Schwarzer Desktop / GVU-Trojaner

panki

Liebe Helfer, ich kann meinem Laptop Windows7 nicht benutzen. Den GVU Trojaner konnte ich entfernen.
Was bleibt ist folgendes Problem:
Nachdem ich Windows eingeloggt bin, kommt Schwarze Bildschirm steht mit ''cmd.exe'' :
"
Der Befehl c:\users.....\temp\ytnududtggyrnlexn.exe ist weder falsch geschrieben oder konnte nicht gefunden werden
C:\windows\system32u

Ich habe auch schon mit frst.exe gescant.
die FRST Logfile



Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-08-2013
Ran by SYSTEM on 10-08-2013 16:41:29
Running from I:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SearchSettings] - C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe [1303360 2013-07-05] (Spigot, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1558480 2013-07-26] (APN)
HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]
HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]
HKU\Herbert\...\Run: [GoogleChromeAutoLaunch_07C7B4A0727A85CFB31587B8055A3D2B] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [846288 2013-07-24] (Google Inc.)
HKU\Herbert\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Herbert\AppData\Local\Temp\ytmwdustggyrnlexn.exe [x] <===== ATTENTION
HKU\Herbert\...\Run: [AOL Fast Start] - C:\Program Files (x86)\AOL Desktop 9.7\AOL.EXE [42320 2012-04-20] (AOL Inc.)
HKU\Herbert\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe [814472 2013-06-12] (Adobe Systems Incorporated)
HKU\Herbert\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\Herbert\...\Command Processor: "C:\Users\Herbert\AppData\Local\Temp\ytmwdustggyrnlexn.exe" <===== ATTENTION!
HKU\UpdatusUser\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [239720 2011-06-12] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\progra~3\browse~1\261519~1.190\{c16c1~1\browse~1.dll [2691536 2013-07-26] ()
Lsa: [Notification Packages] scecli C:\Program Files\Protector Suite\psqlpwd.dll
Startup: C:\Users\Herbert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> (No File)

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-17] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-17] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-07-17] (Avira Operations GmbH & Co. KG)
S2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
S2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-18] ()
S2 BrowserProtect; C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2847696 2013-07-26] ()
S2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [159752 2010-10-06] ()
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-12-14] ()
S2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [62464 2010-12-06] ()
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [x]

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-04-23] ()
S3 ATWPKT2; C:\Windows\system32\drivers\ATWPKT264.SYS [33592 2007-06-13] (America Online)
S3 ATWPKT2; C:\Windows\system32\drivers\ATWPKT264.SYS [33592 2007-06-13] (America Online)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-07-17] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-07-17] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-06] (Avira Operations GmbH & Co. KG)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-04-23] ()
S2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 RSUSBVSTOR; System32\Drivers\RTSUVSTOR.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-10 05:50 - 2013-08-10 05:50 - 00003432 _____ C:\Windows\System32\Tasks\BrowserProtect
2013-08-09 09:16 - 2013-08-09 09:16 - 00000000 ____D C:\Users\Herbert\AppData\Local\AskPartnerNetwork
2013-08-03 12:18 - 2013-08-03 12:19 - 00020814 _____ C:\Windows\PFRO.log
2013-08-01 00:39 - 2013-08-10 05:47 - 00000392 _____ C:\Windows\setupact.log
2013-08-01 00:39 - 2013-08-01 00:39 - 00000000 _____ C:\Windows\setuperr.log
2013-07-29 13:55 - 2013-07-29 13:57 - 00000000 ____D C:\Users\Herbert\Documents\Barbados.2013461
2013-07-29 13:52 - 2013-07-29 13:55 - 13177760 _____ C:\Users\Herbert\Documents\Barbados.2013461.zip
2013-07-27 22:57 - 2013-07-27 22:57 - 00016787 _____ C:\Users\Herbert\Documents\Aufstellung2012.xlsx
2013-07-27 02:29 - 2013-07-27 02:29 - 00000000 ____D C:\.Trash-999
2013-07-27 01:22 - 2013-07-27 01:22 - 00000000 ____D C:\Users\Herbert\AppData\Roaming\Avira
2013-07-27 01:21 - 2013-07-27 01:21 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2013-07-27 01:19 - 2013-07-27 01:19 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-07-27 01:19 - 2013-07-27 01:19 - 00000000 ____D C:\ProgramData\APN
2013-07-27 01:19 - 2013-07-27 01:19 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-07-27 01:18 - 2013-07-27 01:18 - 00002074 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-27 01:18 - 2013-07-27 01:18 - 00000000 ____D C:\Program Files (x86)\Avira
2013-07-27 01:18 - 2013-07-17 22:02 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-07-27 01:18 - 2013-07-17 22:02 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-07-27 01:18 - 2013-03-06 06:13 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-07-26 04:31 - 2013-07-26 04:31 - 00393521 _____ C:\ProgramData\2433f433
2013-07-26 04:31 - 2013-07-26 04:31 - 00393503 _____ C:\Users\Herbert\AppData\Local\2433f433
2013-07-26 04:31 - 2013-07-26 04:31 - 00393484 _____ C:\Users\Herbert\AppData\Roaming\2433f433
2013-07-26 04:20 - 2013-07-26 04:31 - 26144712 _____ C:\Users\Herbert\Documents\ffc2fb656289aad2e2547c9d5548e52972.flv
2013-07-24 12:07 - 2013-07-24 12:07 - 00000000 ____D C:\Program Files (x86)\pdfforge Toolbar
2013-07-24 12:07 - 2013-07-24 12:07 - 00000000 ____D C:\Program Files (x86)\Application Updater
2013-07-21 08:20 - 2013-07-21 08:28 - 177307221 _____ C:\Users\Herbert\Downloads\Grundlagen der Finanzwirtschaft (1).pdf.crdownload
2013-07-19 08:48 - 2013-07-20 14:26 - 00168960 _____ C:\Users\Herbert\Downloads\essen_im_dunkeln-gutschein.ppt
2013-07-18 21:32 - 2013-07-18 21:36 - 00000000 ____D C:\Windows\System32\MRT
2013-07-13 22:56 - 2013-07-26 15:45 - 00000000 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-07-13 14:10 - 2013-07-13 14:10 - 00000000 ____D C:\f86f314eff36194789
2013-07-12 15:48 - 2013-06-11 15:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 15:48 - 2013-06-11 15:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 15:48 - 2013-06-11 15:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 15:48 - 2013-06-11 15:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 15:48 - 2013-06-11 15:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 15:48 - 2013-06-11 15:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 15:48 - 2013-06-11 15:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 15:48 - 2013-06-11 15:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 15:48 - 2013-06-11 15:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 15:48 - 2013-06-11 15:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 15:48 - 2013-06-11 15:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 15:48 - 2013-06-11 15:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-12 15:48 - 2013-06-11 15:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-12 15:48 - 2013-06-11 15:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-12 15:48 - 2013-06-11 15:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-12 15:48 - 2013-06-11 15:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-12 15:48 - 2013-06-11 15:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-12 15:48 - 2013-06-11 15:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-12 15:48 - 2013-06-11 15:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-12 15:48 - 2013-06-11 15:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-07-12 15:48 - 2013-06-11 15:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-07-12 15:48 - 2013-06-11 15:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-12 15:48 - 2013-06-11 15:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-07-12 15:48 - 2013-06-11 14:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 15:48 - 2013-06-11 14:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-12 15:48 - 2013-06-06 19:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-12 15:48 - 2013-06-06 18:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-12 15:47 - 2013-06-11 15:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 15:47 - 2013-06-11 15:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 15:47 - 2013-06-11 15:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-12 15:47 - 2013-06-11 15:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-12 13:45 - 2013-06-03 22:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-12 13:45 - 2013-06-03 20:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-12 13:45 - 2013-05-05 22:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-12 13:45 - 2013-05-05 20:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-12 13:44 - 2013-06-04 19:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-07-12 13:44 - 2013-04-09 15:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-12 13:44 - 2013-04-02 14:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll

==================== One Month Modified Files and Folders =======

2013-08-10 05:58 - 2009-07-13 20:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-10 05:58 - 2009-07-13 20:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-10 05:55 - 2013-07-04 13:28 - 02096395 _____ C:\Windows\WindowsUpdate.log
2013-08-10 05:50 - 2013-08-10 05:50 - 00003432 _____ C:\Windows\System32\Tasks\BrowserProtect
2013-08-10 05:47 - 2013-08-01 00:39 - 00000392 _____ C:\Windows\setupact.log
2013-08-10 05:47 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-10 05:38 - 2011-06-19 09:00 - 00654852 _____ C:\Windows\System32\perfh007.dat
2013-08-10 05:38 - 2011-06-19 09:00 - 00130434 _____ C:\Windows\System32\perfc007.dat
2013-08-10 05:38 - 2009-07-13 21:13 - 01500294 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-10 05:36 - 2013-06-11 12:52 - 00000280 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-08-10 05:35 - 2013-06-26 08:24 - 00001426 _____ C:\Users\Herbert\Desktop\Registry kostenlos entrümpeln!.lnk
2013-08-10 05:35 - 2013-05-20 23:25 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-09 09:16 - 2013-08-09 09:16 - 00000000 ____D C:\Users\Herbert\AppData\Local\AskPartnerNetwork
2013-08-03 12:19 - 2013-08-03 12:18 - 00020814 _____ C:\Windows\PFRO.log
2013-08-03 12:19 - 2013-04-28 12:01 - 00000000 ____D C:\ProgramData\BrowserProtect
2013-08-01 00:39 - 2013-08-01 00:39 - 00000000 _____ C:\Windows\setuperr.log
2013-07-31 22:33 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
2013-07-31 13:39 - 2012-05-23 13:51 - 00000000 ____D C:\Users\Herbert\Desktop\Haus
2013-07-31 13:01 - 2013-06-11 12:52 - 00000288 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-07-31 13:01 - 2011-07-19 07:30 - 00000000 ____D C:\Users\Herbert\AppData\Roaming\SoftGrid Client
2013-07-29 13:57 - 2013-07-29 13:55 - 00000000 ____D C:\Users\Herbert\Documents\Barbados.2013461
2013-07-29 13:55 - 2013-07-29 13:52 - 13177760 _____ C:\Users\Herbert\Documents\Barbados.2013461.zip
2013-07-27 22:57 - 2013-07-27 22:57 - 00016787 _____ C:\Users\Herbert\Documents\Aufstellung2012.xlsx
2013-07-27 22:57 - 2011-11-06 07:04 - 01333760 ___SH C:\Users\Herbert\Desktop\Thumbs.db
2013-07-27 06:19 - 2013-07-02 07:41 - 00000000 ___RD C:\Users\Herbert\Dropbox
2013-07-27 06:19 - 2011-11-07 23:53 - 00000000 ____D C:\Users\Herbert\AppData\Roaming\Dropbox
2013-07-27 02:29 - 2013-07-27 02:29 - 00000000 ____D C:\.Trash-999
2013-07-27 01:22 - 2013-07-27 01:22 - 00000000 ____D C:\Users\Herbert\AppData\Roaming\Avira
2013-07-27 01:21 - 2013-07-27 01:21 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2013-07-27 01:19 - 2013-07-27 01:19 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-07-27 01:19 - 2013-07-27 01:19 - 00000000 ____D C:\ProgramData\APN
2013-07-27 01:19 - 2013-07-27 01:19 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-07-27 01:18 - 2013-07-27 01:18 - 00002074 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-27 01:18 - 2013-07-27 01:18 - 00000000 ____D C:\Program Files (x86)\Avira
2013-07-27 01:18 - 2013-02-25 15:37 - 00000000 ____D C:\ProgramData\Avira
2013-07-26 15:45 - 2013-07-13 22:56 - 00000000 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-07-26 04:31 - 2013-07-26 04:31 - 00393521 _____ C:\ProgramData\2433f433
2013-07-26 04:31 - 2013-07-26 04:31 - 00393503 _____ C:\Users\Herbert\AppData\Local\2433f433
2013-07-26 04:31 - 2013-07-26 04:31 - 00393484 _____ C:\Users\Herbert\AppData\Roaming\2433f433
2013-07-26 04:31 - 2013-07-26 04:20 - 26144712 _____ C:\Users\Herbert\Documents\ffc2fb656289aad2e2547c9d5548e52972.flv
2013-07-24 12:07 - 2013-07-24 12:07 - 00000000 ____D C:\Program Files (x86)\pdfforge Toolbar
2013-07-24 12:07 - 2013-07-24 12:07 - 00000000 ____D C:\Program Files (x86)\Application Updater
2013-07-21 08:28 - 2013-07-21 08:20 - 177307221 _____ C:\Users\Herbert\Downloads\Grundlagen der Finanzwirtschaft (1).pdf.crdownload
2013-07-20 14:26 - 2013-07-19 08:48 - 00168960 _____ C:\Users\Herbert\Downloads\essen_im_dunkeln-gutschein.ppt
2013-07-18 21:36 - 2013-07-18 21:32 - 00000000 ____D C:\Windows\System32\MRT
2013-07-17 22:02 - 2013-07-27 01:18 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-07-17 22:02 - 2013-07-27 01:18 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-07-13 14:10 - 2013-07-13 14:10 - 00000000 ____D C:\f86f314eff36194789
2013-07-13 14:09 - 2011-06-18 23:10 - 00000000 ____D C:\Windows\Panther
2013-07-13 11:52 - 2009-07-13 20:45 - 00649976 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-13 11:51 - 2011-07-18 12:21 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-13 11:51 - 2011-07-18 12:21 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-13 11:49 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-13 11:49 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-13 11:48 - 2012-05-21 14:22 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-13 11:48 - 2012-05-21 14:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-13 11:48 - 2011-04-12 00:28 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 15:51 - 2012-02-17 13:45 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-12 13:58 - 2011-07-18 12:21 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-12 13:58 - 2011-07-18 12:21 - 00003856 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

ZeroAccess:
C:\Users\Herbert\AppData\Local\{f37f9244-f743-2fc5-8bbd-ad4023e125a8}
C:\Users\Herbert\AppData\Local\{f37f9244-f743-2fc5-8bbd-ad4023e125a8}\@

Files to move or delete:
====================
C:\ProgramData\loc_pyt_0_kroj.pad

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-07-11 14:34:22
Restore point made on: 2013-07-12 15:45:55
Restore point made on: 2013-07-13 14:09:56
Restore point made on: 2013-07-13 23:02:09
Restore point made on: 2013-07-14 12:02:34
Restore point made on: 2013-07-18 21:32:37
Restore point made on: 2013-07-21 12:03:20
Restore point made on: 2013-07-23 12:05:01
Restore point made on: 2013-07-27 02:13:23
Restore point made on: 2013-07-27 02:21:29
Restore point made on: 2013-07-27 03:14:13
Restore point made on: 2013-07-28 12:40:12
Restore point made on: 2013-08-06 09:36:31

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 6055.05 MB
Available physical RAM: 5296.52 MB
Total Pagefile: 6053.25 MB
Available Pagefile: 5288.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:657.54 GB) (Free:154.73 GB) NTFS (Disk=0 Partition=2)
Drive d: (Recover) (Fixed) (Total:37.99 GB) (Free:0.01 GB) NTFS (Disk=0 Partition=4)
Drive i: (10 Aug 2013) (CDROM) (Total:0.69 GB) (Free:0.66 GB) UDF
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: () (Fixed) (Total:0.1 GB) (Free:0.03 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 2BD2C32A)
Partition 1: (Active) - (Size=101 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=658 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=40 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)


LastRegBack: 2013-07-27 04:43

==================== End Of Log ============================