GVU Trojaner, Windows Vista geht auch nicht im abgesicherten Modus

a.schottner

Hallo
Leider hat sich mein Freund ein GVU Virus eingefangen.
Nun hatte er mich gebeten das ich mich darum kümmere.

Wie bekomme ich den Virus weg ?

Folgendes habe ich bereits gemacht.
Ich habe mir Scan mit Farbar's Recovery Scan Tool runter geladen und
nach der Anleitung einen Scan durchgeführt.

Der Scan hat folgendes ergeben:
----------------------------------------------------------------------
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-01-2014
Ran by SYSTEM on MINWINPC on 05-01-2014 11:51:07
Running from F:\
Windows Vista (TM) Home Premium (X86) OS Language: English(US)
Internet Explorer Version 7
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1006264 2008-03-24] (Microsoft Corporation)
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4444160 2007-04-24] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Windows\SkyTel.exe [1822720 2007-04-12] (Realtek Semiconductor Corp.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [857648 2007-03-01] (Synaptics, Inc.)
HKLM\...\Run: [ASUS Camera ScreenSaver] - C:\Windows\ASScrProlog.exe [37232 2008-03-24] ()
HKLM\...\Run: [ASUS Screen Saver Protector] - C:\Windows\ASScrPro.exe [33136 2008-03-24] ()
HKLM\...\Run: [NeroFilterCheck] - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG)
HKLM\...\Run: [Symantec PIF AlertEng] - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [583048 2008-01-29] (Symantec Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [THGuard] - C:\Program Files\TrojanHunter 5.5\THGuard.exe [1086880 2012-10-22] (Mischel Internet Security)
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2006-11-02] (Microsoft Corporation)
HKU\Dortmund\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2006-11-02] (Microsoft Corporation)
HKU\Dortmund\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2007-06-20] (Hewlett-Packard Company)
HKU\Klaus\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [ 2007-06-20] (Hewlett-Packard Company)
HKU\Klaus\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2006-11-02] (Microsoft Corporation)
HKU\Klaus\...\Run: [SearchEngineProtection] - C:\Program Files\GamesBar\update\SearchEngineProtection.exe [ 2013-05-26] (Oberon Media )
HKU\Klaus\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\wmpnscfg.exe [ 2006-11-02] (Microsoft Corporation)
Startup: C:\Users\Klaus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1j67a8z9.lnk
ShortcutTarget: 1j67a8z9.lnk -> C:\ProgramData\9z8a76j1.jss (hxxp://tortoisesvn.net)
Startup: C:\Users\Klaus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lcdod1li.lnk
ShortcutTarget: lcdod1li.lnk -> C:\ProgramData\il1dodcl.jss (hxxp://tortoisesvn.net)

========================== Services (Whitelisted) =================

S2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [73728 2007-05-18] ()
S2 ASLDRService; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [94208 2007-02-05] ()
S2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-05-15] ()
S2 LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll [537992 2008-04-10] (Symantec Corporation)
S2 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [123248 2006-12-28] ()
S2 Winmgmt; C:\ProgramData\9z8a76j1.jss [262144 2013-12-21] (hxxp://tortoisesvn.net)
S2 LiveUpdate Notice Ex; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]

==================== Drivers (Whitelisted) ====================

S0 AsDsm; C:\Windows\System32\Drivers\AsDsm.sys [27504 2007-04-24] (Windows (R) Codename Longhorn DDK provider)
S2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [11632 2007-02-05] ()
S2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [15216 2006-11-15] ()
S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [5632 2007-01-24] ( )
S3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-13] (ATK0100)
S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1737984 2007-03-06] ()
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-05 11:50 - 2014-01-05 11:50 - 00000000 ____D C:\FRST
2013-12-21 07:31 - 2013-12-21 07:31 - 00000000 ____D C:\Users\Klaus\AppData\Roaming\TrojanHunter
2013-12-21 07:24 - 2013-12-21 07:25 - 00000000 ____D C:\Program Files\TrojanHunter 5.5
2013-12-21 07:24 - 2013-12-21 07:24 - 00059392 ____R C:\Windows\System32\streamhlp.dll
2013-12-21 07:24 - 2013-12-21 07:24 - 00000889 _____ C:\Users\Klaus\Desktop\TrojanHunter.lnk
2013-12-21 07:24 - 2013-12-21 07:24 - 00000000 ____D C:\ProgramData\TrojanHunter
2013-12-21 07:10 - 2013-12-21 07:22 - 00000000 ____D C:\Users\Klaus\AppData\Local\NPE
2013-12-21 07:10 - 2013-12-21 07:10 - 00000000 ____D C:\ProgramData\Norton
2013-12-21 04:45 - 2013-12-21 07:33 - 00000285 _____ C:\ProgramData\1j67a8z9.reg
2013-12-21 04:44 - 2013-12-21 08:03 - 00000000 _____ C:\ProgramData\lcdod1li.odd
2013-12-21 04:44 - 2013-12-21 08:02 - 00000000 _____ C:\ProgramData\1j67a8z9.odd
2013-12-21 04:43 - 2013-12-21 08:04 - 95025368 ____T C:\ProgramData\lcdod1li.fee
2013-12-21 04:43 - 2013-12-21 08:04 - 95025368 ____T C:\ProgramData\1j67a8z9.fee
2013-12-21 04:43 - 2013-12-21 04:43 - 00262144 _____ (hxxp://tortoisesvn.net) C:\ProgramData\il1dodcl.jss
2013-12-21 04:43 - 2013-12-21 04:43 - 00262144 _____ (hxxp://tortoisesvn.net) C:\ProgramData\9z8a76j1.jss

==================== One Month Modified Files and Folders =======

2014-01-05 11:50 - 2014-01-05 11:50 - 00000000 ____D C:\FRST
2014-01-05 02:31 - 2008-03-24 14:07 - 01352242 _____ C:\Windows\WindowsUpdate.log
2014-01-05 02:31 - 2007-04-18 00:33 - 00000012 _____ C:\Windows\bthservsdp.dat
2014-01-05 02:29 - 2006-11-02 04:47 - 00003072 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-05 02:29 - 2006-11-02 04:47 - 00003072 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-21 08:04 - 2013-12-21 04:43 - 95025368 ____T C:\ProgramData\lcdod1li.fee
2013-12-21 08:04 - 2013-12-21 04:43 - 95025368 ____T C:\ProgramData\1j67a8z9.fee
2013-12-21 08:03 - 2013-12-21 04:44 - 00000000 _____ C:\ProgramData\lcdod1li.odd
2013-12-21 08:02 - 2013-12-21 04:44 - 00000000 _____ C:\ProgramData\1j67a8z9.odd
2013-12-21 07:33 - 2013-12-21 04:45 - 00000285 _____ C:\ProgramData\1j67a8z9.reg
2013-12-21 07:31 - 2013-12-21 07:31 - 00000000 ____D C:\Users\Klaus\AppData\Roaming\TrojanHunter
2013-12-21 07:25 - 2013-12-21 07:24 - 00000000 ____D C:\Program Files\TrojanHunter 5.5
2013-12-21 07:24 - 2013-12-21 07:24 - 00059392 ____R C:\Windows\System32\streamhlp.dll
2013-12-21 07:24 - 2013-12-21 07:24 - 00000889 _____ C:\Users\Klaus\Desktop\TrojanHunter.lnk
2013-12-21 07:24 - 2013-12-21 07:24 - 00000000 ____D C:\ProgramData\TrojanHunter
2013-12-21 07:22 - 2013-12-21 07:10 - 00000000 ____D C:\Users\Klaus\AppData\Local\NPE
2013-12-21 07:13 - 2006-11-02 04:47 - 00377048 _____ C:\Windows\System32\FNTCACHE.DAT
2013-12-21 07:10 - 2013-12-21 07:10 - 00000000 ____D C:\ProgramData\Norton
2013-12-21 06:55 - 2008-07-15 08:23 - 00005676 _____ C:\Users\Klaus\AppData\Local\d3d9caps.dat
2013-12-21 04:43 - 2013-12-21 04:43 - 00262144 _____ (hxxp://tortoisesvn.net) C:\ProgramData\il1dodcl.jss
2013-12-21 04:43 - 2013-12-21 04:43 - 00262144 _____ (hxxp://tortoisesvn.net) C:\ProgramData\9z8a76j1.jss
2013-12-14 11:26 - 2008-03-24 14:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-14 11:19 - 2013-08-23 07:38 - 00000000 ____D C:\Windows\System32\MRT
2013-12-14 11:19 - 2006-11-02 02:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-12-09 12:38 - 2013-05-30 05:21 - 00001970 _____ C:\Users\Public\Desktop\Google Chrome.lnk

Files to move or delete:
====================
C:\ProgramData\1j67a8z9.fee
C:\ProgramData\1j67a8z9.odd
C:\ProgramData\1j67a8z9.reg
C:\ProgramData\9z8a76j1.jss
C:\ProgramData\il1dodcl.jss
C:\ProgramData\lcdod1li.fee
C:\ProgramData\lcdod1li.odd


Some content of TEMP:
====================
C:\Users\Dortmund\AppData\Local\Temp\AskSLib.dll
C:\Users\Klaus\AppData\Local\Temp\81532-667350-mp3-rocket.exe
C:\Users\Klaus\AppData\Local\Temp\contentDATs.exe
C:\Users\Klaus\AppData\Local\Temp\dealply.exe
C:\Users\Klaus\AppData\Local\Temp\dotNetFx40_Full_x86_x64.exe
C:\Users\Klaus\AppData\Local\Temp\iMesh_setup.exe
C:\Users\Klaus\AppData\Local\Temp\Installhelper.dll
C:\Users\Klaus\AppData\Local\Temp\instloffer.exe
C:\Users\Klaus\AppData\Local\Temp\lDiT.dll
C:\Users\Klaus\AppData\Local\Temp\sdsm.dll
C:\Users\Klaus\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Klaus\AppData\Local\Temp\seeme_installer_5.4_02.exe
C:\Users\Klaus\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Klaus\AppData\Local\Temp\speedupmypc.exe
C:\Users\Klaus\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Klaus\AppData\Local\Temp\SymLCSVC.EXE
C:\Users\Klaus\AppData\Local\Temp\tbbabylonv3.exe
C:\Users\Klaus\AppData\Local\Temp\_is1E69.exe
C:\Users\Klaus\AppData\Local\Temp\_isE5A4.exe
C:\Users\Klaus\AppData\Local\Temp\{0EB29066-6ABB-4897-AA48-271501C76970}-30.0.1599.69_29.0.1547.76_chrome_updater.exe


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-11-10 03:31:46
Restore point made on: 2013-11-10 06:06:01
Restore point made on: 2013-11-14 12:55:06
Restore point made on: 2013-11-15 02:18:18
Restore point made on: 2013-11-16 01:43:30
Restore point made on: 2013-11-16 01:52:16
Restore point made on: 2013-11-16 05:05:03
Restore point made on: 2013-11-17 08:47:54
Restore point made on: 2013-11-17 09:01:15
Restore point made on: 2013-11-17 21:47:24
Restore point made on: 2013-11-17 21:59:04
Restore point made on: 2013-11-25 06:58:47
Restore point made on: 2013-11-25 07:10:13
Restore point made on: 2013-11-25 09:37:44
Restore point made on: 2013-11-27 09:12:18
Restore point made on: 2013-11-27 09:22:05
Restore point made on: 2013-11-30 02:30:10
Restore point made on: 2013-11-30 02:38:12
Restore point made on: 2013-11-30 02:41:34
Restore point made on: 2013-12-01 09:40:58
Restore point made on: 2013-12-01 10:38:45
Restore point made on: 2013-12-05 07:36:20
Restore point made on: 2013-12-07 01:32:54
Restore point made on: 2013-12-09 12:41:00
Restore point made on: 2013-12-09 12:50:01
Restore point made on: 2013-12-13 07:51:08
Restore point made on: 2013-12-13 08:02:29
Restore point made on: 2013-12-14 11:17:35
Restore point made on: 2013-12-15 10:56:47
Restore point made on: 2013-12-21 04:34:36
Restore point made on: 2013-12-21 04:42:27

==================== Memory info ===========================

Percentage of memory in use: 20%
Total physical RAM: 2038.66 MB
Available physical RAM: 1613.48 MB
Total Pagefile: 1817.55 MB
Available Pagefile: 1670.34 MB
Total Virtual: 2047.88 MB
Available Virtual: 1975.23 MB

==================== Drives ================================

Drive c: (VistaOS) (Fixed) (Total:116.44 GB) (Free:68.27 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:108.63 GB) (Free:108.51 GB) NTFS
Drive f: () (Removable) (Total:3.84 GB) (Free:3.84 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 233 GB) (Disk ID: BBC58B91)
Partition 1: (Not Active) - (Size=8 GB) - (Type=1C)
Partition 2: (Active) - (Size=116 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=109 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: EA456D43)
Partition 1: (Not Active) - (Size=4 GB) - (Type=0B)


LastRegBack: 2013-12-21 07:27

==================== End Of Log ============================


Bis hier hin bin ich nun gekommen, nun weiss ich leider nicht mehr weiter.
Es würde mich echt freuen wenn mir jemand helfen würde.