Windows 7: Sperrbildschirm - "GVU" - TR/Reveton.V.48

PeterLu · 17.11.2013, 17:44

Hallo Matthias,

Rechner ließ sich nach dem Fix normal booten. Hier das Fixlog:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-11-2013
Ran by M********** at 2013-11-17 17:34:29 Run:1
Running from C:\Users\M**********\Desktop
Boot Mode: Safe Mode (with Networking)
==============================================

Content of fixlist:
*****************
start
Startup: C:\Users\MONIUN~1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\go8btmq.lnk
ShortcutTarget: go8btmq.lnk -> C:\PROGRA~3\qmtb8og.dss (Microsoft Corporation)
C:\ProgramData\go8btmq.reg
C:\ProgramData\go8btmq.pss
C:\ProgramData\go8btmq.bxx
C:\ProgramData\go8btmq.fvv
C:\ProgramData\qmtb8og.dss
C:\Users\MONIUN~1\AppData\Local\Temp\*.exe
end
         
*****************

C:\Users\MONIUN~1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\go8btmq.lnk => Moved successfully.
C:\PROGRA~3\qmtb8og.dss => Moved successfully.
C:\ProgramData\go8btmq.reg => Moved successfully.
C:\ProgramData\go8btmq.pss => Moved successfully.
C:\ProgramData\go8btmq.bxx => Moved successfully.
C:\ProgramData\go8btmq.fvv => Moved successfully.
"C:\ProgramData\qmtb8og.dss" => File/Directory not found.

"C:\Users\MONIUN~1\AppData\Local\Temp\*.exe" directory move:

Could not move "C:\Users\MONIUN~1\AppData\Local\Temp\*.exe" directory. => Scheduled to move on reboot.


=========== Result of Scheduled Files to move ===========

"C:\Users\MONIUN~1\AppData\Local\Temp\*.exe" => Directory could not move.

==== End of Fixlog ====

War es das wohl schon?

Gruß Peter

M-K-D-B · 18.11.2013, 08:00

Servus Peter,

Zitat:

Zitat von PeterLu

War es das wohl schon?

du meinst mit der Bereinigung? Nein.

Verschiebe die FRST.exe vom USB-Stick auf den Desktop des Rechners und führe FRST im normalen Modus nochmal aus:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

PeterLu · 18.11.2013, 17:53

Hallo Matthias,

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-11-2013
Ran by M******** (ATTENTION: The logged in user is not administrator) on LAPTOPMR on 18-11-2013 17:51:21
Running from C:\Users\M********\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\HOTKEY\MKRMSG.EXE
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
(Lenovo Group Limited) C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
(Lenovo Group Limited) C:\Program Files (x86)\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2789160 2011-05-19] (Synaptics Incorporated)
HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [380776 2011-03-29] (Lenovo.)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [310912 2011-04-26] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] - C:\Program Files\CONEXANT\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000}
HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196}
HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196}
HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [WDM_DRMKAUD] - rundll32.exe streamci,StreamingDeviceSetup {EEC12DB6-AD9C-4168-8658-B03DAEF417FE},{ABD61E00-9350-47e2-A632-4438B90C6641},{FFBB6E3F-CCFE-4D84-90D9-421418B03A8E},C:\Windows\inf\WDMAUDIO.inf,WDM_DRMKAUD.Interface.Install
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.)
HKCU\...\Run: [LTT] - C:\Program Files\PC-Doctor\EnableToolbarW32.exe
MountPoints2: {fde84546-5f47-11e1-9202-806e6f6e6963} - Q:\LenovoQDrive.exe
HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [PWMTRV] - C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL [1629544 2011-08-31] (Lenovo Group Limited)
HKLM-x32\...\Run: [Lenovo Registration] - C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2011-07-13] (Lenovo, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421736 2012-03-06] (Apple Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-10-23] (APN)
HKLM-x32\...\Run: [Launch Backup Service Once] - C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrstrigger.exe [133944 2011-08-18] ()
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\M********\AppData\Roaming\Mozilla\Firefox\Profiles\yomldf85.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @garmin.com/GpsControl - C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Garmin Communicator - C:\Users\M********\AppData\Roaming\Mozilla\Firefox\Profiles\yomldf85.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Extension: (Norton Identity Protection) - C:\Users\MONIUN~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.1.0.30_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx

==================== Services (Whitelisted) =================

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [948296 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
S2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-07-27] ()
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1028096 2010-08-31] (Lenovo Group Limited)
R3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1492280 2011-08-18] (Lenovo Group Limited)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 PHCORE; C:\Program Files\Lenovo\RapidBoot\PHCORE64.SYS [32104 2011-07-08] (Lenovo Group Limited)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13840 2009-03-13] (UPEK Inc.)
R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-30] (Lenovo Information Product(ShenZhen China) Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-18 17:51 - 2013-11-16 11:06 - 01957794 _____ (Farbar) C:\Users\M********\Desktop\FRST64.exe
2013-11-18 17:50 - 2013-11-18 17:50 - 00000000 ____D C:\Users\M********\AppData\Local\AskPartnerNetwork
2013-11-17 11:07 - 2013-11-17 11:10 - 00013786 _____ C:\Users\M********\Desktop\AVSCAN-20131113-180136-707EC4F6.LOG
2013-11-17 11:05 - 2013-11-17 11:57 - 00000795 _____ C:\Users\M********\Desktop\Post1.txt
2013-11-17 10:58 - 2013-11-17 10:58 - 00000817 _____ C:\Users\M********\Desktop\Gmer.txt
2013-11-17 10:50 - 2013-11-16 11:08 - 00377856 _____ C:\Users\M********\Desktop\gmer_2.1.19163.exe
2013-11-17 10:48 - 2013-11-17 11:03 - 00017417 _____ C:\Users\M********\Desktop\Addition1.txt
2013-11-17 10:47 - 2013-11-18 17:51 - 00012167 _____ C:\Users\M********\Desktop\FRST.txt
2013-11-17 10:47 - 2013-11-18 17:48 - 00016785 _____ C:\Users\M********\Desktop\FRST1.txt
2013-11-17 10:47 - 2013-11-17 17:40 - 00000000 ____D C:\FRST
2013-11-17 10:45 - 2013-11-17 10:45 - 00000472 _____ C:\Users\M********\Desktop\defogger_disable.log
2013-11-17 10:45 - 2013-11-17 10:45 - 00000000 _____ C:\Users\Peter\defogger_reenable
2013-11-17 10:44 - 2013-11-16 11:03 - 00050477 _____ C:\Users\M********\Desktop\Defogger.exe

==================== One Month Modified Files and Folders =======

2013-11-18 17:51 - 2013-11-17 10:47 - 00012167 _____ C:\Users\M********\Desktop\FRST.txt
2013-11-18 17:50 - 2013-11-18 17:50 - 00000000 ____D C:\Users\M********\AppData\Local\AskPartnerNetwork
2013-11-18 17:48 - 2013-11-17 10:47 - 00016785 _____ C:\Users\M********\Desktop\FRST1.txt
2013-11-18 17:48 - 2009-07-14 05:45 - 00024400 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-18 17:48 - 2009-07-14 05:45 - 00024400 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-18 17:47 - 2012-02-25 10:16 - 00696870 _____ C:\Windows\system32\perfh007.dat
2013-11-18 17:47 - 2012-02-25 10:16 - 00148134 _____ C:\Windows\system32\perfc007.dat
2013-11-18 17:47 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-18 17:39 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-18 17:38 - 2009-07-14 05:51 - 00102837 _____ C:\Windows\setupact.log
2013-11-17 17:46 - 2012-02-25 01:35 - 01711252 _____ C:\Windows\WindowsUpdate.log
2013-11-17 17:40 - 2013-11-17 10:47 - 00000000 ____D C:\FRST
2013-11-17 17:34 - 2012-03-16 16:55 - 00000000 ___RD C:\Users\M********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-17 11:57 - 2013-11-17 11:05 - 00000795 _____ C:\Users\M********\Desktop\Post1.txt
2013-11-17 11:10 - 2013-11-17 11:07 - 00013786 _____ C:\Users\M********\Desktop\AVSCAN-20131113-180136-707EC4F6.LOG
2013-11-17 11:03 - 2013-11-17 10:48 - 00017417 _____ C:\Users\M********\Desktop\Addition1.txt
2013-11-17 10:58 - 2013-11-17 10:58 - 00000817 _____ C:\Users\M********\Desktop\Gmer.txt
2013-11-17 10:45 - 2013-11-17 10:45 - 00000472 _____ C:\Users\M********\Desktop\defogger_disable.log
2013-11-17 10:45 - 2013-11-17 10:45 - 00000000 _____ C:\Users\Peter\defogger_reenable
2013-11-17 10:45 - 2012-03-16 21:48 - 00000000 ____D C:\Users\Peter
2013-11-16 11:08 - 2013-11-17 10:50 - 00377856 _____ C:\Users\M********\Desktop\gmer_2.1.19163.exe
2013-11-16 11:06 - 2013-11-18 17:51 - 01957794 _____ (Farbar) C:\Users\M********\Desktop\FRST64.exe
2013-11-16 11:03 - 2013-11-17 10:44 - 00050477 _____ C:\Users\M********\Desktop\Defogger.exe
2013-11-15 19:47 - 2012-04-06 19:54 - 426364112 _____ C:\Windows\MEMORY.DMP
2013-11-15 19:47 - 2012-04-06 19:54 - 00000000 ____D C:\Windows\Minidump

Some content of TEMP:
====================
C:\Users\M********\AppData\Local\Temp\0OKD.dll
C:\Users\M********\AppData\Local\Temp\avgnt.exe
C:\Users\M********\AppData\Local\Temp\tmp1FFE.exe
C:\Users\M********\AppData\Local\Temp\tmp3E.exe
C:\Users\M********\AppData\Local\Temp\tmp67C7.exe
C:\Users\M********\AppData\Local\Temp\tmp9636.exe
C:\Users\M********\AppData\Local\Temp\tmpE9F0.exe
C:\Users\M********\AppData\Local\Temp\tmpEB3B.exe
C:\Users\M********\AppData\Local\Temp\tmpEF1E.exe
C:\Users\M********\AppData\Local\Temp\tmpF1DC.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

--- --- ---

Gruß Peter

M-K-D-B · 18.11.2013, 19:34

Servus,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Windows 7: Sperrbildschirm - "GVU" - TR/Reveton.V.48

Log-Analyse und Auswertung: Windows 7: Sperrbildschirm - "GVU" - TR/Reveton.V.48