved successfully.
C:\ProgramData\895756E846256544D5B562561F226D75\ggcly8t7.cpp => Moved successfully.
Winmgmt => Service restored successfully.
C:\ProgramData\895756E846256544D5B562561F226D75 => Moved successfully.

==== End of Fixlog ====
Muss der usb stick anschliessend formatiert werden? Ist der jetzt auch infiziert?

Vielen Dank der Rechner startet wieder und ich kann meine Daten sichern.
Reicht es den Rechner jetzt neu aufzusetzen?

Sorry für die Fragerei, will das Thema aber möglichst schnell erledigen.

schrauber 31.05.2014 15:23
Du kannst jetzt Daten sichern und neu aufsetzen, oder wir machen das schnell fertig sauber.

Wenn du säubern willst, dann ab jetzt im normalen MOdus:


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Verzweifler 01.06.2014 11:33
Hallo Schrauber

Ich habe mich fürs Neuaufsetzen entschieden. Ist sowieso mal wieder fällig.

Vielen Dank für Deine Unterstützung!!!

Grüsse

schrauber 02.06.2014 11:46
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:15 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131