Trojaner-Board - GVU Trojaner

Hallo!

Ich habe mich durch Internet gehangelt und habe FRST.exe bei Windows 7 durchgeführt und folgende Datei bekommen - kann mir jemand helfen???
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-06-2013 (ATTENTION: FRST version is 80 days old)

Ran by SYSTEM on 23-08-2013 10:11:24

Running from H:\

Windows 7 Home Premium (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Recovery

 

The current controlset is ControlSet001
 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

 

==================== Registry (Whitelisted) ==================

 

HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-14] (Synaptics Incorporated)

HKLM\...\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [450048 2009-07-21] (IDT, Inc.)

HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" [171520 2009-08-25] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-07-02] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [HPCam_Menu] "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam" [218408 2009-02-25] (CyberLink Corp.)

HKLM-x32\...\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [320056 2009-06-24] ( Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED [581480 2009-05-12] (Symantec Corporation)

HKLM-x32\...\Run: [UpdatePRCShortCut] "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover" [222504 2009-05-19] (CyberLink Corp.)

HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)

HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [500792 2010-03-23] (Hewlett-Packard Company)

HKLM-x32\...\Run: [NPSStartup] [x]

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-05-30] (Apple Inc.)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [x]

HKLM-x32\...\Run: [BrowserPlugInHelper] C:\Program Files (x86)\Wondershare\Video Converter Ultimate\BrowserPlugInHelper.exe [x]

HKLM-x32\...\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [x]

HKU\Default\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard)

HKU\Default\...\Policies\system: [WallpaperStyle] 2

HKU\Default User\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard)

HKU\Default User\...\Policies\system: [WallpaperStyle] 2

HKU\Sunny\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard)

HKU\Sunny\...\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2363392 2009-06-17] (Hewlett-Packard Company)

HKU\Sunny\...\Run: [AccelerometerSysTrayApplet] "C:\Program Files\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.Exe" [75576 2009-07-13] (Hewlett-Packard)

HKU\Sunny\...\Run: [] [x]

HKU\Sunny\...\Run: [Torntv Downloader] C:\Program Files (x86)\TornTV.com\Torntv Downloader.exe /c=startup [x]

HKU\Sunny\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\Sunny\AppData\Local\Temp\wlqqhxwywtjapwctp.exe [50688 2013-08-22] (Valve Corporation)

HKU\Sunny\...\Policies\system: [WallpaperStyle] 2

HKU\Sunny\...\Policies\system: [DisableLockWorkstation] 0

HKU\Sunny\...\Policies\system: [DisableChangePassword] 0

HKU\Sunny\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION 

AppInit_DLLs: [0 ] ()

 

==================== Services (Whitelisted) =================

 

S2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)

S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\diMaster.dll [556336 2013-05-29] (Symantec Corporation)

S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-01-21] ()

S2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe [240128 2009-07-21] (IDT, Inc.)

S2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]

 

==================== Drivers (Whitelisted) ====================

 

S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)

S1 cdrbsdrv; C:\Windows\System32\Drivers\cdrbsdrv.sys [39208 2006-08-25] (B.H.A Corporation)

S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-08-20] (Symantec Corporation)

S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-08-20] (Symantec Corporation)

S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20130821.003\IDSvia64.sys [520280 2013-08-20] (Symantec Corporation)

S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130822.002\ENG64.SYS [126040 2013-08-15] (Symantec Corporation)

S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130822.002\EX64.SYS [2098776 2013-08-15] (Symantec Corporation)

S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)

S1 ccSet_NIS; \SystemRoot\system32\drivers\NISx64\1404000.028\ccSetx64.sys [x]

S3 Ser2pl; system32\DRIVERS\ser2pl64.sys [x]

S1 SRTSP; \SystemRoot\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [x]

S1 SRTSPX; \SystemRoot\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [x]

S0 SymDS; system32\drivers\NISx64\1404000.028\SYMDS64.SYS [x]

S0 SymEFA; system32\drivers\NISx64\1404000.028\SYMEFA64.SYS [x]

S3 SYMFW; \SystemRoot\System32\Drivers\NISx64\1007020.00B\SYMFW.SYS [x]

S1 SymIRON; \SystemRoot\system32\drivers\NISx64\1404000.028\Ironx64.SYS [x]

S3 SYMNDISV; \SystemRoot\System32\Drivers\NISx64\1007020.00B\SYMNDISV.SYS [x]

S1 SymNetS; \SystemRoot\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [x]

 

========================== Drivers MD5 =======================

 

C:\Windows\System32\DRIVERS\wd.sys ==> MD5 is legit

C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4

C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit

C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D

C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit

C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit

C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F

C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

C:\Windows\System32\DRIVERS\yk62x64.sys B3EEACF62445E24FBB2CD4B0FB4DB026

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2013-08-23 10:11 - 2013-08-23 10:11 - 00000000 ____D C:\FRST

2013-08-22 13:54 - 2013-08-22 13:54 - 00000000 __SHD C:\found.000

2013-08-22 12:40 - 2013-08-22 12:40 - 01084804 ____A C:\Users\Sunny\AppData\Roaming\2433f433

2013-08-22 12:40 - 2013-08-22 12:40 - 01084797 ____A C:\ProgramData\2433f433

2013-08-22 12:40 - 2013-08-22 12:40 - 01084755 ____A C:\Users\Sunny\AppData\Local\2433f433

2013-08-22 12:39 - 2013-08-22 12:39 - 04099857 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part19.rar.part

2013-08-22 11:57 - 2013-08-22 12:33 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part18.rar

2013-08-22 10:44 - 2013-08-22 11:20 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part17.rar

2013-08-22 10:44 - 2013-08-22 11:04 - 63275662 ____A C:\Users\Sunny\Downloads\Stsch20.rar

2013-08-22 09:56 - 2013-08-22 10:33 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part16.rar

2013-08-22 09:04 - 2013-08-22 09:40 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part15.rar

2013-08-22 07:18 - 2013-08-22 07:49 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part14.rar

2013-08-22 07:17 - 2013-08-22 07:40 - 68680690 ____A C:\Users\Sunny\Downloads\Stsch19.rar

2013-08-21 21:53 - 2013-08-21 22:31 - 118422686 ____A C:\Users\Sunny\Downloads\Stsch16.rar

2013-08-21 21:53 - 2013-08-21 22:11 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part13.rar

2013-08-21 10:26 - 2013-08-21 10:26 - 00007984 ____A C:\Users\Sunny\Downloads\conni-h8wvsdm3w0gu.dlc

2013-08-20 09:03 - 2013-08-20 09:03 - 00017048 ____A C:\Users\Sunny\Downloads\Game_of_Thrones_S03_XviD-227a2nmeetlqq.dlc

2013-08-20 09:00 - 2013-08-20 09:00 - 00021720 ____A C:\Users\Sunny\Downloads\31c942ad308113177e42e9d3c41b423b.dlc

2013-08-17 05:20 - 2013-08-22 23:50 - 00001176 ____A C:\Windows\setupact.log

2013-08-17 05:20 - 2013-08-17 05:20 - 00000000 ____A C:\Windows\setuperr.log

2013-08-14 12:43 - 2013-07-25 21:13 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-08-14 12:43 - 2013-07-25 21:13 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-08-14 12:43 - 2013-07-25 21:13 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-08-14 12:43 - 2013-07-25 21:12 - 19239424 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-08-14 12:43 - 2013-07-25 21:12 - 15405056 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-08-14 12:43 - 2013-07-25 21:12 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-08-14 12:43 - 2013-07-25 21:12 - 02647040 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-08-14 12:43 - 2013-07-25 21:12 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-08-14 12:43 - 2013-07-25 21:12 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-08-14 12:43 - 2013-07-25 21:12 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-08-14 12:43 - 2013-07-25 21:12 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-08-14 12:43 - 2013-07-25 21:12 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-08-14 12:43 - 2013-07-25 21:12 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-08-14 12:43 - 2013-07-25 21:12 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-08-14 12:43 - 2013-07-25 19:35 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-08-14 12:43 - 2013-07-25 19:13 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-08-14 12:43 - 2013-07-25 19:13 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-08-14 12:43 - 2013-07-25 19:12 - 14329344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-08-14 12:43 - 2013-07-25 19:12 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-08-14 12:43 - 2013-07-25 19:12 - 02048512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-08-14 12:43 - 2013-07-25 19:12 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-08-14 12:43 - 2013-07-25 19:12 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-08-14 12:43 - 2013-07-25 19:12 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-08-14 12:43 - 2013-07-25 19:12 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-08-14 12:43 - 2013-07-25 19:12 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-08-14 12:43 - 2013-07-25 19:12 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-08-14 12:43 - 2013-07-25 19:11 - 13761024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-08-14 12:43 - 2013-07-25 19:11 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-08-14 12:43 - 2013-07-25 18:49 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-08-14 12:43 - 2013-07-25 18:39 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-08-14 12:43 - 2013-07-25 17:59 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-08-14 12:31 - 2013-08-14 12:36 - 00000000 ____D C:\Windows\System32\MRT

2013-08-14 10:24 - 2013-08-14 10:24 - 00013912 ____A C:\Users\Sunny\Downloads\bz-hberg-iijiodmm1o9a.dlc

2013-08-14 05:34 - 2013-07-25 01:25 - 01888768 ____A (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL

2013-08-14 05:34 - 2013-07-25 00:57 - 01620992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-08-14 05:34 - 2013-07-18 17:58 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll

2013-08-14 05:34 - 2013-07-18 17:41 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2013-08-14 05:34 - 2013-07-08 22:03 - 05550528 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

2013-08-14 05:34 - 2013-07-08 21:54 - 01732032 ____A (Microsoft Corporation) C:\Windows\System32\ntdll.dll

2013-08-14 05:34 - 2013-07-08 21:53 - 00243712 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll

2013-08-14 05:34 - 2013-07-08 21:52 - 00224256 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll

2013-08-14 05:34 - 2013-07-08 21:51 - 01217024 ____A (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll

2013-08-14 05:34 - 2013-07-08 21:46 - 01472512 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll

2013-08-14 05:34 - 2013-07-08 21:46 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll

2013-08-14 05:34 - 2013-07-08 21:46 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll

2013-08-14 05:34 - 2013-07-08 21:03 - 03968960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-08-14 05:34 - 2013-07-08 21:03 - 03913664 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-08-14 05:34 - 2013-07-08 20:53 - 01292192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2013-08-14 05:34 - 2013-07-08 20:52 - 00663552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2013-08-14 05:34 - 2013-07-08 20:52 - 00175104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2013-08-14 05:34 - 2013-07-08 20:52 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-08-14 05:34 - 2013-07-08 20:46 - 01166848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-08-14 05:34 - 2013-07-08 20:46 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-08-14 05:34 - 2013-07-08 20:46 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-08-14 05:34 - 2013-07-08 18:49 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-08-14 05:34 - 2013-07-08 18:49 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-08-14 05:34 - 2013-07-08 18:49 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-08-14 05:34 - 2013-07-08 18:49 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-08-14 05:33 - 2013-07-05 22:03 - 01910208 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

2013-08-14 05:33 - 2013-06-14 20:32 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys

2013-08-09 02:55 - 2013-08-09 03:01 - 115929465 ____A C:\Users\Sunny\Downloads\05Ponyfee-Tiere.7z

2013-08-09 01:55 - 2013-08-09 02:01 - 116519273 ____A C:\Users\Sunny\Downloads\04Ponyfee-Feenstab.7z

2013-08-09 00:55 - 2013-08-09 01:00 - 104951625 ____A C:\Users\Sunny\Downloads\03Ponyfee-Perlensee.7z

2013-08-09 00:48 - 2013-08-09 00:54 - 104440265 ____A C:\Users\Sunny\Downloads\02Ponyfee-Prinz-Roseninsel.7z

2013-08-08 13:39 - 2013-08-08 13:45 - 108230409 ____A C:\Users\Sunny\Downloads\01Ponyfee-Geheimnis.7z

2013-08-07 10:30 - 2013-08-07 10:30 - 00007640 ____A C:\Users\Sunny\Downloads\ba092e43d14578e3571c44236c1c9c91.dlc

2013-08-06 23:07 - 2013-08-11 11:17 - 00005956 ____A C:\Users\Sunny\Downloads\k8325362cv6kmrl.dlc

2013-08-06 23:06 - 2013-08-06 23:06 - 00003908 ____A C:\Users\Sunny\Downloads\k8325362cv6kmrl-uploaded.net.dlc

2013-08-06 10:01 - 2013-08-06 10:01 - 00024664 ____A C:\Users\Sunny\Downloads\BIBI_Einzeln-d2znaelxiaof.dlc

2013-07-26 12:08 - 2013-07-26 12:08 - 00006488 ____A C:\Users\Sunny\Downloads\Stschw-h3u0ajmtszj.dlc

2013-07-26 12:03 - 2013-07-26 12:03 - 00000136 ____A C:\Users\Sunny\Downloads\uqh3jhlna7175a46.js

 

==================== One Month Modified Files and Folders =======

 

2013-08-23 10:11 - 2013-08-23 10:11 - 00000000 ____D C:\FRST

2013-08-22 23:51 - 2011-12-26 10:51 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-22 23:50 - 2013-08-17 05:20 - 00001176 ____A C:\Windows\setupact.log

2013-08-22 23:50 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-08-22 19:40 - 2012-12-18 12:29 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-22 19:38 - 2011-12-26 10:51 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-22 14:07 - 2009-07-13 20:45 - 00023024 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-08-22 14:07 - 2009-07-13 20:45 - 00023024 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-08-22 14:03 - 2009-10-02 15:25 - 01402435 ____A C:\Windows\WindowsUpdate.log

2013-08-22 13:54 - 2013-08-22 13:54 - 00000000 __SHD C:\found.000

2013-08-22 12:40 - 2013-08-22 12:40 - 01084804 ____A C:\Users\Sunny\AppData\Roaming\2433f433

2013-08-22 12:40 - 2013-08-22 12:40 - 01084797 ____A C:\ProgramData\2433f433

2013-08-22 12:40 - 2013-08-22 12:40 - 01084755 ____A C:\Users\Sunny\AppData\Local\2433f433

2013-08-22 12:39 - 2013-08-22 12:39 - 04099857 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part19.rar.part

2013-08-22 12:33 - 2013-08-22 11:57 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part18.rar

2013-08-22 11:20 - 2013-08-22 10:44 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part17.rar

2013-08-22 11:04 - 2013-08-22 10:44 - 63275662 ____A C:\Users\Sunny\Downloads\Stsch20.rar

2013-08-22 10:33 - 2013-08-22 09:56 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part16.rar

2013-08-22 09:40 - 2013-08-22 09:04 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part15.rar

2013-08-22 07:49 - 2013-08-22 07:18 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part14.rar

2013-08-22 07:40 - 2013-08-22 07:17 - 68680690 ____A C:\Users\Sunny\Downloads\Stsch19.rar

2013-08-21 22:31 - 2013-08-21 21:53 - 118422686 ____A C:\Users\Sunny\Downloads\Stsch16.rar

2013-08-21 22:11 - 2013-08-21 21:53 - 108003328 ____A C:\Users\Sunny\Downloads\G.o.T-S02-E01-E10.part13.rar

2013-08-21 10:26 - 2013-08-21 10:26 - 00007984 ____A C:\Users\Sunny\Downloads\conni-h8wvsdm3w0gu.dlc

2013-08-20 10:40 - 2012-12-18 12:29 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-08-20 10:40 - 2012-12-18 12:29 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-08-20 09:03 - 2013-08-20 09:03 - 00017048 ____A C:\Users\Sunny\Downloads\Game_of_Thrones_S03_XviD-227a2nmeetlqq.dlc

2013-08-20 09:00 - 2013-08-20 09:00 - 00021720 ____A C:\Users\Sunny\Downloads\31c942ad308113177e42e9d3c41b423b.dlc

2013-08-17 05:20 - 2013-08-17 05:20 - 00000000 ____A C:\Windows\setuperr.log

2013-08-16 13:37 - 2009-07-24 22:11 - 00000000 ____D C:\Windows\Panther

2013-08-16 05:57 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-08-15 23:30 - 2009-08-25 18:42 - 00657948 ____A C:\Windows\System32\perfh007.dat

2013-08-15 23:30 - 2009-08-25 18:42 - 00131288 ____A C:\Windows\System32\perfc007.dat

2013-08-15 23:30 - 2009-07-13 21:13 - 01507502 ____A C:\Windows\System32\PerfStringBackup.INI

2013-08-14 12:43 - 2009-08-25 10:08 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-14 12:36 - 2013-08-14 12:31 - 00000000 ____D C:\Windows\System32\MRT

2013-08-14 12:31 - 2010-01-03 04:45 - 78161360 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-08-14 10:24 - 2013-08-14 10:24 - 00013912 ____A C:\Users\Sunny\Downloads\bz-hberg-iijiodmm1o9a.dlc

2013-08-14 05:35 - 2010-03-04 10:57 - 00000000 ____D C:\Users\Sunny\AppData\Local\CrashDumps

2013-08-11 11:17 - 2013-08-06 23:07 - 00005956 ____A C:\Users\Sunny\Downloads\k8325362cv6kmrl.dlc

2013-08-09 03:01 - 2013-08-09 02:55 - 115929465 ____A C:\Users\Sunny\Downloads\05Ponyfee-Tiere.7z

2013-08-09 02:01 - 2013-08-09 01:55 - 116519273 ____A C:\Users\Sunny\Downloads\04Ponyfee-Feenstab.7z

2013-08-09 01:00 - 2013-08-09 00:55 - 104951625 ____A C:\Users\Sunny\Downloads\03Ponyfee-Perlensee.7z

2013-08-09 00:54 - 2013-08-09 00:48 - 104440265 ____A C:\Users\Sunny\Downloads\02Ponyfee-Prinz-Roseninsel.7z

2013-08-08 13:45 - 2013-08-08 13:39 - 108230409 ____A C:\Users\Sunny\Downloads\01Ponyfee-Geheimnis.7z

2013-08-07 10:30 - 2013-08-07 10:30 - 00007640 ____A C:\Users\Sunny\Downloads\ba092e43d14578e3571c44236c1c9c91.dlc

2013-08-06 23:06 - 2013-08-06 23:06 - 00003908 ____A C:\Users\Sunny\Downloads\k8325362cv6kmrl-uploaded.net.dlc

2013-08-06 11:17 - 2012-02-19 12:16 - 00000000 ____D C:\Windows\SysWOW64\Adobe

2013-08-06 10:01 - 2013-08-06 10:01 - 00024664 ____A C:\Users\Sunny\Downloads\BIBI_Einzeln-d2znaelxiaof.dlc

2013-08-04 10:36 - 2013-07-10 10:17 - 00000000 ____D C:\Program Files (x86)\JDownloader

2013-08-02 22:41 - 2009-12-17 11:41 - 00000000 ____D C:\Program Files (x86)\Google

2013-08-02 06:50 - 2009-07-13 21:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT

2013-07-26 12:08 - 2013-07-26 12:08 - 00006488 ____A C:\Users\Sunny\Downloads\Stschw-h3u0ajmtszj.dlc

2013-07-26 12:03 - 2013-07-26 12:03 - 00000136 ____A C:\Users\Sunny\Downloads\uqh3jhlna7175a46.js

2013-07-25 21:13 - 2013-08-14 12:43 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-07-25 21:13 - 2013-08-14 12:43 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-07-25 21:13 - 2013-08-14 12:43 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-07-25 21:12 - 2013-08-14 12:43 - 19239424 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-07-25 21:12 - 2013-08-14 12:43 - 15405056 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-07-25 21:12 - 2013-08-14 12:43 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-07-25 21:12 - 2013-08-14 12:43 - 02647040 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-07-25 21:12 - 2013-08-14 12:43 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-07-25 21:12 - 2013-08-14 12:43 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-07-25 21:12 - 2013-08-14 12:43 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-07-25 21:12 - 2013-08-14 12:43 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-07-25 21:12 - 2013-08-14 12:43 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-07-25 21:12 - 2013-08-14 12:43 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-07-25 21:12 - 2013-08-14 12:43 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-07-25 19:35 - 2013-08-14 12:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-07-25 19:13 - 2013-08-14 12:43 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-25 19:13 - 2013-08-14 12:43 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-25 19:12 - 2013-08-14 12:43 - 14329344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-25 19:12 - 2013-08-14 12:43 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-25 19:12 - 2013-08-14 12:43 - 02048512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-25 19:12 - 2013-08-14 12:43 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-25 19:12 - 2013-08-14 12:43 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-25 19:12 - 2013-08-14 12:43 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-25 19:12 - 2013-08-14 12:43 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-25 19:12 - 2013-08-14 12:43 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-25 19:12 - 2013-08-14 12:43 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-25 19:11 - 2013-08-14 12:43 - 13761024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-25 19:11 - 2013-08-14 12:43 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-25 18:49 - 2013-08-14 12:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-25 18:39 - 2013-08-14 12:43 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-07-25 17:59 - 2013-08-14 12:43 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-25 01:25 - 2013-08-14 05:34 - 01888768 ____A (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL

2013-07-25 00:57 - 2013-08-14 05:34 - 01620992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

 

Files to move or delete:

====================

C:\Users\Sunny\wrar410d.exe

 

==================== Known DLLs (Whitelisted) ================

 

 

==================== Bamital & volsnap Check =================

 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

 

==================== EXE ASSOCIATION =====================

 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

 

==================== Restore Points =========================

 

Restore point made on: 2013-08-14 12:29:52

Restore point made on: 2013-08-21 14:00:21

 

==================== BCD ================================

 

Windows-Start-Manager

---------------------

Bezeichner {bootmgr}

device partition=Y:

description Windows Boot Manager

locale de-DE

inherit {globalsettings}

extendedinput Yes

default {default}

resumeobject {f04f848d-78e1-11de-b692-abbf25df600e}

displayorder {default}

toolsdisplayorder {memdiag}

timeout 30

customactions 0x1000085000001

0x5400000f

custom:5400000f {current}

 

Windows-Startladeprogramm

-------------------------

Bezeichner {current}

device ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{075b10b4-affd-11de-898c-814322c93442}

path \windows\system32\winload.exe

description Windows Recovery Environment

inherit {bootloadersettings}

osdevice ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{075b10b4-affd-11de-898c-814322c93442}

systemroot \windows

nx OptIn

winpe Yes

 

Windows-Startladeprogramm

-------------------------

Bezeichner {572bcd60-ffa7-11d9-aae0-0007e994107d}

device ramdisk=[boot]\sources\boot.wim,{ramdiskoptions}

path \windows\system32\boot\winload.exe

description Microsoft Windows PE 2.0 

osdevice ramdisk=[boot]\sources\boot.wim,{ramdiskoptions}

systemroot \windows

detecthal Yes

winpe Yes

ems Yes

 

Windows-Startladeprogramm

-------------------------

Bezeichner {default}

device partition=C:

path \Windows\system32\winload.exe

description Windows 7

locale de-DE

inherit {bootloadersettings}

recoverysequence {current}

recoveryenabled Yes

osdevice partition=C:

systemroot \Windows

resumeobject {f04f848d-78e1-11de-b692-abbf25df600e}

nx OptIn

 

Wiederaufnahme aus dem Ruhezustand

----------------------------------

Bezeichner {f04f848d-78e1-11de-b692-abbf25df600e}

device partition=C:

path \Windows\system32\winresume.exe

description Windows Resume Application

locale de-DE

inherit {resumeloadersettings}

filedevice partition=C:

filepath \hiberfil.sys

debugoptionenabled No

 

Windows-Speichertestprogramm

----------------------------

Bezeichner {memdiag}

device partition=Y:

path \boot\memtest.exe

description Windows Memory Diagnostic

locale de-DE

inherit {globalsettings}

badmemoryaccess Yes

 

EMS-Einstellungen

-----------------

Bezeichner {emssettings}

bootems Yes

 

Debuggereinstellungen

---------------------

Bezeichner {dbgsettings}

debugtype Serial

debugport 1

baudrate 115200

 

RAM-Defekte

-----------

Bezeichner {badmemory}

 

Globale Einstellungen

---------------------

Bezeichner {globalsettings}

inherit {dbgsettings}

{emssettings}

{badmemory}

 

Startladeprogramm-Einstellungen

-------------------------------

Bezeichner {bootloadersettings}

inherit {globalsettings}

{hypervisorsettings}

 

Hypervisoreinstellungen

-------------------

Bezeichner {hypervisorsettings}

hypervisordebugtype Serial

hypervisordebugport 1

hypervisorbaudrate 115200

 

Einstellungen zur Ladeprogrammfortsetzung

-----------------------------------------

Bezeichner {resumeloadersettings}

inherit {globalsettings}

 

Ger„teoptionen

--------------

Bezeichner {075b10b4-affd-11de-898c-814322c93442}

description Ramdisk Options

ramdisksdidevice partition=E:

ramdisksdipath \Recovery\WindowsRE\boot.sdi

 

Optionen zum RAM-Datentr„gersetup

---------------------------------

Bezeichner {ramdiskoptions}

description Ramdisk Options

ramdisksdidevice boot

ramdisksdipath \boot\boot.sdi

 

 

==================== Memory info =========================== 

 

Percentage of memory in use: 18%

Total physical RAM: 4092.2 MB

Available physical RAM: 3352.11 MB

Total Pagefile: 4090.35 MB

Available Pagefile: 3341.35 MB

Total Virtual: 8192 MB

Available Virtual: 8191.86 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:452.23 GB) (Free:286.61 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]

Drive e: (RECOVERY) (Fixed) (Total:13.24 GB) (Free:2.21 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)]

Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32 (Disk=0 Partition=4)

Drive h: () (Removable) (Total:0.47 GB) (Free:0.47 GB) FAT (Disk=1 Partition=1)

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (Size: 466 GB) (Disk ID: 2BCBFB6B)

Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=452 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=13 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

 

========================================================

Disk: 1 (Size: 481 MB) (Disk ID: 00625660)

Partition 1: (Active) - (Size=481 MB) - (Type=06)

 

 

Last Boot: 2013-08-21 14:35

 

==================== End Of Log ============================
--- --- ---