BKA-Trojaner

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 30-11-2013
Ran by SYSTEM on MININT-05LMLAM on 30-11-2013 15:18:13
Running from G:\
Windows 7 Starter Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10025576 2011-02-10] (Realtek Semiconductor)
HKLM\...\Run: [SuiteTray] - C:\Program Files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [340848 2011-04-02] (Egis Technology Inc.)
HKLM\...\Run: [EgisTecPMMUpdate] - C:\Program Files\EgisTec IPS\PmmUpdate.exe [408432 2011-03-28] (Egis Technology Inc.)
HKLM\...\Run: [EgisUpdate] - C:\Program Files\EgisTec IPS\EgisUpdate.exe [202608 2011-03-28] (Egis Technology Inc.)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1103440 2011-06-30] (Dritek System Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1934632 2010-10-08] (Synaptics Incorporated)
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [715368 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [iSyncData] - C:\Program Files\Acer\Android Manager\iSync.exe [408128 2011-05-09] (Insyde Software Corp.)
HKLM\...\Run: [AndroidManager] - C:\Program Files\Acer\Android Manager\AML.exe [508992 2011-05-09] ()
HKLM\...\Run: [iPatchData] - C:\Program Files\Acer\Updater\iUpdate.exe [492096 2011-05-09] (Insyde Software Corp.)
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [283136 2007-02-02] (AVM Berlin)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-07] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe [ 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe [ 2010-07-29] ()
HKU\Katrin Brandes\...\Run: [Facebook Update] - C:\Users\Katrin Brandes\AppData\Local\Facebook\Update\FacebookUpdate.exe [ 2012-07-15] (Facebook Inc.)
HKU\Katrin Brandes\...\Run: [IExplorer Util] - C:\Users\Katrin Brandes\AppData\Roaming\ie_util.exe
AppInit_DLLs: c:\progra~2\browse~1\23796~1.11\{16cdf~1\browse~1.dll [ ] ()
Startup: C:\Users\Katrin Brandes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b89o9e.lnk
ShortcutTarget: b89o9e.lnk -> C:\ProgramData\e9o98b.dss (Корпорация Майкрософт)

========================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 EgisTec Ticket Service; C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe [173424 2011-04-02] (Egis Technology Inc. )
S2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [739944 2011-05-10] (Acer Incorporated)
S2 GREGService; C:\Program Files\Acer\Registration\GREGsvc.exe [29696 2011-05-25] (Acer Incorporated)
S2 IconMan_R; C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1755136 2011-03-07] (Realsil Microelectronics Inc.)
S2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [260640 2010-01-29] (Acer Incorporated)
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [770432 2013-10-18] (Enigma Software Group USA, LLC.)
S2 Winmgmt; C:\ProgramData\e9o98b.dss [189952 2013-11-26] (Корпорация Майкрософт)
S2 GFilterSvc; C:\Windows\System32\GFilterSvc.exe [x]
S2 mounuvol; C:\Windows\system32\RtsPTtorIcon.exe [x]

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-07] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-07] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-25] (AVM Berlin)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2012-06-22] ()
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-25] (AVM GmbH)
S1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [21600 2011-07-26] (Egis Technology Inc.)
S1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16936 2011-07-26] (Egis Technology Inc.)
S1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [62240 2011-07-26] (Egis Technology Inc.)
S3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [7435264 2011-01-03] (Intel Corporation)
S3 RSPCIESTOR; C:\Windows\System32\DRIVERS\RtsPStor.sys [252520 2011-03-06] (Realtek Semiconductor Corp.)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-30 15:18 - 2013-11-30 15:18 - 00000000 ____D C:\FRST
2013-11-30 05:49 - 2013-11-30 05:49 - 00000000 ____H C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-11-30 05:42 - 2013-11-30 05:42 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-30 05:35 - 2013-11-30 05:35 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-30 05:15 - 2013-11-30 05:15 - 00000000 ____D C:\b3b12c690c765685a3a2fee9
2013-11-26 14:49 - 2013-11-26 14:49 - 00002268 _____ C:\Users\Katrin Brandes\Desktop\SpyHunter.lnk
2013-11-26 14:49 - 2013-11-26 14:49 - 00000000 ____D C:\sh4ldr
2013-11-26 14:49 - 2013-11-26 14:49 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-11-26 14:48 - 2013-11-26 14:48 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-11-26 14:28 - 2013-11-30 05:11 - 00000273 _____ C:\ProgramData\b89o9e.reg
2013-11-26 14:27 - 2013-11-30 06:00 - 95025368 ____T C:\ProgramData\b89o9e.bxx
2013-11-26 14:27 - 2013-11-30 06:00 - 00000000 _____ C:\ProgramData\b89o9e.fvv
2013-11-26 14:27 - 2013-11-26 14:27 - 00189952 _____ (Корпорация Майкрософт) C:\ProgramData\e9o98b.dss
2013-11-26 14:13 - 2013-11-26 14:13 - 00000000 ____D C:\Users\Katrin Brandes\restore
2013-11-26 14:10 - 2013-11-26 14:24 - 00000000 ____D C:\ProgramData\tmp
2013-11-26 14:10 - 2013-11-26 14:10 - 00001151 _____ C:\Users\Public\Desktop\Pixum Fotobuch.lnk
2013-11-26 14:10 - 2013-11-26 14:10 - 00000000 ____D C:\ProgramData\hps
2013-11-26 14:03 - 2013-11-26 14:03 - 00000000 ____D C:\Program Files\Pixum

==================== One Month Modified Files and Folders =======

2013-11-30 15:18 - 2013-11-30 15:18 - 00000000 ____D C:\FRST
2013-11-30 06:00 - 2013-11-26 14:27 - 95025368 ____T C:\ProgramData\b89o9e.bxx
2013-11-30 06:00 - 2013-11-26 14:27 - 00000000 _____ C:\ProgramData\b89o9e.fvv
2013-11-30 05:59 - 2009-07-13 20:39 - 00099222 _____ C:\Windows\setupact.log
2013-11-30 05:50 - 2011-10-29 20:53 - 01388725 _____ C:\Windows\WindowsUpdate.log
2013-11-30 05:50 - 2009-07-13 20:34 - 00016160 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-30 05:50 - 2009-07-13 20:34 - 00016160 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-30 05:49 - 2013-11-30 05:49 - 00000000 ____H C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-11-30 05:42 - 2013-11-30 05:42 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-30 05:35 - 2013-11-30 05:35 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-30 05:18 - 2011-12-29 07:29 - 00000000 ____D C:\users\Katrin Brandes
2013-11-30 05:16 - 2013-09-14 14:20 - 00000000 ____D C:\Windows\System32\MRT
2013-11-30 05:15 - 2013-11-30 05:15 - 00000000 ____D C:\b3b12c690c765685a3a2fee9
2013-11-30 05:15 - 2012-01-04 12:14 - 80340640 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-11-30 05:11 - 2013-11-26 14:28 - 00000273 _____ C:\ProgramData\b89o9e.reg
2013-11-26 14:49 - 2013-11-26 14:49 - 00002268 _____ C:\Users\Katrin Brandes\Desktop\SpyHunter.lnk
2013-11-26 14:49 - 2013-11-26 14:49 - 00000000 ____D C:\sh4ldr
2013-11-26 14:49 - 2013-11-26 14:49 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-11-26 14:48 - 2013-11-26 14:48 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-11-26 14:48 - 2010-11-20 13:01 - 01513970 _____ C:\Windows\System32\PerfStringBackup.INI
2013-11-26 14:27 - 2013-11-26 14:27 - 00189952 _____ (Корпорация Майкрософт) C:\ProgramData\e9o98b.dss
2013-11-26 14:24 - 2013-11-26 14:10 - 00000000 ____D C:\ProgramData\tmp
2013-11-26 14:13 - 2013-11-26 14:13 - 00000000 ____D C:\Users\Katrin Brandes\restore
2013-11-26 14:10 - 2013-11-26 14:10 - 00001151 _____ C:\Users\Public\Desktop\Pixum Fotobuch.lnk
2013-11-26 14:10 - 2013-11-26 14:10 - 00000000 ____D C:\ProgramData\hps
2013-11-26 14:03 - 2013-11-26 14:03 - 00000000 ____D C:\Program Files\Pixum
2013-11-10 20:50 - 2012-02-17 23:19 - 00230048 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

Files to move or delete:
====================
C:\ProgramData\b89o9e.bxx
C:\ProgramData\b89o9e.fvv
C:\ProgramData\b89o9e.reg
C:\ProgramData\e9o98b.dss


Some content of TEMP:
====================
C:\Users\Katrin Brandes\AppData\Local\Temp\amrtomp3converter_setup.exe
C:\Users\Katrin Brandes\AppData\Local\Temp\AskSLib.dll
C:\Users\Katrin Brandes\AppData\Local\Temp\avgnt.exe
C:\Users\Katrin Brandes\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\Katrin Brandes\AppData\Local\Temp\SHSetup.exe
C:\Users\Katrin Brandes\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Katrin Brandes\AppData\Local\Temp\uninst1.exe
C:\Users\Katrin Brandes\AppData\Local\Temp\~tmf6612087998965225447.dll


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

21
Restore point made on: 2013-06-30 05:11:46
Restore point made on: 2013-07-17 09:18:58
Restore point made on: 2013-07-17 09:27:16
Restore point made on: 2013-07-17 09:32:33
Restore point made on: 2013-07-17 09:32:35
Restore point made on: 2013-07-17 09:32:40
Restore point made on: 2013-07-19 13:03:01
Restore point made on: 2013-07-19 13:48:57
Restore point made on: 2013-07-22 02:58:10
Restore point made on: 2013-08-04 03:07:03
Restore point made on: 2013-08-08 10:41:57
Restore point made on: 2013-09-14 14:05:28
Restore point made on: 2013-09-14 14:19:08
Restore point made on: 2013-09-24 08:16:44
Restore point made on: 2013-10-07 05:17:03
Restore point made on: 2013-10-17 09:34:08
Restore point made on: 2013-10-17 10:21:52
Restore point made on: 2013-10-26 01:38:23
Restore point made on: 2013-11-26 13:55:43
Restore point made on: 2013-11-30 05:15:34
Restore point made on: 2013-11-30 05:50:05

==================== Memory info =========================== 

Percentage of memory in use: 49%
Total physical RAM: 1011.87 MB
Available physical RAM: 514.55 MB
Total Pagefile: 1011.87 MB
Available Pagefile: 518.25 MB
Total Virtual: 2047.88 MB
Available Virtual: 1941.96 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:280.89 GB) (Free:239.53 GB) NTFS
Drive e: () (Fixed) (Total:4.1 GB) (Free:2.59 GB) FAT32
Drive f: (PQSERVICE) (Fixed) (Total:13 GB) (Free:2.82 GB) NTFS
Drive g: (HITMANPRO) (Removable) (Total:29.45 GB) (Free:29.45 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: D3330E16)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Not Active) - (Size=4 GB) - (Type=0C)
Partition 3: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=281 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 29 GB) (Disk ID: 34C741B1)
Partition 1: (Active) - (Size=29 GB) - (Type=0C)


LastRegBack: 2013-07-17 09:10

==================== End Of Log ============================