GUV-BKA-Trojaner

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013
Ran by SYSTEM on MININT-UFNJ1VL on 21-11-2013 11:55:07
Running from F:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
 
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 
==================== Registry (Whitelisted) ==================
 
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-07-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ATICustomerCare] - C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-03-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1766464 2013-10-16] (1und1 Mail und Media GmbH)
HKU\Hirth\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-09-26] (Google Inc.)
HKU\Hirth\...\Run: [Adobe Reader Synchronizer] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe [1272704 2013-09-03] (Adobe Systems Incorporated)
HKU\Hirth\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1093464 2013-07-09] (Garmin Ltd or its subsidiaries)
Startup: C:\Users\Hirth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f2vvfrrj.lnk
ShortcutTarget: f2vvfrrj.lnk -> C:\PROGRA~3\jrrfvv2f.dss (Корпорация Майкрософт)
 
==================== Services (Whitelisted) =================
 
S2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [219480 2013-07-09] (Garmin Ltd or its subsidiaries)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe [275696 2013-10-08] (Symantec Corporation)
S2 Winmgmt; C:\ProgramData\fodh3ow.pss [61024 2013-11-18] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
S1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\BASHDefs\20131114.001\BHDrvx64.sys [1524824 2013-10-23] (Symantec Corporation)
S1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-21] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-21] (Symantec Corporation)
S1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\IPSDefs\20131120.003\IDSvia64.sys [521816 2013-10-29] (Symantec Corporation)
S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)
S3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\VirusDefs\20131120.017\ENG64.SYS [126040 2013-10-01] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\VirusDefs\20131120.017\EX64.SYS [2099288 2013-10-01] (Symantec Corporation)
S1 SRTSP; C:\Windows\System32\Drivers\NISx64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSPX64.SYS [36952 2013-07-31] (Symantec Corporation)
S3 StarOpen; No ImagePath
S0 SymDS; C:\Windows\System32\drivers\NISx64\1501000.012\SYMDS64.SYS [493656 2013-08-01] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NISx64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-10-01] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NISx64\1501000.012\Ironx64.SYS [264280 2013-07-31] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NISx64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
S3 EraserUtilDrv11312; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11312.sys [x]
S3 MSICDSetup; \??\D:\CDriver64.sys [x]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2013-11-21 11:54 - 2013-11-21 11:54 - 00000000 ____D C:\FRST
2013-11-21 09:18 - 2013-11-21 11:35 - 95025368 ____T C:\ProgramData\f2vvfrrj.bxx
2013-11-21 09:18 - 2013-11-21 11:35 - 00000000 _____ C:\ProgramData\f2vvfrrj.fvv
2013-11-21 09:18 - 2013-11-21 09:18 - 00221184 _____ (Корпорация Майкрософт) C:\ProgramData\jrrfvv2f.dss
2013-11-21 09:18 - 2013-11-21 09:18 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\f2vvfrrj.pss
2013-11-20 11:14 - 2013-11-20 11:14 - 00000000 ____D C:\Users\Hirth\AppData\Local\NPE
2013-11-18 20:37 - 2013-11-18 20:37 - 00001513 _____ C:\Users\Hirth\Desktop\Internet Explorer.lnk
2013-11-18 19:48 - 2013-11-18 19:48 - 51415040 _____ (Microsoft Corporation) C:\Users\Hirth\Downloads\IE10-Windows6.1-x64-de-de.exe
2013-11-18 11:11 - 2013-11-18 15:39 - 00000000 ____D C:\Users\Hirth\AppData\Local\CrashDumps
2013-11-18 10:54 - 2013-11-18 19:23 - 95025368 ____T C:\ProgramData\fodh3ow.bxx
2013-11-18 10:54 - 2013-11-18 15:38 - 00000000 _____ C:\ProgramData\fodh3ow.fvv
2013-11-18 10:54 - 2013-11-18 10:54 - 00061024 ____T (Microsoft Corporation) C:\ProgramData\fodh3ow.pss
2013-11-18 10:54 - 2013-11-18 10:54 - 00000279 _____ C:\ProgramData\fodh3ow.reg
2013-11-14 20:54 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-14 20:54 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-11-14 20:54 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-14 20:54 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-11-14 20:54 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 20:54 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 20:54 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-14 20:54 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-14 20:54 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-11-14 20:54 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 20:53 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-14 20:53 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-14 20:53 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-14 20:53 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 20:53 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 20:53 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 16:51 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-11-14 16:51 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 16:51 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\System32\SmartcardCredentialProvider.dll
2013-11-14 16:51 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\credui.dll
2013-11-14 16:51 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-11-14 16:51 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 16:51 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 16:51 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 16:51 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2013-11-14 16:50 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\System32\nshwfp.dll
2013-11-14 16:50 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL
2013-11-14 16:50 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL
2013-11-14 16:50 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 16:50 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 16:50 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-11-14 16:50 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 16:50 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2013-11-14 16:50 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2013-11-14 16:50 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2013-11-14 16:50 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2013-11-14 16:50 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2013-11-14 16:50 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2013-11-14 16:50 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2013-11-14 16:50 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2013-11-14 16:50 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 16:50 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 16:50 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 16:50 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 16:50 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2013-11-14 16:50 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files\WEB.DE MailCheck
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files (x86)\WEB.DE MailCheck
2013-11-08 17:37 - 2013-11-08 17:37 - 00000000 ____D C:\ProgramData\UUdb
2013-11-05 14:16 - 2013-11-05 14:18 - 00000000 _____ C:\ctapi_out_gr.txt
 
==================== One Month Modified Files and Folders =======
 
2013-11-21 11:54 - 2013-11-21 11:54 - 00000000 ____D C:\FRST
2013-11-21 11:42 - 2009-07-14 05:45 - 00014928 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-21 11:42 - 2009-07-14 05:45 - 00014928 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-21 11:35 - 2013-11-21 09:18 - 95025368 ____T C:\ProgramData\f2vvfrrj.bxx
2013-11-21 11:35 - 2013-11-21 09:18 - 00000000 _____ C:\ProgramData\f2vvfrrj.fvv
2013-11-21 11:35 - 2012-09-26 09:23 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-21 11:34 - 2010-12-21 15:28 - 00084791 _____ C:\Windows\setupact.log
2013-11-21 11:34 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-21 11:27 - 2010-08-20 22:48 - 01960136 _____ C:\Windows\WindowsUpdate.log
2013-11-21 09:18 - 2013-11-21 09:18 - 00221184 _____ (Корпорация Майкрософт) C:\ProgramData\jrrfvv2f.dss
2013-11-21 09:18 - 2013-11-21 09:18 - 00061540 ____T (Microsoft Corporation) C:\ProgramData\f2vvfrrj.pss
2013-11-21 08:55 - 2013-01-18 10:05 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-21 08:54 - 2012-09-26 09:23 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-20 11:14 - 2013-11-20 11:14 - 00000000 ____D C:\Users\Hirth\AppData\Local\NPE
2013-11-18 20:37 - 2013-11-18 20:37 - 00001513 _____ C:\Users\Hirth\Desktop\Internet Explorer.lnk
2013-11-18 20:32 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\NDF
2013-11-18 19:50 - 2013-05-07 19:33 - 00011008 _____ C:\Windows\IE10_main.log
2013-11-18 19:48 - 2013-11-18 19:48 - 51415040 _____ (Microsoft Corporation) C:\Users\Hirth\Downloads\IE10-Windows6.1-x64-de-de.exe
2013-11-18 19:23 - 2013-11-18 10:54 - 95025368 ____T C:\ProgramData\fodh3ow.bxx
2013-11-18 15:46 - 2011-02-06 20:19 - 00000000 ____D C:\Users\Eigene Dateien\Norbert
2013-11-18 15:39 - 2013-11-18 11:11 - 00000000 ____D C:\Users\Hirth\AppData\Local\CrashDumps
2013-11-18 15:38 - 2013-11-18 10:54 - 00000000 _____ C:\ProgramData\fodh3ow.fvv
2013-11-18 15:38 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-18 10:54 - 2013-11-18 10:54 - 00061024 ____T (Microsoft Corporation) C:\ProgramData\fodh3ow.pss
2013-11-18 10:54 - 2013-11-18 10:54 - 00000279 _____ C:\ProgramData\fodh3ow.reg
2013-11-16 15:54 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-16 13:57 - 2012-09-26 09:23 - 00002181 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-16 13:07 - 2011-05-03 10:22 - 00030126 _____ C:\Windows\PFRO.log
2013-11-14 20:52 - 2013-08-15 21:36 - 00000000 ____D C:\Windows\System32\MRT
2013-11-14 20:52 - 2010-08-20 17:35 - 82896128 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files\WEB.DE MailCheck
2013-11-09 10:37 - 2013-11-09 10:37 - 00000000 ____D C:\Program Files (x86)\WEB.DE MailCheck
2013-11-08 17:37 - 2013-11-08 17:37 - 00000000 ____D C:\ProgramData\UUdb
2013-11-08 17:37 - 2012-10-14 15:27 - 00002008 _____ C:\Users\Hirth\Desktop\Amazon.lnk
2013-11-08 17:37 - 2012-10-14 15:27 - 00002006 _____ C:\Users\Hirth\Desktop\WEB.DE.lnk
2013-11-08 17:37 - 2012-10-14 15:27 - 00002000 _____ C:\Users\Hirth\Desktop\eBay.lnk
2013-11-08 17:37 - 2012-10-14 15:27 - 00000000 ____D C:\ProgramData\DesktopIcons
2013-11-08 17:37 - 2012-05-26 12:40 - 00003872 _____ C:\Windows\System32\Tasks\Registration 1und1 Task
2013-11-08 17:37 - 2012-05-26 12:40 - 00000000 ____D C:\Program Files (x86)\1und1Softwareaktualisierung
2013-11-05 14:18 - 2013-11-05 14:16 - 00000000 _____ C:\ctapi_out_gr.txt
2013-10-29 20:02 - 2009-07-14 18:58 - 00657660 _____ C:\Windows\System32\perfh007.dat
2013-10-29 20:02 - 2009-07-14 18:58 - 00131032 _____ C:\Windows\System32\perfc007.dat
2013-10-29 20:02 - 2009-07-14 06:13 - 01507342 _____ C:\Windows\System32\PerfStringBackup.INI
 
Files to move or delete:
====================
C:\ProgramData\f2vvfrrj.bxx
C:\ProgramData\f2vvfrrj.fvv
C:\ProgramData\f2vvfrrj.pss
C:\ProgramData\fodh3ow.bxx
C:\ProgramData\fodh3ow.fvv
C:\ProgramData\fodh3ow.pss
C:\ProgramData\fodh3ow.reg
C:\ProgramData\jrrfvv2f.dss
 
 
Some content of TEMP:
====================
C:\Users\Hirth\AppData\Local\Temp\0946.dll
C:\Users\Hirth\AppData\Local\Temp\setup.exe
C:\Users\Hirth\AppData\Local\Temp\tmp10C2.exe
C:\Users\Hirth\AppData\Local\Temp\tmp1C20.exe
C:\Users\Hirth\AppData\Local\Temp\tmp26E0.exe
C:\Users\Hirth\AppData\Local\Temp\tmp6F78.exe
C:\Users\Hirth\AppData\Local\Temp\tmpB03D.exe
C:\Users\Hirth\AppData\Local\Temp\tmpE465.exe
C:\Users\Hirth\AppData\Local\Temp\tmpF640.exe
C:\Users\Hirth\AppData\Local\Temp\tmpF862.exe
C:\Users\Hirth\AppData\Local\Temp\tmpF99.exe
C:\Users\Hirth\AppData\Local\Temp\WEB.DE_Softwareaktualisierung_Setup.exe
C:\Users\Hirth\AppData\Local\Temp\WEB.DE_Toolbar_IE_Setup.exe
C:\Users\Hirth\AppData\Local\Temp\WEB.DE_Toolbar_IE_Setup_quiet.exe
 
 
==================== Known DLLs (Whitelisted) ================
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
==================== EXE ASSOCIATION =====================
 
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
 
==================== Restore Points =========================
 
12
Restore point made on: 2013-09-17 11:32:03
Restore point made on: 2013-09-20 13:01:28
Restore point made on: 2013-09-24 11:44:37
Restore point made on: 2013-10-01 12:00:58
Restore point made on: 2013-10-10 19:01:51
Restore point made on: 2013-10-11 18:10:51
Restore point made on: 2013-10-12 19:13:47
Restore point made on: 2013-10-20 15:45:25
Restore point made on: 2013-10-28 14:43:19
Restore point made on: 2013-11-05 15:22:28
Restore point made on: 2013-11-13 16:06:16
Restore point made on: 2013-11-14 20:51:24
 
==================== Memory info =========================== 
 
Percentage of memory in use: 15%
Total physical RAM: 3838.18 MB
Available physical RAM: 3224.19 MB
Total Pagefile: 3836.33 MB
Available Pagefile: 3215.63 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB
 
==================== Drives ================================
 
Drive c: (System) (Fixed) (Total:931.41 GB) (Free:867.83 GB) NTFS
Drive f: () (Removable) (Total:0.98 GB) (Free:0.85 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E7A3CBC2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
 
========================================================
Disk: 1 (Size: 1006 MB) (Disk ID: 6E652072)
No partition Table on disk 1.
 
 
LastRegBack: 2013-11-20 12:25
 
==================== End Of Log ============================