Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GVU Virus auf Sony Vaio (https://www.trojaner-board.de/138388-gvu-virus-sony-vaio.html)

linusspoke 17.07.2013 21:19
GVU Virus auf Sony Vaio
 
Hallo,

versuche schon einige Zeit das Laptop eines Kumpel wieder lauffähig zu machen.
Bin dabei auf die Möglichkeit mit FRST_64 in diesem Forum gestoßen.

LogFile wurde schon erstellt, benötige jetzt zum Fixen noch die erforderliche FIXlog-Daten.

Wer kann helfen

Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-07-2013 02
Ran by SYSTEM on 17-07-2013 19:41:11
Running from E:\
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] - C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [764032 2012-08-13] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-08-13] (Atheros Communications)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-21] (Synaptics Incorporated)
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [271872 2012-07-26] (Microsoft Corporation)
HKLM-x32\...\Run: [mcui_exe] - "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1534504 2013-01-14] (McAfee, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] - "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" [68776 2012-08-18] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [724576 2012-07-27] (Sony Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "c:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] - "C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe" --domain-id F0399437-FD0C-4A48-B101-F0314A6172E4 [152896 2012-06-25] (Intel Corporation)
HKLM-x32\...\Run: [mcpltui_exe] - "C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe" /platui [299648 2012-07-24] (McAfee, Inc.)
HKU\Harald\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Harald\AppData\Local\Temp\guqirpivnnmeamxur.exe [48128 2013-07-13] (NVIDIA Corporation) <===== ATTENTION
HKU\Harald\...\Winlogon: [Shell] cmd.exe [404992 2012-07-26] (Microsoft Corporation) <==== ATTENTION
HKU\Harald\...\Command Processor: "C:\Users\Harald\AppData\Local\Temp\guqirpivnnmeamxur.exe" <===== ATTENTION!

==================== Services (Whitelisted) =================

S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-13] (Qualcomm Atheros Commnucations)
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [332080 2012-01-26] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [220856 2012-07-24] (McAfee, Inc.)
S2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [220856 2012-07-24] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McSchedulerSvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [220856 2012-07-24] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241016 2012-12-26] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218320 2012-12-26] (McAfee, Inc.)
S2 mfeicfcoreocp; C:\Program Files\McAfeeEx\MOCP\core\mfeicfcore.exe [2769552 2013-05-09] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [182312 2012-12-26] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [623784 2012-08-18] (Sony Corporation)
S2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474208 2012-07-27] (Sony Corporation)
S2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] ()
S3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1266336 2012-07-24] (Sony Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
S2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-08-13] (Atheros)
S2 0017831372189333mcinstcleanup; C:\Windows\TEMP\001783~1.EXE -cleanup -nolog [x]

==================== Drivers (Whitelisted) ====================

S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-13] (Qualcomm Atheros)
S3 BTATH_VDP; C:\Windows\system32\drivers\btath_vdp.sys [427416 2012-08-13] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [69672 2012-12-26] (McAfee, Inc.)
S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [178840 2012-12-26] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309400 2012-12-26] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69168 2012-12-26] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515528 2012-12-26] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771096 2012-12-26] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106112 2012-12-26] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [339776 2012-12-26] (McAfee, Inc.)
S3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-21] (Synaptics Incorporated)
S3 SOWS; C:\Windows\System32\drivers\sows.sys [24280 2012-06-11] (Sony Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-17 19:40 - 2013-07-17 19:40 - 00000000 ____D C:\FRST
2013-07-15 18:27 - 2013-07-15 18:27 - 00000000 __SHD C:\found.000
2013-07-15 15:51 - 2013-07-15 15:51 - 00000000 ____H C:\Windows\System32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2013-07-14 17:24 - 2013-07-17 16:29 - 00357336 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-13 09:04 - 2013-07-13 09:04 - 01084743 _____ C:\ProgramData\2433f433
2013-07-13 09:04 - 2013-07-13 09:04 - 01084701 _____ C:\Users\Harald\AppData\Roaming\2433f433
2013-07-13 09:04 - 2013-07-13 09:04 - 01084695 _____ C:\Users\Harald\AppData\Local\2433f433
2013-07-11 20:18 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 20:18 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 20:18 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 20:18 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 20:18 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 20:18 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 20:18 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 20:18 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 20:18 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-11 20:18 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-11 20:18 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-11 20:18 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-11 20:18 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-11 20:18 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-11 20:18 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-11 20:18 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-11 20:18 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-11 20:18 - 2013-06-01 10:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 20:18 - 2013-06-01 10:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-11 20:18 - 2013-05-31 00:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-07-11 20:18 - 2013-04-11 23:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 20:18 - 2013-04-11 23:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-07-11 20:17 - 2013-05-04 07:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-11 20:17 - 2013-05-04 05:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-06-21 12:07 - 2013-05-31 00:24 - 01257472 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-06-21 12:07 - 2013-05-31 00:08 - 00974848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-06-21 12:07 - 2013-05-24 00:01 - 01300992 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-06-21 12:07 - 2013-05-23 23:27 - 01022464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-06-21 12:07 - 2013-05-15 03:25 - 00888320 _____ (Microsoft Corporation) C:\Windows\System32\autochk.exe
2013-06-21 12:07 - 2013-05-15 03:25 - 00542208 _____ (Microsoft Corporation) C:\Windows\System32\untfs.dll
2013-06-21 12:07 - 2013-05-15 03:24 - 00793088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe
2013-06-21 12:07 - 2013-05-15 03:24 - 00482816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2013-06-21 12:06 - 2013-05-04 08:58 - 00120736 _____ (Microsoft Corporation) C:\Windows\System32\AuthHost.exe
2013-06-21 12:06 - 2013-05-04 08:34 - 00446720 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\USBHUB3.SYS
2013-06-21 12:06 - 2013-05-04 08:34 - 00284416 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\spaceport.sys
2013-06-21 12:06 - 2013-05-04 08:34 - 00213248 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\UCX01000.SYS
2013-06-21 12:06 - 2013-05-04 08:30 - 00058312 _____ (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2013-06-21 12:06 - 2013-05-04 07:59 - 13644288 _____ (Microsoft Corporation) C:\Windows\System32\Windows.UI.Xaml.dll
2013-06-21 12:06 - 2013-05-04 07:59 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2013-06-21 12:06 - 2013-05-04 07:59 - 01619968 _____ (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2013-06-21 12:06 - 2013-05-04 07:59 - 01483776 _____ (Microsoft Corporation) C:\Windows\System32\VSSVC.exe
2013-06-21 12:06 - 2013-05-04 07:59 - 00812544 _____ (Microsoft Corporation) C:\Windows\System32\Magnify.exe
2013-06-21 12:06 - 2013-05-04 07:59 - 00760320 _____ (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2013-06-21 12:06 - 2013-05-04 07:59 - 00251904 _____ (Microsoft Corporation) C:\Windows\System32\WUSettingsProvider.dll
2013-06-21 12:06 - 2013-05-04 07:59 - 00141824 _____ (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2013-06-21 12:06 - 2013-05-04 07:59 - 00098304 _____ (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2013-06-21 12:06 - 2013-05-04 07:59 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2013-06-21 12:06 - 2013-05-04 07:58 - 10116096 _____ (Microsoft Corporation) C:\Windows\System32\twinui.dll
2013-06-21 12:06 - 2013-05-04 07:58 - 01332736 _____ (Microsoft Corporation) C:\Windows\System32\sysmain.dll
2013-06-21 12:06 - 2013-05-04 07:58 - 00470528 _____ (Microsoft Corporation) C:\Windows\System32\netprofmsvc.dll
2013-06-21 12:06 - 2013-05-04 07:58 - 00330240 _____ (Microsoft Corporation) C:\Windows\System32\stobject.dll
2013-06-21 12:06 - 2013-05-04 07:58 - 00328192 _____ (Microsoft Corporation) C:\Windows\System32\ubpm.dll
2013-06-21 12:06 - 2013-05-04 07:58 - 00173568 _____ (Microsoft Corporation) C:\Windows\System32\storewuauth.dll
2013-06-21 12:06 - 2013-05-04 07:58 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\netplwiz.dll
2013-06-21 12:06 - 2013-05-04 07:58 - 00151552 _____ (Microsoft Corporation) C:\Windows\System32\netprofm.dll
2013-06-21 12:06 - 2013-05-04 07:58 - 00093696 _____ (Microsoft Corporation) C:\Windows\System32\psmsrv.dll
2013-06-21 12:06 - 2013-05-04 07:57 - 02305024 _____ (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-06-21 12:06 - 2013-05-04 07:57 - 01131520 _____ (Microsoft Corporation) C:\Windows\System32\AppXDeploymentServer.dll
2013-06-21 12:06 - 2013-05-04 07:57 - 00708096 _____ (Microsoft Corporation) C:\Windows\System32\AppXDeploymentExtensions.dll
2013-06-21 12:06 - 2013-05-04 07:57 - 00560640 _____ (Microsoft Corporation) C:\Windows\System32\mfmp4srcsnk.dll
2013-06-21 12:06 - 2013-05-04 07:57 - 00501760 _____ (Microsoft Corporation) C:\Windows\System32\DevicePairing.dll
2013-06-21 12:06 - 2013-05-04 07:57 - 00389120 _____ (Microsoft Corporation) C:\Windows\System32\BCP47Langs.dll
2013-06-21 12:06 - 2013-05-04 07:57 - 00179712 _____ (Microsoft Corporation) C:\Windows\System32\bisrv.dll
2013-06-21 12:06 - 2013-05-04 07:57 - 00122368 _____ (Microsoft Corporation) C:\Windows\System32\biwinrt.dll
2013-06-21 12:06 - 2013-05-04 07:57 - 00017408 _____ (Microsoft Corporation) C:\Windows\System32\muifontsetup.dll
2013-06-21 12:06 - 2013-05-04 07:56 - 00419840 _____ (Microsoft Corporation) C:\Windows\System32\intl.cpl
2013-06-21 12:06 - 2013-05-04 05:58 - 00758784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Magnify.exe
2013-06-21 12:06 - 2013-05-04 05:58 - 00621056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-06-21 12:06 - 2013-05-04 05:58 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-06-21 12:06 - 2013-05-04 05:58 - 00083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-06-21 12:06 - 2013-05-04 05:58 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-06-21 12:06 - 2013-05-04 05:57 - 10788864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2013-06-21 12:06 - 2013-05-04 05:57 - 08857088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2013-06-21 12:06 - 2013-05-04 05:57 - 00303616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2013-06-21 12:06 - 2013-05-04 05:57 - 00247296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2013-06-21 12:06 - 2013-05-04 05:57 - 00151040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netplwiz.dll
2013-06-21 12:06 - 2013-05-04 05:57 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netprofm.dll
2013-06-21 12:06 - 2013-05-04 05:57 - 00018432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\npmproxy.dll
2013-06-21 12:06 - 2013-05-04 05:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\muifontsetup.dll
2013-06-21 12:06 - 2013-05-04 05:56 - 02035712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-06-21 12:06 - 2013-05-04 05:56 - 00449536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairing.dll
2013-06-21 12:06 - 2013-05-04 05:56 - 00411136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2013-06-21 12:06 - 2013-05-04 05:56 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BCP47Langs.dll
2013-06-21 12:06 - 2013-05-04 05:56 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\biwinrt.dll
2013-06-21 12:06 - 2013-05-04 05:55 - 00389632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\intl.cpl
2013-06-21 12:06 - 2013-05-04 05:51 - 00014848 _____ (Microsoft) C:\Windows\System32\rars.rs
2013-06-21 12:06 - 2013-05-04 05:48 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidclass.sys
2013-06-21 12:06 - 2013-05-04 05:48 - 00027648 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidusb.sys
2013-06-21 12:06 - 2013-05-04 05:47 - 00427520 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdbss.sys
2013-06-21 12:06 - 2013-05-04 05:10 - 00014848 _____ (Microsoft) C:\Windows\SysWOW64\rars.rs
2013-06-21 12:06 - 2013-05-02 23:04 - 00386646 _____ C:\Windows\System32\ApnDatabase.xml
2013-06-21 12:01 - 2013-05-15 23:37 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-06-21 12:01 - 2013-05-15 23:35 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\UXInit.dll
2013-06-21 12:01 - 2013-05-14 14:14 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-21 12:01 - 2013-05-14 10:23 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-21 12:01 - 2013-05-04 08:45 - 02233600 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-21 12:01 - 2013-04-28 23:28 - 00915968 _____ (Microsoft Corporation) C:\Windows\System32\uxtheme.dll
2013-06-21 12:01 - 2013-04-27 06:20 - 00733184 _____ (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-21 12:01 - 2013-04-24 00:13 - 01013248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-21 12:01 - 2013-04-24 00:12 - 01569792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-21 12:01 - 2013-04-24 00:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-21 12:01 - 2013-04-23 23:56 - 01255936 _____ (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-21 12:01 - 2013-04-23 23:55 - 01889280 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-21 12:01 - 2013-04-23 23:55 - 00141312 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-21 12:01 - 2013-04-23 23:55 - 00068096 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-21 12:01 - 2013-04-03 00:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-21 12:01 - 2013-04-03 00:12 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll

==================== One Month Modified Files and Folders =======

2013-07-17 19:40 - 2013-07-17 19:40 - 00000000 ____D C:\FRST
2013-07-17 16:30 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-17 16:29 - 2013-07-14 17:24 - 00357336 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-15 22:16 - 2012-10-29 23:42 - 00753134 _____ C:\Windows\System32\perfh007.dat
2013-07-15 22:16 - 2012-10-29 23:42 - 00155826 _____ C:\Windows\System32\perfc007.dat
2013-07-15 22:16 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-15 22:02 - 2012-10-30 00:37 - 00000000 ____D C:\ProgramData\MOCP
2013-07-15 21:03 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\System32\sru
2013-07-15 20:35 - 2012-10-30 00:04 - 02072470 _____ C:\Windows\WindowsUpdate.log
2013-07-15 20:07 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\System32\oobe
2013-07-15 18:31 - 2012-07-26 08:21 - 00025970 _____ C:\Windows\setupact.log
2013-07-15 18:27 - 2013-07-15 18:27 - 00000000 __SHD C:\found.000
2013-07-15 17:54 - 2012-08-03 03:22 - 00046936 _____ C:\Windows\PFRO.log
2013-07-15 15:51 - 2013-07-15 15:51 - 00000000 ____H C:\Windows\System32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2013-07-15 02:02 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\System32\config\ELAM
2013-07-14 17:23 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\System32\config\BBI
2013-07-14 17:21 - 2012-10-30 00:08 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-07-14 17:19 - 2012-07-26 08:52 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-13 09:04 - 2013-07-13 09:04 - 01084743 _____ C:\ProgramData\2433f433
2013-07-13 09:04 - 2013-07-13 09:04 - 01084701 _____ C:\Users\Harald\AppData\Roaming\2433f433
2013-07-13 09:04 - 2013-07-13 09:04 - 01084695 _____ C:\Users\Harald\AppData\Local\2433f433
2013-07-11 20:53 - 2013-01-19 13:18 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 20:52 - 2012-07-26 06:26 - 00000220 _____ C:\Windows\win.ini
2013-07-11 20:49 - 2013-01-13 11:48 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-07-11 20:42 - 2013-01-12 10:51 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1125416264-3547490676-2638424123-1001
2013-07-04 22:51 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-06-27 23:04 - 2012-07-26 09:14 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-27 23:04 - 2012-07-26 09:14 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-24 20:31 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2013-06-23 12:19 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ToastData
2013-06-23 12:19 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2013-06-23 12:19 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-06-23 12:19 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-06-23 12:19 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-06-23 12:19 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\System32\Dism

Files to move or delete:
====================
C:\ProgramData\RoCGsTU.bat
C:\ProgramData\RoCGsTU.reg

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-06-29 16:59:02
Restore point made on: 2013-07-11 20:44:10
Restore point made on: 2013-07-15 20:06:51
Restore point made on: 2013-07-16 21:18:30
Restore point made on: 2013-07-17 16:25:15

==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 3978.35 MB
Available physical RAM: 3349.49 MB
Total Pagefile: 3978.35 MB
Available Pagefile: 3364.83 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:429.52 GB) (Free:380.36 GB) NTFS
Drive d: (HRM_CCSA_X64FRE_DE-DE_DV5) (CDROM) (Total:3.32 GB) (Free:0 GB) UDF
Drive e: (HITMANPRO) (Removable) (Total:0.94 GB) (Free:0.92 GB) FAT32 (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: D5B062BF)

Partition: GPT Partition Type
========================================================
Disk: 1 (Size: 965 MB) (Disk ID: 499ACB7F)
Partition 1: (Active) - (Size=965 MB) - (Type=0B)


LastRegBack: 2013-07-11 20:43

==================== End Of Log ============================
ich hoffe die Daten sind vollständig.

Besten Dank im Voraus

aharonov 17.07.2013 21:24
Hi,

Zitat:
benötige jetzt zum Fixen noch die erforderliche FIXlog-Daten.
Versuchs mal mit diesen. :)
Startet der Rechner danach wieder normal?


Drücke auf einem Zweitrechner bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument:
Code:
HKU\Harald\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Harald\AppData\Local\Temp\guqirpivnnmeamxur.exe [48128 2013-07-13] (NVIDIA Corporation) <===== ATTENTION
HKU\Harald\...\Winlogon: [Shell] cmd.exe [404992 2012-07-26] (Microsoft Corporation) <==== ATTENTION
HKU\Harald\...\Command Processor: "C:\Users\Harald\AppData\Local\Temp\guqirpivnnmeamxur.exe" <===== ATTENTION!
C:\Users\Harald\AppData\Local\Temp\guqirpivnnmeamxur.exe
C:\Users\Harald\AppData\Local\Temp\guqirpivnnmeamxur.dll
2013-07-13 09:04 - 2013-07-13 09:04 - 01084743 _____ C:\ProgramData\2433f433
2013-07-13 09:04 - 2013-07-13 09:04 - 01084701 _____ C:\Users\Harald\AppData\Roaming\2433f433
2013-07-13 09:04 - 2013-07-13 09:04 - 01084695 _____ C:\Users\Harald\AppData\Local\2433f433
C:\ProgramData\RoCGsTU.bat
C:\ProgramData\RoCGsTU.reg
Speichere dieses dann bitte unter dem Dateinamen Fixlist.txt auf deinen USB Stick neben FRST.
  • Schliesse den USB Stick wieder an den infizierten Rechner an.
  • Starte deinen Rechner erneut in die Reparaturoptionen.
  • Starte nun wiederum FRST, aber klicke dieses Mal auf den Fix Button.
Das Tool erstellt eine Datei Fixlog.txt auf deinem USB Stick. Poste deren Inhalt bitte hier.

aharonov 25.07.2013 17:31
Hi,

ich hab schon länger keine Antwort mehr von dir erhalten. Brauchst du weiterhin noch Hilfe?

Wenn ich in den nächsten 24 Stunden nichts von dir höre, gehe ich davon aus, dass sich das Thema erledigt hat und lösche es aus meinen Abos.

Hinweis: Wir sind noch nicht fertig! Auch wenn die Symptome verschwunden sein sollten, kann dein System weiterhin infiziert sein und über Sicherheitslücken verfügen, welche eine erneute Infektion möglich machen.

linusspoke 26.07.2013 07:57
Entschuldige, war die letzte Zeit zu sehr beschäftigt (Geld verdienen ...)

Habe es noch ausprobiert, Notebook war auch entsperrt und wieder lauffähig, aber das abgelaufene Testabo von McAfee hat dann anschließend Probleme bereitet.

Letzt endlich musste ich dann doch den Rechner "auffrischen" und alle Updates nachziehen....

Im Moment scheint alles in Ordnung.

Nochmal vielen Dank für die schnelle Hilfe. :applaus:


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:12 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55