Flash Drive Shortcut Virus wtbchkxbde..vbs

fxak · 28.04.2014, 22:20

Fixlog.txt:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-04-2014
Ran by SYSTEM at 2014-04-28 22:48:01 Run:2
Running from F:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKLM\...\Run: [wtbchkxbde] => wscript.exe //B "C:\Users\Franz\AppData\Roaming\wtbchkxbde..vbs" <===== ATTENTION
HKU\Franz\...\Run: [wtbchkxbde] => wscript.exe //B "C:\Users\Franz\AppData\Roaming\wtbchkxbde..vbs" <===== ATTENTION
Startup: C:\Users\Franz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtbchkxbde..vbs ()
2014-04-18 13:16 - 2013-09-22 07:47 - 00073266 _____ () C:\Users\Franz\AppData\Roaming\wtbchkxbde..vbs
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\wtbchkxbde => Value deleted successfully.
HKU\Franz\Software\Microsoft\Windows\CurrentVersion\Run\\wtbchkxbde => Value deleted successfully.
C:\Users\Franz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtbchkxbde..vbs => Moved successfully.
C:\Users\Franz\AppData\Roaming\wtbchkxbde..vbs => Moved successfully.

==== End of Fixlog ====

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-04-2014
Ran by SYSTEM on MININT-FS42655 on 28-04-2014 22:48:15
Running from F:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.




==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-22] (Alcor Micro Corp.)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9996320 2010-01-19] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [877600 2010-01-19] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [585376 2010-05-25] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [354464 2010-05-25] (Atheros Commnucations)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [345648 2010-03-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [496160 2010-02-02] (Acer Incorporated)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [260608 2010-03-08] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-04-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [960080 2010-05-25] (Dritek System Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-20] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default
HKU\Franz\...\Run: [NetLimiter] => C:\Program Files\NetLimiter 3\NLClientApp.exe [2910208 2011-03-21] (Locktime Software)

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
S2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [820768 2010-02-02] (Acer Incorporated)
S2 nlsvc; C:\Program Files\NetLimiter 3\nlsvc.exe [1845248 2011-03-21] (Locktime Software)
S2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-29] (Acer Incorporated)

==================== Drivers (Whitelisted) ====================

S5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-22] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-22] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-15] (Avira Operations GmbH & Co. KG)
S1 nltdi; C:\Program Files\NetLimiter 3\nltdi.sys [88200 2011-03-21] (Locktime Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-28 12:43 - 2014-04-28 12:43 - 00000439 _____ () C:\Users\Franz\Desktop\Fixlist.txt
2014-04-27 17:14 - 2014-04-27 17:14 - 00039936 _____ () C:\Users\Franz\Desktop\Kalender.xls
2014-04-24 20:43 - 2014-04-24 20:43 - 01048576 _____ (Farbar) C:\Users\Franz\Desktop\FRST.exe
2014-04-24 20:31 - 2014-04-27 13:10 - 02061824 _____ (Farbar) C:\Users\Franz\Desktop\FRST64.exe
2014-04-23 08:44 - 2014-04-23 08:44 - 00000341 _____ () C:\Users\Franz\Desktop\CFScript.txt
2014-04-23 08:39 - 2014-04-23 08:39 - 00018305 _____ () C:\ComboFix.txt
2014-04-22 14:27 - 2014-04-22 14:32 - 00000000 ____D () C:\Users\Franz\Desktop\Air Niugini
2014-04-22 07:26 - 2014-04-22 07:27 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Franz\Desktop\tdsskiller.exe
2014-04-21 18:48 - 2014-04-21 19:35 - 00000000 ____D () C:\Users\Franz\Desktop\Projekt
2014-04-21 17:28 - 2014-04-21 17:28 - 05196870 ____R (Swearware) C:\Users\Franz\Desktop\ComboFix.exe
2014-04-21 16:40 - 2014-04-27 21:58 - 00000000 ____D () C:\Program Files (x86)\Smadav
2014-04-21 16:40 - 2014-04-21 16:40 - 00003240 _____ () C:\Windows\System32\Tasks\smadav
2014-04-21 16:40 - 2014-04-21 16:40 - 00000718 _____ () C:\Users\Public\Desktop\SMADΔV.lnk
2014-04-21 16:40 - 2014-04-21 16:40 - 00000000 ____D () C:\Users\Franz\AppData\Roaming\Smadav
2014-04-19 19:20 - 2014-04-19 19:21 - 00025978 _____ () C:\Users\Franz\Desktop\FRST.txt
2014-04-18 13:13 - 2014-04-18 13:13 - 00000000 ____D () C:\Users\Franz\Desktop\FRST-OlderVersion
2014-04-16 13:57 - 2014-04-16 13:59 - 00000041 _____ () C:\Users\Franz\Desktop\pw.txt
2014-04-16 13:46 - 2014-04-16 13:46 - 00000000 ____D () C:\Windows\ERUNT
2014-04-16 13:07 - 2014-04-16 13:10 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-04-16 13:06 - 2014-04-16 13:06 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-16 13:06 - 2014-04-16 13:06 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-16 13:06 - 2014-04-16 13:06 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-16 13:06 - 2014-04-02 23:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2014-04-16 13:06 - 2014-04-02 23:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys
2014-04-16 13:06 - 2014-04-02 23:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2014-04-15 16:56 - 2014-04-23 08:40 - 00000000 ____D () C:\Qoobox
2014-04-15 16:56 - 2014-04-15 17:35 - 00000000 ____D () C:\Windows\erdnt
2014-04-15 16:56 - 2011-06-25 22:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-15 16:56 - 2010-11-07 09:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-15 16:56 - 2009-04-19 20:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-15 16:56 - 2000-08-30 16:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-15 16:56 - 2000-08-30 16:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-15 16:56 - 2000-08-30 16:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-15 16:56 - 2000-08-30 16:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-15 16:56 - 2000-08-30 16:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-15 16:52 - 2014-04-15 16:52 - 00000000 ____D () C:\ProgramData\Panda Security
2014-04-15 16:52 - 2014-04-15 16:52 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-04-15 16:50 - 2014-04-15 16:50 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-04-14 01:21 - 2008-03-21 18:21 - 733980672 ___SH () C:\Users\Franz\Desktop\The Seeker-The Dark is Rising[2007]DvDrip[Eng]-FXG.avi
2014-04-14 01:19 - 2010-01-05 06:04 - 956607690 ___SH () C:\Users\Franz\Desktop\The Marine 2 (2010) DVDR DivXNL-Team.avi
2014-04-14 00:43 - 2014-04-28 22:48 - 00000000 ____D () C:\FRST
2014-04-10 19:39 - 2014-03-04 04:07 - 142602520 _____ (Microsoft Corporation) C:\Users\Franz\Desktop\wlsetup-all_16.4.3508.0205.exe
2014-04-06 23:32 - 2014-04-27 13:07 - 00000000 ____D () C:\[Smad-Cage]
2014-04-06 23:30 - 2014-04-06 23:30 - 00000000 ____D () C:\ProgramData\Kaspersky Lab Setup Files
2014-04-03 00:10 - 2014-04-21 16:27 - 00000000 ____D () C:\Users\Franz\Desktop\FPCD
2014-04-01 22:42 - 2014-04-16 12:12 - 00000000 ____D () C:\Users\Franz\Desktop\Antivir
2014-04-01 22:27 - 2014-04-01 22:27 - 00000000 ____D () C:\Windows\pss
2014-04-01 22:19 - 2014-04-01 22:54 - 00000000 ____D () C:\Users\Franz\AppData\Local\NPE
2014-04-01 22:19 - 2014-04-01 22:19 - 00000000 ____D () C:\ProgramData\Norton
2014-04-01 20:29 - 2013-02-01 00:07 - 557660892 _____ () C:\Users\Franz\Desktop\Bavaria Traumreise durch Bayern.mkv
2014-04-01 20:15 - 2013-03-02 20:17 - 3702646581 _____ () C:\Users\Franz\Desktop\Das grüne Wunder - Unser Wald.mkv

==================== One Month Modified Files and Folders =======

2014-04-28 22:48 - 2014-04-14 00:43 - 00000000 ____D () C:\FRST
2014-04-28 12:45 - 2013-04-16 09:13 - 02062847 _____ () C:\Windows\WindowsUpdate.log
2014-04-28 12:43 - 2014-04-28 12:43 - 00000439 _____ () C:\Users\Franz\Desktop\Fixlist.txt
2014-04-28 12:40 - 2013-04-16 10:09 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-28 12:39 - 2013-04-16 10:29 - 00000043 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-04-28 03:21 - 2013-10-03 12:57 - 00000000 ____D () C:\Users\Franz\AppData\Roaming\uTorrent
2014-04-28 03:16 - 2009-07-13 20:51 - 00089688 _____ () C:\Windows\setupact.log
2014-04-28 02:53 - 2013-04-16 10:09 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-27 22:06 - 2009-07-13 20:45 - 00022672 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-27 22:06 - 2009-07-13 20:45 - 00022672 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-27 21:58 - 2014-04-21 16:40 - 00000000 ____D () C:\Program Files (x86)\Smadav
2014-04-27 21:56 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-27 17:14 - 2014-04-27 17:14 - 00039936 _____ () C:\Users\Franz\Desktop\Kalender.xls
2014-04-27 13:10 - 2014-04-24 20:31 - 02061824 _____ (Farbar) C:\Users\Franz\Desktop\FRST64.exe
2014-04-27 13:07 - 2014-04-06 23:32 - 00000000 ____D () C:\[Smad-Cage]
2014-04-24 20:43 - 2014-04-24 20:43 - 01048576 _____ (Farbar) C:\Users\Franz\Desktop\FRST.exe
2014-04-24 20:39 - 2010-05-10 15:15 - 00116164 _____ () C:\Windows\PFRO.log
2014-04-23 08:44 - 2014-04-23 08:44 - 00000341 _____ () C:\Users\Franz\Desktop\CFScript.txt
2014-04-23 08:40 - 2014-04-15 16:56 - 00000000 ____D () C:\Qoobox
2014-04-23 08:39 - 2014-04-23 08:39 - 00018305 _____ () C:\ComboFix.txt
2014-04-23 08:16 - 2009-07-13 18:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-23 08:00 - 2013-04-16 10:10 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-22 14:32 - 2014-04-22 14:27 - 00000000 ____D () C:\Users\Franz\Desktop\Air Niugini
2014-04-22 07:27 - 2014-04-22 07:26 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Franz\Desktop\tdsskiller.exe
2014-04-21 19:35 - 2014-04-21 18:48 - 00000000 ____D () C:\Users\Franz\Desktop\Projekt
2014-04-21 17:28 - 2014-04-21 17:28 - 05196870 ____R (Swearware) C:\Users\Franz\Desktop\ComboFix.exe
2014-04-21 16:40 - 2014-04-21 16:40 - 00003240 _____ () C:\Windows\System32\Tasks\smadav
2014-04-21 16:40 - 2014-04-21 16:40 - 00000718 _____ () C:\Users\Public\Desktop\SMADΔV.lnk
2014-04-21 16:40 - 2014-04-21 16:40 - 00000000 ____D () C:\Users\Franz\AppData\Roaming\Smadav
2014-04-21 16:27 - 2014-04-03 00:10 - 00000000 ____D () C:\Users\Franz\Desktop\FPCD
2014-04-19 19:21 - 2014-04-19 19:20 - 00025978 _____ () C:\Users\Franz\Desktop\FRST.txt
2014-04-19 18:46 - 2013-04-16 19:01 - 00696870 _____ () C:\Windows\System32\perfh007.dat
2014-04-19 18:46 - 2013-04-16 19:01 - 00148134 _____ () C:\Windows\System32\perfc007.dat
2014-04-19 18:46 - 2009-07-13 21:13 - 01612484 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-04-18 17:21 - 2013-04-16 10:22 - 00000000 ____D () C:\Users\Franz\AppData\Roaming\vlc
2014-04-18 13:13 - 2014-04-18 13:13 - 00000000 ____D () C:\Users\Franz\Desktop\FRST-OlderVersion
2014-04-16 14:00 - 2014-03-11 07:56 - 00000000 ____D () C:\AdwCleaner
2014-04-16 13:59 - 2014-04-16 13:57 - 00000041 _____ () C:\Users\Franz\Desktop\pw.txt
2014-04-16 13:46 - 2014-04-16 13:46 - 00000000 ____D () C:\Windows\ERUNT
2014-04-16 13:10 - 2014-04-16 13:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-04-16 13:06 - 2014-04-16 13:06 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-16 13:06 - 2014-04-16 13:06 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-16 13:06 - 2014-04-16 13:06 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-16 12:12 - 2014-04-01 22:42 - 00000000 ____D () C:\Users\Franz\Desktop\Antivir
2014-04-15 17:43 - 2009-07-13 19:20 - 00000000 __RHD () C:\users\Default
2014-04-15 17:35 - 2014-04-15 16:56 - 00000000 ____D () C:\Windows\erdnt
2014-04-15 16:52 - 2014-04-15 16:52 - 00000000 ____D () C:\ProgramData\Panda Security
2014-04-15 16:52 - 2014-04-15 16:52 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-04-15 16:50 - 2014-04-15 16:50 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-04-14 00:20 - 2013-04-16 11:29 - 00000000 ____D () C:\Setups
2014-04-06 23:30 - 2014-04-06 23:30 - 00000000 ____D () C:\ProgramData\Kaspersky Lab Setup Files
2014-04-05 22:23 - 2013-04-16 10:09 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-05 22:23 - 2013-04-16 10:09 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-02 23:51 - 2014-04-16 13:06 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2014-04-02 23:51 - 2014-04-16 13:06 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys
2014-04-02 23:50 - 2014-04-16 13:06 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2014-04-01 22:54 - 2014-04-01 22:19 - 00000000 ____D () C:\Users\Franz\AppData\Local\NPE
2014-04-01 22:27 - 2014-04-01 22:27 - 00000000 ____D () C:\Windows\pss
2014-04-01 22:25 - 2013-04-16 10:39 - 00000000 ___RD () C:\Users\Franz\Desktop\Dropbox
2014-04-01 22:24 - 2013-04-16 10:35 - 00000000 ____D () C:\Users\Franz\AppData\Roaming\Dropbox
2014-04-01 22:19 - 2014-04-01 22:19 - 00000000 ____D () C:\ProgramData\Norton
2014-03-30 18:12 - 2014-02-28 03:54 - 00000000 ____D () C:\Users\Franz\Desktop\Fotos

Some content of TEMP:
====================
C:\Users\Franz\AppData\Local\Temp\avgnt.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2014-03-04 04:16:53
Restore point made on: 2014-03-13 18:01:05
Restore point made on: 2014-03-23 14:56:49
Restore point made on: 2014-04-01 23:56:23
Restore point made on: 2014-04-02 04:47:26
Restore point made on: 2014-04-15 16:57:13
Restore point made on: 2014-04-20 15:04:46
Restore point made on: 2014-04-21 17:31:02

==================== Memory info =========================== 

Percentage of memory in use: 19%
Total physical RAM: 3764.43 MB
Available physical RAM: 3047.62 MB
Total Pagefile: 3762.57 MB
Available Pagefile: 3034.05 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:452.97 GB) (Free:29.47 GB) NTFS
Drive e: (PQSERVICE) (Fixed) (Total:12.7 GB) (Free:2.56 GB) NTFS
Drive f: () (Removable) (Total:14.63 GB) (Free:14.62 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 59D459D4)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=453 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)


LastRegBack: 2014-03-23 14:49

==================== End Of Log ============================

--- --- ---

So wies ausschaut ist der Virus weg, auf dem Stick kommt nach dem Formatieren keine neue .vbs, vielen dank schonmal!!

Jetzt hab ich noch eine Frage: kann ich diese Fixlist auch auf anderen Computern anwenden, wenn ich die Pfadnamen anpasse? Hier bei mir im Dorf ist dieser Virus auf so gut wie jedem Computer, aber mit den meisten komme ich nicht ans Internet und ich halte es auch für wenig sinnvoll für jeden hier ein neues Thema aufzumachen

kann übrigens nur noch über einen Proxy aufs Trojaner-Board, alle anderen Seiten gehen nach wie vor problemlos, gibts da einen Trick?

Flash Drive Shortcut Virus wtbchkxbde..vbs

Plagegeister aller Art und deren Bekämpfung: Flash Drive Shortcut Virus wtbchkxbde..vbs

Flash Drive Shortcut Virus wtbchkxbde..vbs

Ähnliche Themen: Flash Drive Shortcut Virus wtbchkxbde..vbs