GVU Trojaner, zum ersten ...

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2013 01
Ran by SYSTEM on 13-08-2013 19:25:07
Running from H:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-16] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [524800 2010-12-13] (IDT, Inc.)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company)
HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2012-01-04] (Intel(R) Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [318520 2010-12-13] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-02-09] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [281768 2011-04-20] (Avira GmbH)
HKLM-x32\...\Run: [DATAMNGR] - C:\PROGRA~2\WI3C8A~1\Datamngr\DATAMN~1.EXE [1694608 2011-12-06] (Bandoo Media, inc)
HKU\Mcx1-MARIUS-HP\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation) <==== ATTENTION 
HKU\Steinmetzer\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-11-22] (Hewlett-Packard Company)
HKU\Steinmetzer\...\Run: [Wisdom-soft AutoScreenRecorder 3.1 Free] - 0 [x]
HKU\Steinmetzer\...\Run: [Speech Recognition] - C:\Windows\Speech\Common\sapisvr.exe [44544 2009-07-13] (Microsoft Corporation)
HKU\Steinmetzer\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1671592 2013-07-01] (Valve Corporation)
HKU\Steinmetzer\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59240 2012-02-23] (Apple Inc.)
HKU\Steinmetzer\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59240 2012-02-23] (Apple Inc.)
HKU\Steinmetzer\...\Run: [Spotify Web Helper] - C:\Users\Steinmetzer\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-10] (Spotify Ltd)
HKU\Steinmetzer\...\Run: [GoogleChromeAutoLaunch_86E68EA1987AAE753BE55EE1F8756C88] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [846288 2013-07-24] (Google Inc.)
HKU\Steinmetzer\...\Run: [Spotify] - C:\Users\Steinmetzer\AppData\Roaming\Spotify\spotify.exe [4640768 2013-07-10] (Spotify Ltd)
HKU\Steinmetzer\...\Run: [Facebook Update] - C:\Users\Steinmetzer\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-04-07] (Facebook Inc.)
HKU\Steinmetzer\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-20] (Skype Technologies S.A.)
HKU\Steinmetzer\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\STEINM~1\AppData\Local\Temp\lxjkqmfrfxxdvsirg.exe [62976 2013-08-12] (Valve Corporation) <===== ATTENTION
HKU\Steinmetzer\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe [814472 2013-06-11] (Adobe Systems Incorporated)
HKU\Steinmetzer\...\Winlogon: [Shell] cmd.exe [345088 2010-11-19] (Microsoft Corporation) <==== ATTENTION 
HKU\Steinmetzer\...\Command Processor: "C:\Users\STEINM~1\AppData\Local\Temp\lxjkqmfrfxxdvsirg.exe" <===== ATTENTION!
AppInit_DLLs: C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll  [1791384 2011-12-06] (Bandoo Media, inc)
Startup: C:\Users\Steinmetzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\Steinmetzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk ->  (No File)
Startup: C:\Users\Steinmetzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kitre0.exe.lnk
ShortcutTarget: kitre0.exe.lnk -> C:\Users\STEINM~1\AppData\Local\Temp\kitre0.exe (No File)
Startup: C:\Users\Steinmetzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Steinmetzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Real Desktop.lnk
ShortcutTarget: Real Desktop.lnk -> C:\Program Files (x86)\Real Desktop\Real Desktop.exe (No File)

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [136360 2011-04-20] (Avira GmbH)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [269480 2011-07-21] (Avira GmbH)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2012-01-04] ()
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [3889424 2011-08-01] (INCA Internet Co., Ltd.)
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-06-16] ()
S2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll [x]
S2 ezSharedSvc; 

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88288 2011-07-21] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [123784 2011-07-21] (Avira GmbH)
S3 RZMAELSTROMVADService; C:\Windows\System32\drivers\RzMaelstromVAD.sys [40696 2013-05-17] (Windows (R) Win 7 DDK provider)
S3 ss_bserd; C:\Windows\System32\DRIVERS\ss_bserd.sys [128000 2009-09-18] (MCCI Corporation)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-01-10] (Anchorfree Inc.)
S3 dump_wmimmc; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-12 10:03 - 2013-08-12 10:03 - 00393568 _____ C:\Users\Steinmetzer\AppData\Roaming\2433f433
2013-08-12 10:03 - 2013-08-12 10:03 - 00393540 _____ C:\ProgramData\2433f433
2013-08-12 10:03 - 2013-08-12 10:03 - 00393521 _____ C:\Users\Steinmetzer\AppData\Local\2433f433
2013-08-10 05:00 - 2013-08-10 05:10 - 139145504 _____ (GIANTS Software                                             ) C:\Users\Steinmetzer\Downloads\FarmingSimulator2013Patch2.0DE_PublicBeta2 (1).exe
2013-08-10 04:38 - 2013-08-10 04:41 - 00009551 _____ C:\Users\Steinmetzer\Downloads\FarmingSimulator2013Patch2.0DE_PublicBeta2.exe
2013-08-07 13:53 - 2013-08-12 08:50 - 00000000 ___RD C:\Users\Steinmetzer\Desktop\,
2013-08-05 06:10 - 2013-08-05 06:13 - 37949670 _____ C:\Users\Steinmetzer\Downloads\fendt13bbgreen.rar
2013-07-31 12:38 - 2013-07-31 12:38 - 00003142 _____ C:\Windows\System32\Tasks\{A2DB886C-B0C6-4D79-B64F-8DDF8A759933}
2013-07-31 12:27 - 2013-07-31 12:36 - 108422648 _____ C:\Users\Steinmetzer\Downloads\avira_free_antivirus884_de.exe
2013-07-31 11:14 - 2013-07-31 11:14 - 00181452 _____ C:\Users\Steinmetzer\AppData\Local\9f2c10a0-f56c-464d-b90f-23109eb5be53
2013-07-31 11:14 - 2013-07-31 11:14 - 00093184 _____ (Корпорация  Майкрософт) C:\Users\Steinmetzer\AppData\Local\vcitocrekhjhppfmygw.bfg
2013-07-28 13:11 - 2013-07-28 13:12 - 11342986 _____ C:\Users\Steinmetzer\Downloads\zuerst_entpacken (1).zip
2013-07-28 13:09 - 2013-07-28 13:09 - 05122685 _____ C:\Users\Steinmetzer\Downloads\Holaras_Schild_ENTPACKEN.rar
2013-07-20 11:27 - 2013-07-20 11:27 - 00000000 ____D C:\Games
2013-07-18 01:09 - 2013-07-18 01:11 - 00000000 ____D C:\Windows\System32\MRT
2013-07-14 12:44 - 2013-07-14 12:46 - 18496415 _____ C:\Users\Steinmetzer\Downloads\Lexion 550 UNPACK ME V2.5.rar

==================== One Month Modified Files and Folders =======

2013-08-13 09:18 - 2013-01-30 06:58 - 00005254 _____ C:\Windows\setupact.log
2013-08-13 09:18 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-13 08:59 - 2009-07-13 20:45 - 00023024 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-13 08:59 - 2009-07-13 20:45 - 00023024 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-13 08:56 - 2011-01-09 16:49 - 21629446 _____ C:\Windows\System32\perfh007.dat
2013-08-13 08:56 - 2011-01-09 16:49 - 06964686 _____ C:\Windows\System32\perfc007.dat
2013-08-13 08:56 - 2009-07-13 21:13 - 00006678 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-13 08:54 - 2011-11-02 13:13 - 00000356 _____ C:\Windows\Tasks\HPCeeScheduleForSteinmetzer.job
2013-08-13 08:53 - 2012-10-24 09:47 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-13 08:47 - 2013-03-13 08:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-13 08:47 - 2012-10-24 09:47 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-13 08:47 - 2012-05-16 12:38 - 00001144 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1421421367-465013136-1781341850-1001UA.job
2013-08-13 08:47 - 2012-05-16 12:38 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1421421367-465013136-1781341850-1001Core.job
2013-08-13 08:47 - 2011-09-20 10:44 - 00000952 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1421421367-465013136-1781341850-1001UA.job
2013-08-13 08:47 - 2011-09-20 10:44 - 00000930 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1421421367-465013136-1781341850-1001Core.job
2013-08-12 10:10 - 2013-02-03 09:29 - 00117926 _____ C:\Windows\PFRO.log
2013-08-12 10:05 - 2011-04-15 18:01 - 01253497 _____ C:\Windows\WindowsUpdate.log
2013-08-12 10:03 - 2013-08-12 10:03 - 00393568 _____ C:\Users\Steinmetzer\AppData\Roaming\2433f433
2013-08-12 10:03 - 2013-08-12 10:03 - 00393540 _____ C:\ProgramData\2433f433
2013-08-12 10:03 - 2013-08-12 10:03 - 00393521 _____ C:\Users\Steinmetzer\AppData\Local\2433f433
2013-08-12 08:53 - 2011-10-29 10:09 - 00000000 ____D C:\Users\Steinmetzer\AppData\Roaming\TS3Client
2013-08-12 08:53 - 2011-09-21 09:23 - 00000000 ____D C:\Users\Steinmetzer\AppData\Local\CrashDumps
2013-08-12 08:51 - 2012-10-21 10:54 - 00000000 ____D C:\Users\Steinmetzer\AppData\Local\TeamSpeak 3 Client
2013-08-12 08:50 - 2013-08-07 13:53 - 00000000 ___RD C:\Users\Steinmetzer\Desktop\,
2013-08-12 08:32 - 2012-09-12 11:27 - 00000000 ____D C:\Users\Steinmetzer\AppData\Local\Spotify
2013-08-12 08:32 - 2012-09-12 11:26 - 00000000 ____D C:\Users\Steinmetzer\AppData\Roaming\Spotify
2013-08-10 05:11 - 2012-10-24 10:40 - 00000000 ____D C:\Program Files (x86)\Landwirtschafts Simulator 2013
2013-08-10 05:10 - 2013-08-10 05:00 - 139145504 _____ (GIANTS Software                                             ) C:\Users\Steinmetzer\Downloads\FarmingSimulator2013Patch2.0DE_PublicBeta2 (1).exe
2013-08-10 04:41 - 2013-08-10 04:38 - 00009551 _____ C:\Users\Steinmetzer\Downloads\FarmingSimulator2013Patch2.0DE_PublicBeta2.exe
2013-08-09 03:09 - 2011-12-29 16:47 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-09 02:54 - 2011-11-02 13:13 - 00003222 _____ C:\Windows\System32\Tasks\HPCeeScheduleForSteinmetzer
2013-08-07 14:04 - 2013-02-03 04:00 - 00001036 _____ C:\Users\Steinmetzer\Desktop\Dropbox.lnk
2013-08-07 14:04 - 2013-02-03 04:00 - 00000000 ___RD C:\Users\Steinmetzer\Dropbox
2013-08-07 14:04 - 2013-02-03 03:54 - 00000000 ____D C:\Users\Steinmetzer\AppData\Roaming\Dropbox
2013-08-07 11:12 - 2011-10-05 11:25 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-08-05 06:13 - 2013-08-05 06:10 - 37949670 _____ C:\Users\Steinmetzer\Downloads\fendt13bbgreen.rar
2013-08-05 02:31 - 2011-12-24 11:37 - 00000000 ____D C:\Users\Steinmetzer\AppData\Roaming\.minecraft
2013-08-02 12:53 - 2012-03-14 10:03 - 00000000 ____D C:\Program Files (x86)\Google
2013-07-31 12:38 - 2013-07-31 12:38 - 00003142 _____ C:\Windows\System32\Tasks\{A2DB886C-B0C6-4D79-B64F-8DDF8A759933}
2013-07-31 12:36 - 2013-07-31 12:27 - 108422648 _____ C:\Users\Steinmetzer\Downloads\avira_free_antivirus884_de.exe
2013-07-31 12:20 - 2011-09-15 03:12 - 00000000 ____D C:\users\Steinmetzer
2013-07-31 12:20 - 2009-07-13 20:45 - 00417384 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-31 12:19 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-31 12:19 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-31 12:18 - 2012-01-01 13:05 - 00000000 ____D C:\users\Mcx1-MARIUS-HP
2013-07-31 12:16 - 2013-03-14 05:21 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-31 12:16 - 2013-03-14 05:21 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-31 12:16 - 2011-09-15 23:21 - 00000000 ____D C:\ProgramData\Avira
2013-07-31 12:16 - 2011-09-15 23:21 - 00000000 ____D C:\Program Files (x86)\Avira
2013-07-31 12:16 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-07-31 12:14 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration
2013-07-31 11:14 - 2013-07-31 11:14 - 00181452 _____ C:\Users\Steinmetzer\AppData\Local\9f2c10a0-f56c-464d-b90f-23109eb5be53
2013-07-31 11:14 - 2013-07-31 11:14 - 00093184 _____ (Корпорация  Майкрософт) C:\Users\Steinmetzer\AppData\Local\vcitocrekhjhppfmygw.bfg
2013-07-28 13:12 - 2013-07-28 13:11 - 11342986 _____ C:\Users\Steinmetzer\Downloads\zuerst_entpacken (1).zip
2013-07-28 13:09 - 2013-07-28 13:09 - 05122685 _____ C:\Users\Steinmetzer\Downloads\Holaras_Schild_ENTPACKEN.rar
2013-07-23 00:04 - 2012-11-03 07:20 - 00000000 ____D C:\Users\Steinmetzer\AppData\Local\Paint.NET
2013-07-20 11:27 - 2013-07-20 11:27 - 00000000 ____D C:\Games
2013-07-18 01:11 - 2013-07-18 01:09 - 00000000 ____D C:\Windows\System32\MRT
2013-07-14 12:46 - 2013-07-14 12:44 - 18496415 _____ C:\Users\Steinmetzer\Downloads\Lexion 550 UNPACK ME V2.5.rar

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1421421367-465013136-1781341850-1001\$480952bbd06f13c408d8325fcad7e9c6

Files to move or delete:
====================
C:\Users\STEINM~1\AppData\Local\Temp\lxjkqmfrfxxdvsirg.exe
C:\Users\Steinmetzer\AppData\Roaming\cache.dat

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-07-31 12:06:43
Restore point made on: 2013-07-31 12:46:19
Restore point made on: 2013-08-05 22:40:06
Restore point made on: 2013-08-09 03:05:37

==================== Memory info =========================== 

Percentage of memory in use: 18%
Total physical RAM: 4043.86 MB
Available physical RAM: 3281.64 MB
Total Pagefile: 4042.01 MB
Available Pagefile: 3279.08 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:580.17 GB) (Free:184.92 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive e: (RECOVERY) (Fixed) (Total:15.71 GB) (Free:1.94 GB) NTFS (Disk=0 Partition=3)
Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32 (Disk=0 Partition=4)
Drive h: (MARIUSKLEIN) (Removable) (Total:0.48 GB) (Free:0.48 GB) FAT32 (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: FBCCF9BA)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=580 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

========================================================
Disk: 1 (Size: 491 MB) (Disk ID: 643D5C3C)
Partition 1: (Active) - (Size=491 MB) - (Type=0B)


LastRegBack: 2013-08-07 15:03

==================== End Of Log ============================