Inactive [A] Win32:malware-gen

[sulpher]

Hello,
seems like I visited a bad internet site because my avast home is going crazy. He tells me all the time that he found win32:malware-gen for example in the processes: system32.exe, services.exe etc.

I did a boot scan with avast and he found some malware and deleted those files but the problem is still there

I installed malwarebytes anti-malware (as suggested in the forum) and scanned with it - 52 infected files found and deleted. after restart again avast going crazy, scanned again with malwarebytes anti-malware and found 2. the log will follow now.



P.S.: thanks for your help in advance - I really appreciate the help you people give! and sorry for my bad english as I'm not a native speaker

 

[sulpher]

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.12.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Rene :: CHRONOS [Administrator]

Schutz: Aktiviert

12.07.2012 13:14:57
mbam-log-2012-07-12 (13-14-57).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 228745
Laufzeit: 5 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 57
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz1290.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz12A0.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz1D48.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz1FBB.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz24F5.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz2F3A.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz31F2.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz3399.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz3579.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz37A8.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz4064.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz408D.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz42DB.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz495B.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz49AF.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz4C4B.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz5494.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz5AA8.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz5AF.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz5C7F.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz614B.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz6FFD.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz7271.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz7AD1.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz7EB7.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz8AE8.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz90B0.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz92E2.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz93A7.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz962D.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz9677.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz9C3F.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz9FFA.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzA293.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzA62E.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzA705.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzACF0.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzB361.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzB47D.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzBC9E.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzBFA7.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzC39B.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzC4A3.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzCEDD.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzD0DF.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzD52F.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzDB3B.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzDC11.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzE564.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzE66E.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzE9B8.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzEB42.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzF1FC.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzF5BA.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzF897.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzFBA.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzFCB4.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

 

[sulpher]

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.12.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Rene :: CHRONOS [Administrator]

Schutz: Aktiviert

12.07.2012 13:24:37
mbam-log-2012-07-12 (13-24-37).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 228513
Laufzeit: 5 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz2B02.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzC5E.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

 

[sulpher]

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.12.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Rene :: CHRONOS [Administrator]

Schutz: Aktiviert

12.07.2012 13:36:50
mbam-log-2012-07-12 (13-36-50).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 228470
Laufzeit: 4 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz309.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzDD4F.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzECFE.tmp (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

 

[sulpher]

Also there is a FB5FB9.exe trying to execute itself from following path: C:\Users\username\AppData\Roaming\FB5FB9.exe
but when I enter that folder, I can't find a file with that name

also avast gives me the message:
malicious website blocked
object: http:/jycjgaic.cn/4294735874?w=603&I=3801910661&v=2.4
infection: URL:Mal
process: c:\Windows\System32\svchost.exe

 

[sulpher]

avast sandbox log:
12.07.2012 13:23:21 Autosandbox candidate: C:\Users\Rene\AppData\Roaming\FB5FB9.exe
[Source: local://C:\Users\Rene\AppData\Local\Temp\fdjjo.exe http://oigybwebs.tk/3.html]
[Opened by: C:\Users\Rene\AppData\Roaming\FB5FB9.exe]
--> Result: Not sandboxing (based on user's decision).

 

[sulpher]

Avast Boottime scan:

Datei C:\Users\Rene\AppData\Local\Temp\jar_cache2387943184186376843.tmp|>fax.class ist infiziert von Java:CVE-2011-3544-HQ [Expl], Gelöscht
Datei C:\Users\Rene\AppData\Local\{fe12307a-d93b-c855-ecab-5fb11141fa17}\trzE73E.tmp ist infiziert von Win64:Sirefef-F [Rtk], Gelöscht
Datei C:\Users\Rene\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\41db82a3-5b1cf728|>a\c.class ist infiziert von Java:Agent-BEG [Expl], Gelöscht
Datei C:\Users\Rene\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\41db82a3-5b1cf728|>a\b.class ist infiziert von Java:CVE-2012-0507-JS [Expl], Gelöscht
Datei C:\Users\Rene\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\5ac63b63-4d1119fc ist infiziert von Win32:Buzus-AYD [Trj], Gelöscht
Datei C:\Users\Rene\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\461b1b07-5c27c83e|>r_ea\r_ec.class ist infiziert von Java:CVE-2012-0507-IW [Expl], Gelöscht
Datei C:\Users\Rene\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\461b1b07-5c27c83e|>r_ea\r_ea.class ist infiziert von Java:CVE-2012-0507-JS [Expl], Gelöscht
Datei C:\Users\Rene\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\546ae989-2de71c48|>a\Test.class ist infiziert von Java:CVE-2012-0507-CB [Expl], Gelöscht
Datei C:\Users\Rene\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\546ae989-2de71c48|>a\Msgs.class ist infiziert von Java:Agent-AWI [Expl], Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\trz208F.tmp ist infiziert von Win64:Sirefef-F [Rtk], Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz12B5.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz18BE.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz23D9.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz3D90.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz4AFB.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz5C04.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz6926.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz75A7.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzB7D.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trzF1D8.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei E:\System Volume Information\_restore{C3C85003-487D-490A-860B-EE2A316BFDC5}\RP10\A0001085.exe|>TDM\TDMInstall.exe|>Wise0011.bin Fehler 42145 {Installationsarchiv ist beschädigt.}
Datei E:\System Volume Information\_restore{C3C85003-487D-490A-860B-EE2A316BFDC5}\RP10\A0001086.exe|>TDM\TDMInstall.exe|>Wise0011.bin Fehler 42145 {Installationsarchiv ist beschädigt.}
Datei E:\System Volume Information\_restore{C3C85003-487D-490A-860B-EE2A316BFDC5}\RP10\A0001087.exe|>TDM\TDMInstall.exe|>Wise0011.bin Fehler 42145 {Installationsarchiv ist beschädigt.}
Datei E:\System Volume Information\_restore{C3C85003-487D-490A-860B-EE2A316BFDC5}\RP10\A0001088.exe|>TDM\TDMInstall.exe|>Wise0010.bin Fehler 42145 {Installationsarchiv ist beschädigt.}
Datei E:\System Volume Information\_restore{C3C85003-487D-490A-860B-EE2A316BFDC5}\RP10\A0001089.exe|>TDM\TDMInstall.exe|>Wise0011.bin Fehler 42145 {Installationsarchiv ist beschädigt.}
Datei G:\eigen\cpuz.exe ist infiziert von Win32ropper-DMZ [Trj], Gelöscht
Datei G:\eigen\SC-110.exe ist infiziert von Win32:MalOb-FE [Cryp], Gelöscht
Datei G:\videos\ibiza2011.mpeg ist infiziert von WMA:Wimad [Susp], Gelöscht
Datei G:\Router reconnect\JDownloader 0.6.193\downloads\FSJSetup.exe ist infiziert von Win32ropper-DMZ [Trj], Gelöscht
Datei G:\usefull tools\daemon403-x86.exe|>$INSTDIR\SetupDTSB.exe|>VVSN.exe ist infiziert von Win32:Whenu-I [PUP], Gelöscht
Datei G:\usefull tools\daemon403-x86.exe|>$INSTDIR\SetupDTSB.exe ist infiziert von Win32UP-gen [PUP], Gelöscht

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

======================================================

For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

• • 
    Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

 

[sulpher]

Hi Broni,

thanks for your fast reply. I just finished my scan with GMER when you replied.
Here is the log:
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-07-12 17:39:31
Windows 6.1.7601 Service Pack 1
Running: 72q5cdld.exe


---- Files - GMER 1.0.15 ----

File C:\avast! sandbox 0 bytes
File C:\avast! sandbox\S-1-5-21-1058247347-2628564259-3555606596-1001 0 bytes
File C:\avast! sandbox\S-1-5-21-1058247347-2628564259-3555606596-1001\r386 0 bytes
File C:\avast! sandbox\S-1-5-21-1058247347-2628564259-3555606596-1001\r386\F4D561A500007C_{75d617d6-cc34-11e1-b760-0013d3b089a0} 0 bytes
File C:\avast! sandbox\snx_rhive 262144 bytes
File C:\avast! sandbox\snx_rhive.LOG1 5120 bytes
File C:\avast! sandbox\snx_rhive.LOG2 0 bytes
File C:\avast! sandbox\snx_rhive{75d617d8-cc34-11e1-b760-0013d3b089a0}.TM.blf 65536 bytes
File C:\avast! sandbox\snx_rhive{75d617d8-cc34-11e1-b760-0013d3b089a0}.TMContainer00000000000000000001.regtrans-ms 524288 bytes
File C:\avast! sandbox\snx_rhive{75d617d8-cc34-11e1-b760-0013d3b089a0}.TMContainer00000000000000000002.regtrans-ms 524288 bytes

---- EOF - GMER 1.0.15 ----










I will now follow your instructions and give feedback as soon as I'm done!

 

[sulpher]

I downloaded Farbar Recovery Scan Tool 64-Bit and saved it to a USB stick but when I boot and press F8 and come into the boot menu, I have to select a boot first device:
>Removable
>hard disk
>cdrom
when I select hard disk I find my usb stick but he can't boot from it, what now?

 

[Broni]

You don't press F8.
You keep tapping F8 until Advanced Boot Options appears.

 

[sulpher]

aaaaaah, ok, I tapped F8 too early, if I wait until the boot sequence is at a later point I enter the advanced boot options! thanks! proceeding now

 

[sulpher]

Scan result of Farbar Recovery Scan Tool Version: 11-07-2012
Ran by SYSTEM at 12-07-2012 18:14:55
Running from J:\
Windows 7 Professional (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12673128 2011-08-16] (Realtek Semiconductor)
HKLM-x32\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4273976 2012-07-03] (AVAST Software)
HKLM-x32\...\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe" [36352 2008-08-03] ()
HKLM-x32\...\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start [69632 2004-04-12] (InstallShield Software Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [462920 2012-07-03] (Malwarebytes Corporation)
HKU\Rene\...\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup [196608 2004-04-17] (InstallShield Software Corporation)
HKU\Rene\...\Run: [TBPanel] C:\Program Files (x86)\Vtune\TBPanel.exe /A [2240512 2011-03-11] ()
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Startup: C:\Users\All Users\Start Menu\Programs\Startup\EasySetPackage.lnk
ShortcutTarget: EasySetPackage.lnk -> C:\Program Files (x86)\LG Soft India\EasySetPackage\bin\EasySetPackage.exe ()

==================== Services (Whitelisted) ======

2 avast! Antivirus; "C:\Program Files\AVAST Software\Avast\AvastSvc.exe" [44808 2012-07-03] (AVAST Software)
2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [655944 2012-07-03] (Malwarebytes Corporation)
2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2011-10-01] ()

========================== Drivers (Whitelisted) =============

2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [25232 2012-07-03] (AVAST Software)
2 aswMonFlt; C:\Windows\System32\Drivers\aswMonFlt.sys [71064 2012-07-03] (AVAST Software)
1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [42328 2011-11-28] (AVAST Software)
1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [958400 2012-07-03] (AVAST Software)
1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [355856 2012-07-03] (AVAST Software)
1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [59728 2012-07-03] (AVAST Software)
3 Cardex; \??\C:\Windows\SysWOW64\drivers\TBPANELX64.SYS [15648 2007-03-16] (Windows (R) Server 2003 DDK provider)
3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [24904 2012-07-03] (Malwarebytes Corporation)
3 RTL8023x64; C:\Windows\System32\DRIVERS\Rtnic64.sys [51712 2009-06-10] (Realtek Semiconductor Corporation )
3 LGDDCDevice; \??\C:\Windows\system32\LGI2CDriver.sys [x]
3 LGII2CDevice; \??\C:\Windows\system32\LGPII2CDriver.sys [x]
2 TBPanel; [x]

========================== NetSvcs (Whitelisted) ===========


============ One Month Created Files and Folders ==============

2012-07-12 07:39 - 2012-07-12 07:39 - 00001622 ____A C:\Users\Rene\germ.log
2012-07-12 07:19 - 2012-07-12 07:19 - 00302592 ____A C:\Users\Rene\Desktop\72q5cdld.exe
2012-07-12 04:07 - 2012-07-03 08:21 - 00054072 ____A (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys
2012-07-12 03:51 - 2012-06-11 19:08 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-07-12 03:13 - 2012-07-12 03:13 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-12 03:13 - 2012-07-12 03:13 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Malwarebytes
2012-07-12 03:13 - 2012-07-12 03:13 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-07-12 03:13 - 2012-07-12 03:13 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-12 03:13 - 2012-07-03 03:46 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-07-12 03:12 - 2012-07-12 03:12 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\Rene\Desktop\mbam-setup-1.62.0.1300.exe
2012-07-11 23:25 - 2012-06-08 21:43 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-07-11 23:25 - 2012-06-08 20:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2012-07-11 23:25 - 2012-06-05 22:06 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-07-11 23:25 - 2012-06-05 22:06 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-07-11 23:25 - 2012-06-05 21:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2012-07-11 23:25 - 2012-06-05 21:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2012-07-11 23:25 - 2012-06-01 21:50 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-07-11 23:25 - 2012-06-01 21:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-07-11 23:25 - 2012-06-01 21:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-07-11 23:25 - 2012-06-01 21:45 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-07-11 23:25 - 2012-06-01 21:44 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-07-11 23:25 - 2012-06-01 20:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2012-07-11 23:25 - 2012-06-01 20:40 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2012-07-11 23:25 - 2012-06-01 20:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2012-07-11 23:25 - 2012-06-01 20:34 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2012-07-11 23:25 - 2010-06-25 19:55 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll
2012-07-11 23:25 - 2010-06-25 19:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2012-07-11 23:24 - 2012-06-05 22:02 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll
2012-07-11 23:24 - 2012-06-05 21:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2012-07-11 23:24 - 2012-04-23 21:37 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-07-11 23:24 - 2012-04-23 21:37 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-07-11 23:24 - 2012-04-23 21:37 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-07-11 23:24 - 2012-04-23 20:36 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-07-11 23:24 - 2012-04-23 20:36 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-07-11 23:24 - 2012-04-23 20:36 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-07-05 10:59 - 2012-07-05 10:59 - 00034691 ____A C:\Users\Rene\Downloads\FtN_DoW_WA_DC_SS_Schemes.zip
2012-07-05 10:58 - 2012-07-05 11:02 - 193044358 ____A C:\Users\Rene\Downloads\DoW-SS-Englische-Einheitensounds.rar
2012-07-05 10:58 - 2012-07-05 11:02 - 154956615 ____A C:\Users\Rene\Downloads\DoW-DC-Englische-Einheitensounds.rar
2012-07-05 10:58 - 2012-07-05 11:00 - 69647012 ____A C:\Users\Rene\Downloads\DoW-Englische-Einheitensounds.rar
2012-07-05 10:58 - 2012-07-05 11:00 - 40160969 ____A C:\Users\Rene\Downloads\DoW-WA-Englische-Einheitensounds.rar
2012-07-05 10:58 - 2012-07-05 10:58 - 00349126 ____A C:\Users\Rene\Downloads\DoW-SS-Englische-Textdateien.rar
2012-07-01 11:11 - 2012-07-01 11:12 - 80018429 ____A C:\Users\Rene\Downloads\Play The Assassin Records - To Clasp A Fallen Wish with Broken Fingers.zip
2012-07-01 07:50 - 2012-07-01 07:50 - 00001273 ____A C:\Users\Rene\Documents\schleif.rtf
2012-06-30 07:10 - 2011-06-10 13:45 - 20497978 ____A C:\Users\Rene\Downloads\mchat - 06-10-2011 strippers.avi
2012-06-30 07:01 - 2012-06-30 07:07 - 17524068 ____A C:\Users\Rene\Downloads\83.rar
2012-06-30 04:05 - 2012-06-30 04:05 - 00000823 ____A C:\Users\Rene\.recently-used.xbel
2012-06-29 09:25 - 2012-06-29 09:26 - 62620566 ____A C:\Users\Rene\Downloads\Chronos - The Grips Of Winter.zip
2012-06-29 09:25 - 2012-06-29 09:26 - 55971373 ____A C:\Users\Rene\Downloads\Chronos - Demo 2010.zip
2012-06-27 09:24 - 2012-06-27 09:36 - 34002548 ____A C:\Users\Rene\Downloads\71.rar
2012-06-24 04:53 - 2012-06-24 04:54 - 113573393 ____A C:\Users\Rene\Downloads\'Sans Souci' - HRR072D320MP3.zip
2012-06-24 04:17 - 2012-06-24 04:18 - 59833759 ____A C:\Users\Rene\Downloads\Bossk_Rinoa Split - EOSLP023 320 MO3.zip
2012-06-24 04:17 - 2012-06-24 04:18 - 27055033 ____A C:\Users\Rene\Downloads\Coloured Tongues_MFBT - HRR085D320MP3.zip
2012-06-24 02:17 - 2012-06-24 02:17 - 00000000 ____D C:\Program Files (x86)\OO Software
2012-06-22 02:28 - 2012-06-02 14:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-22 02:28 - 2012-06-02 14:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-22 02:28 - 2012-06-02 14:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-22 02:28 - 2012-06-02 14:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-22 02:28 - 2012-06-02 14:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-22 02:28 - 2012-06-02 14:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-22 02:28 - 2012-06-02 14:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-22 02:28 - 2012-06-02 05:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-22 02:28 - 2012-06-02 05:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-20 06:36 - 2012-06-20 06:39 - 13849076 ____A C:\Users\Rene\Downloads\RS-GSNnHbMlt.rar
2012-06-19 10:17 - 2012-06-19 10:26 - 965612406 ____A C:\Users\Rene\Peaceful Solitude Mix - video.mp4
2012-06-18 08:32 - 2012-06-18 08:44 - 588432650 ____A C:\Users\Rene\Forgotten Dreams Mix - video.mp4
2012-06-18 06:13 - 2012-06-18 07:15 - 81408000 ____A C:\Users\Rene\Downloads\Godflesh_-_Slavestate.rar
2012-06-17 03:41 - 2012-06-17 03:58 - 00000000 ____D C:\Users\Rene\Projektuhr
2012-06-16 10:56 - 2012-06-16 11:22 - 46607244 ____A C:\Users\Rene\Downloads\Godflesh_-_Slateman-Cold_World.rar
2012-06-16 09:57 - 2012-06-16 10:39 - 74312197 ____A C:\Users\Rene\Downloads\Godflesh_-_Godflesh.rar
2012-06-16 05:52 - 2012-06-16 06:24 - 157026636 ____A C:\Users\Rene\Downloads\Beatles.avi
2012-06-14 08:54 - 2012-06-14 08:54 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Waveform
2012-06-14 05:15 - 2012-04-19 21:42 - 12297216 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-14 05:15 - 2012-04-19 21:42 - 09059840 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-14 05:15 - 2012-04-19 21:42 - 00735744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-06-14 05:15 - 2012-04-19 20:57 - 06027776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-06-14 05:15 - 2012-04-19 20:57 - 00627712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-06-14 05:15 - 2012-04-19 20:56 - 11020800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-06-14 05:14 - 2012-05-14 20:01 - 01188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-14 05:14 - 2012-05-14 19:59 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-14 05:14 - 2012-05-14 19:03 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-06-14 05:14 - 2012-05-14 19:00 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-06-14 05:14 - 2012-05-04 03:06 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-06-14 05:14 - 2012-05-04 02:03 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-06-14 05:14 - 2012-05-04 02:03 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-06-14 05:14 - 2012-04-27 19:55 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-06-14 05:14 - 2012-04-25 21:41 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-06-14 05:14 - 2012-04-25 21:41 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-06-14 05:14 - 2012-04-25 21:34 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-06-14 05:14 - 2012-04-19 21:42 - 02454528 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-14 05:14 - 2012-04-19 21:42 - 01494016 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-14 05:14 - 2012-04-19 21:42 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-14 05:14 - 2012-04-19 21:42 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-14 05:14 - 2012-04-19 21:42 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-14 05:14 - 2012-04-19 21:00 - 01231360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-06-14 05:14 - 2012-04-19 21:00 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-14 05:14 - 2012-04-19 20:57 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-06-14 05:14 - 2012-04-19 20:56 - 02073600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-06-14 05:14 - 2012-04-19 20:56 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-06-14 05:14 - 2012-04-19 19:45 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-14 05:14 - 2012-04-19 19:16 - 01638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb


============ 3 Months Modified Files ========================

2012-07-12 08:04 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-12 08:04 - 2009-07-13 20:51 - 00044543 ____A C:\Windows\setupact.log
2012-07-12 07:49 - 2009-07-13 20:45 - 00020016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-12 07:49 - 2009-07-13 20:45 - 00020016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-12 07:39 - 2012-07-12 07:39 - 00001622 ____A C:\Users\Rene\germ.log
2012-07-12 07:19 - 2012-07-12 07:19 - 00302592 ____A C:\Users\Rene\Desktop\72q5cdld.exe
2012-07-12 07:15 - 2011-08-23 04:09 - 00036712 ____A C:\Windows\PFRO.log
2012-07-12 04:40 - 2011-10-07 12:49 - 06275584 __ASH C:\Users\Rene\Thumbs.db
2012-07-12 04:08 - 2011-08-23 00:52 - 01480158 ____A C:\Windows\WindowsUpdate.log
2012-07-12 04:07 - 2011-08-23 01:31 - 00000000 ____A C:\Windows\SysWOW64\config.nt
2012-07-12 03:55 - 2009-07-13 20:45 - 00318944 ____A C:\Windows\System32\FNTCACHE.DAT
2012-07-12 03:49 - 2011-08-24 11:15 - 59701280 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-07-12 03:13 - 2012-07-12 03:13 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-12 03:12 - 2012-07-12 03:12 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\Rene\Desktop\mbam-setup-1.62.0.1300.exe
2012-07-11 03:54 - 2011-08-23 10:47 - 00696768 ____A C:\Windows\System32\perfh007.dat
2012-07-11 03:54 - 2011-08-23 10:47 - 00148064 ____A C:\Windows\System32\perfc007.dat
2012-07-11 03:54 - 2009-07-13 21:13 - 01613080 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-06 07:15 - 2011-08-23 07:20 - 00367189 ____A C:\Windows\DirectX.log
2012-07-05 11:02 - 2012-07-05 10:58 - 193044358 ____A C:\Users\Rene\Downloads\DoW-SS-Englische-Einheitensounds.rar
2012-07-05 11:02 - 2012-07-05 10:58 - 154956615 ____A C:\Users\Rene\Downloads\DoW-DC-Englische-Einheitensounds.rar
2012-07-05 11:00 - 2012-07-05 10:58 - 69647012 ____A C:\Users\Rene\Downloads\DoW-Englische-Einheitensounds.rar
2012-07-05 11:00 - 2012-07-05 10:58 - 40160969 ____A C:\Users\Rene\Downloads\DoW-WA-Englische-Einheitensounds.rar
2012-07-05 10:59 - 2012-07-05 10:59 - 00034691 ____A C:\Users\Rene\Downloads\FtN_DoW_WA_DC_SS_Schemes.zip
2012-07-05 10:58 - 2012-07-05 10:58 - 00349126 ____A C:\Users\Rene\Downloads\DoW-SS-Englische-Textdateien.rar
2012-07-03 08:21 - 2012-07-12 04:07 - 00054072 ____A (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys
2012-07-03 08:21 - 2011-08-23 01:31 - 00958400 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys
2012-07-03 08:21 - 2011-08-23 01:31 - 00355856 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys
2012-07-03 08:21 - 2011-08-23 01:31 - 00285328 ____A (AVAST Software) C:\Windows\System32\aswBoot.exe
2012-07-03 08:21 - 2011-08-23 01:31 - 00071064 ____A (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys
2012-07-03 08:21 - 2011-08-23 01:31 - 00059728 ____A (AVAST Software) C:\Windows\System32\Drivers\aswTdi.sys
2012-07-03 08:21 - 2011-08-23 01:31 - 00025232 ____A (AVAST Software) C:\Windows\System32\Drivers\aswFsBlk.sys
2012-07-03 08:21 - 2011-08-23 01:30 - 00227648 ____A (AVAST Software) C:\Windows\SysWOW64\aswBoot.exe
2012-07-03 08:21 - 2011-08-23 01:30 - 00041224 ____A (AVAST Software) C:\Windows\avastSS.scr
2012-07-03 03:46 - 2012-07-12 03:13 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-07-01 11:12 - 2012-07-01 11:11 - 80018429 ____A C:\Users\Rene\Downloads\Play The Assassin Records - To Clasp A Fallen Wish with Broken Fingers.zip
2012-07-01 07:50 - 2012-07-01 07:50 - 00001273 ____A C:\Users\Rene\Documents\schleif.rtf
2012-06-30 04:05 - 2012-06-30 04:05 - 00000823 ____A C:\Users\Rene\.recently-used.xbel
2012-06-29 09:26 - 2012-06-29 09:25 - 62620566 ____A C:\Users\Rene\Downloads\Chronos - The Grips Of Winter.zip
2012-06-29 09:26 - 2012-06-29 09:25 - 55971373 ____A C:\Users\Rene\Downloads\Chronos - Demo 2010.zip
2012-06-28 06:13 - 2012-06-28 05:12 - 109131386 ____A C:\Users\Rene\Downloads\Cult_Of_Luna-The_Beyond.rar
2012-06-24 04:54 - 2012-06-24 04:53 - 113573393 ____A C:\Users\Rene\Downloads\'Sans Souci' - HRR072D320MP3.zip
2012-06-24 04:18 - 2012-06-24 04:17 - 59833759 ____A C:\Users\Rene\Downloads\Bossk_Rinoa Split - EOSLP023 320 MO3.zip
2012-06-24 04:18 - 2012-06-24 04:17 - 27055033 ____A C:\Users\Rene\Downloads\Coloured Tongues_MFBT - HRR085D320MP3.zip
2012-06-19 10:26 - 2012-06-19 10:17 - 965612406 ____A C:\Users\Rene\Peaceful Solitude Mix - video.mp4
2012-06-18 08:44 - 2012-06-18 08:32 - 588432650 ____A C:\Users\Rene\Forgotten Dreams Mix - video.mp4
2012-06-18 07:15 - 2012-06-18 06:13 - 81408000 ____A C:\Users\Rene\Downloads\Godflesh_-_Slavestate.rar
2012-06-16 11:22 - 2012-06-16 10:56 - 46607244 ____A C:\Users\Rene\Downloads\Godflesh_-_Slateman-Cold_World.rar
2012-06-16 10:39 - 2012-06-16 09:57 - 74312197 ____A C:\Users\Rene\Downloads\Godflesh_-_Godflesh.rar
2012-06-16 06:24 - 2012-06-16 05:52 - 157026636 ____A C:\Users\Rene\Downloads\Beatles.avi
2012-06-14 08:54 - 2011-08-25 02:07 - 00466456 ____A (Creative Labs) C:\Windows\System32\wrap_oal.dll
2012-06-14 08:54 - 2011-08-25 02:07 - 00444952 ____A (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll
2012-06-14 08:54 - 2011-08-25 02:07 - 00122904 ____A (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\System32\OpenAL32.dll
2012-06-14 08:54 - 2011-08-25 02:07 - 00109080 ____A (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll
2012-06-11 19:08 - 2012-07-12 03:51 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-09 12:59 - 2012-06-09 12:21 - 469752501 ____A C:\Users\Rene\Downloads\pk.ras2.sc2.amanda.eliza.miranda.480p.mp4
2012-06-09 04:49 - 2012-06-09 04:30 - 35736662 ____A C:\Users\Rene\Downloads\ZAUM.rar
2012-06-08 21:43 - 2012-07-11 23:25 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-06-08 20:41 - 2012-07-11 23:25 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2012-06-08 06:03 - 2012-06-08 06:03 - 00362373 ____A C:\Users\Rene\Downloads\exifr300_e.zip
2012-06-07 10:14 - 2011-10-01 05:11 - 00280856 ____A C:\Windows\SysWOW64\PnkBstrB.xtr
2012-06-07 10:14 - 2011-09-05 12:39 - 00280856 ____A C:\Windows\SysWOW64\PnkBstrB.ex0
2012-06-07 10:13 - 2012-06-07 10:20 - 00280856 ____A C:\Windows\SysWOW64\PnkBstrB.exe
2012-06-05 22:06 - 2012-07-11 23:25 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-06-05 22:06 - 2012-07-11 23:25 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-06-05 22:02 - 2012-07-11 23:24 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll
2012-06-05 21:05 - 2012-07-11 23:25 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2012-06-05 21:05 - 2012-07-11 23:25 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2012-06-05 21:03 - 2012-07-11 23:24 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2012-06-02 14:19 - 2012-06-22 02:28 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-22 02:28 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-22 02:28 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-22 02:28 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-22 02:28 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:15 - 2012-06-22 02:28 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:15 - 2012-06-22 02:28 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 05:19 - 2012-06-22 02:28 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 05:15 - 2012-06-22 02:28 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-01 21:50 - 2012-07-11 23:25 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-06-01 21:48 - 2012-07-11 23:25 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-06-01 21:48 - 2012-07-11 23:25 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-06-01 21:45 - 2012-07-11 23:25 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-06-01 21:44 - 2012-07-11 23:25 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-06-01 20:40 - 2012-07-11 23:25 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2012-06-01 20:40 - 2012-07-11 23:25 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2012-06-01 20:39 - 2012-07-11 23:25 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2012-06-01 20:34 - 2012-07-11 23:25 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2012-05-22 11:52 - 2012-05-22 11:48 - 211927944 ____A (NVIDIA Corporation) C:\Users\Rene\Downloads\301.42-desktop-win7-winvista-64bit-international-whql.exe
2012-05-16 15:22 - 2012-05-16 15:22 - 00000706 ____A C:\Users\Rene\Desktop\cebhjkcwbe.txt
2012-05-16 09:13 - 2012-05-16 09:13 - 00001070 ____A C:\Users\Public\Desktop\VLC media player.lnk
2012-05-16 09:04 - 2012-05-16 09:04 - 22259528 ____A C:\Users\Rene\Downloads\vlc-2.0.1-win32.exe
2012-05-15 11:07 - 2011-08-23 01:23 - 00076160 ____A C:\Users\Rene\AppData\Local\GDIPFONTCACHEV1.DAT
2012-05-15 09:30 - 2012-05-15 09:30 - 00012793 ____A C:\Users\Rene\webscr.htm
2012-05-14 20:01 - 2012-06-14 05:14 - 01188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-14 19:59 - 2012-06-14 05:14 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-14 19:03 - 2012-06-14 05:14 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-05-14 19:00 - 2012-06-14 05:14 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-05-13 00:08 - 2012-05-13 00:07 - 00381608 ____A C:\Windows\Minidump\051312-27484-01.dmp
2012-05-13 00:07 - 2011-10-02 02:55 - 388100764 ____A C:\Windows\MEMORY.DMP
2012-05-04 23:12 - 2012-04-14 02:49 - 00419488 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-05-04 23:12 - 2011-08-23 06:23 - 00070304 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-05-04 03:06 - 2012-06-14 05:14 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-05-04 02:03 - 2012-06-14 05:14 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-05-04 02:03 - 2012-06-14 05:14 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-05-01 09:00 - 2012-01-27 06:32 - 00000000 ____A C:\Users\Rene\AppData\Local\Temptable.xml
2012-05-01 08:50 - 2012-05-01 08:50 - 00874496 ____A C:\Users\Rene\Downloads\Zeichnung1(1).SLDDRW
2012-05-01 08:50 - 2012-05-01 08:50 - 00745472 ____A C:\Users\Rene\Downloads\Zeichnung_Blatt(1).SLDDRW
2012-05-01 08:50 - 2012-05-01 08:50 - 00624619 ____A C:\Users\Rene\Downloads\Zeichnung_Blatt(1).DXF
2012-05-01 08:50 - 2012-05-01 08:50 - 00401410 ____A C:\Users\Rene\Downloads\Zifferblatt_Reinzeichnung(1).dxf
2012-04-28 08:11 - 2012-04-28 08:11 - 00000222 ____A C:\Users\Rene\Desktop\The Walking Dead.url
2012-04-27 19:55 - 2012-06-14 05:14 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-27 13:45 - 2012-04-27 13:45 - 00014680 ____A C:\Users\Rene\Documents\efw.rtf
2012-04-25 21:41 - 2012-06-14 05:14 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-25 21:41 - 2012-06-14 05:14 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-25 21:34 - 2012-06-14 05:14 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-23 21:37 - 2012-07-11 23:24 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-23 21:37 - 2012-07-11 23:24 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-23 21:37 - 2012-07-11 23:24 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-04-23 20:36 - 2012-07-11 23:24 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-04-23 20:36 - 2012-07-11 23:24 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-04-23 20:36 - 2012-07-11 23:24 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-04-19 21:42 - 2012-06-14 05:15 - 12297216 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-04-19 21:42 - 2012-06-14 05:15 - 09059840 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-04-19 21:42 - 2012-06-14 05:15 - 00735744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-04-19 21:42 - 2012-06-14 05:14 - 02454528 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-04-19 21:42 - 2012-06-14 05:14 - 01494016 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-04-19 21:42 - 2012-06-14 05:14 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-04-19 21:42 - 2012-06-14 05:14 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-04-19 21:42 - 2012-06-14 05:14 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-04-19 21:00 - 2012-06-14 05:14 - 01231360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-04-19 21:00 - 2012-06-14 05:14 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-04-19 20:57 - 2012-06-14 05:15 - 06027776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-04-19 20:57 - 2012-06-14 05:15 - 00627712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-04-19 20:57 - 2012-06-14 05:14 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-04-19 20:56 - 2012-06-14 05:15 - 11020800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-04-19 20:56 - 2012-06-14 05:14 - 02073600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-04-19 20:56 - 2012-06-14 05:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-04-19 19:45 - 2012-06-14 05:14 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-04-19 19:16 - 2012-06-14 05:14 - 01638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-04-19 07:05 - 2012-03-17 12:11 - 00002014 ____A C:\Users\Public\Desktop\Adobe Reader 9.lnk
2012-04-18 12:43 - 2012-04-18 12:43 - 00002267 ____A C:\Users\Rene\Documents\rgge.rtf
2012-04-14 14:02 - 2012-04-14 14:02 - 00224542 ____A C:\Users\Rene\skittles1.htm
2012-04-14 14:02 - 2012-04-14 14:02 - 00104014 ____A C:\Users\Rene\skittles2.htm
2012-04-14 04:09 - 2012-04-14 04:08 - 83414549 ____A C:\Users\Rene\Downloads\Decoder- Decoder (2011 CD Rip).zip

ZeroAccess:
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\@
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\L
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\00000001.@
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\80000000.@
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\800000cb.@

ZeroAccess:
C:\Users\Rene\AppData\Local\{fe12307a-d93b-c855-ecab-5fb11141fa17}
C:\Users\Rene\AppData\Local\{fe12307a-d93b-c855-ecab-5fb11141fa17}\@
C:\Users\Rene\AppData\Local\{fe12307a-d93b-c855-ecab-5fb11141fa17}\L
C:\Users\Rene\AppData\Local\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 24%
Total physical RAM: 3197.49 MB
Available physical RAM: 2427.68 MB
Total Pagefile: 3195.64 MB
Available Pagefile: 2420 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:116.41 GB) (Free:10.19 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: (Treiber) (Fixed) (Total:4.88 GB) (Free:2.21 GB) NTFS
3 Drive e: (BACKUP) (Fixed) (Total:107.91 GB) (Free:89.33 GB) NTFS
4 Drive f: (Volume) (Fixed) (Total:8.55 GB) (Free:8.46 GB) NTFS
5 Drive g: (Misc) (Fixed) (Total:195.31 GB) (Free:9.7 GB) NTFS
6 Drive h: (Musik) (Fixed) (Total:265.57 GB) (Free:5.84 GB) NTFS
8 Drive j: () (Removable) (Total:1.84 GB) (Free:1.84 GB) FAT
9 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 232 GB 8 MB
Datentr„ger 1 Online 465 GB 1024 KB
Datentr„ger 2 Online 1886 MB 0 B

Datentr„gerpartitionierung wird beendet...


==========================================================

Last Boot: 2012-07-08 10:31

======================= End Of Log ==========================

 

[Broni]

In Vista or Windows 7: Boot to System Recovery Options and run FRST.
In Windows XP: Please boot to UBCD and run FRST.
Type the following in the edit box after "Search:".

services.exe

Click Search button and post the log (Search.txt) it makes to your reply.

 

[sulpher]

Farbar Recovery Scan Tool Version: 11-07-2012
Ran by SYSTEM at 2012-07-13 10:17:02
Running from J:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06

====== End Of Search ======

 

[Broni]

Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Next....

Restart normally.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
• Close any open browsers.
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
• Double click on combofix.exe & follow the prompts.

• 
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.

• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe

• Double-click on the Rkill icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[sulpher]

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 11-07-2012
Ran by SYSTEM at 2012-07-14 12:28:36 Run:1
Running from J:\

==============================================

HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows No ZeroAccess entry found.
C:\Windows\System32\consrv.dll not found.
C:\Windows\Installer\{fe12307a-d93b-c855-ecab-5fb11141fa17} moved successfully.
C:\Users\Rene\AppData\Local\{fe12307a-d93b-c855-ecab-5fb11141fa17} moved successfully.
C:\Windows\System32\services.exe moved successfully.
C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe

==== End of Fixlog ====

 

[sulpher]

I deactivated avast "until next restart" before running combofix but combofix gives me a warning, that avast is still active and that I should deactivate it before clicking "ok"
but avast says it's deactivated
what now? :\

 

[sulpher]

ok, I managed to end the avast process in the task manager by unchecking in avast: Program Settings > Troubleshoot > Disable Avast self defense module.
task manager says avast is no longer active now
combofix still says it's active .... is that a false alarm from combofix?

 

[sulpher]

ok, I ran combofix after a restart and avast didn't start up because I disabled it before the restart. combofix tells me that avast is running - but that's impossiblle so I scanned nevertheless:

 

[sulpher]

ComboFix 12-07-13.03 - Rene 14.07.2012 12:43:40.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3197.2213 [GMT 2:00]
ausgeführt von:: c:\users\Rene\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Rene\342.jpg
c:\users\Rene\378656245-Dateien
c:\users\Rene\378656245-Dateien\1318634694165.gif
c:\users\Rene\378656245-Dateien\1328270403119s.jpg
c:\users\Rene\378656245-Dateien\1328272288150s.jpg
c:\users\Rene\378656245-Dateien\1328274727022s.jpg
c:\users\Rene\378656245-Dateien\1328275605394s.jpg
c:\users\Rene\378656245-Dateien\1328275759621s.jpg
c:\users\Rene\378656245-Dateien\1328275800826s.jpg
c:\users\Rene\378656245-Dateien\1328275878194s.jpg
c:\users\Rene\378656245-Dateien\1328275977379s.jpg
c:\users\Rene\378656245-Dateien\1328276051460s.jpg
c:\users\Rene\378656245-Dateien\1328276117316s.jpg
c:\users\Rene\378656245-Dateien\1328276301285s.jpg
c:\users\Rene\378656245-Dateien\1328276475013s.jpg
c:\users\Rene\378656245-Dateien\1328278905046s.jpg
c:\users\Rene\378656245-Dateien\1328279015936s.jpg
c:\users\Rene\378656245-Dateien\1328279429855s.jpg
c:\users\Rene\378656245-Dateien\1328279597932s.jpg
c:\users\Rene\378656245-Dateien\1328281026880s.jpg
c:\users\Rene\378656245-Dateien\1328281257502s.jpg
c:\users\Rene\378656245-Dateien\1328281738214s.jpg
c:\users\Rene\378656245-Dateien\apps1.js
c:\users\Rene\378656245-Dateien\audio.png
c:\users\Rene\378656245-Dateien\burichan.css
c:\users\Rene\378656245-Dateien\challenge
c:\users\Rene\378656245-Dateien\cloudflare.js
c:\users\Rene\378656245-Dateien\futaba.css
c:\users\Rene\378656245-Dateien\ga.js
c:\users\Rene\378656245-Dateien\help.png
c:\users\Rene\378656245-Dateien\image.jpg
c:\users\Rene\378656245-Dateien\jpn-flag.jpg
c:\users\Rene\378656245-Dateien\logo.png
c:\users\Rene\378656245-Dateien\quant.js
c:\users\Rene\378656245-Dateien\recaptcha.js
c:\users\Rene\378656245-Dateien\recaptcha_ajax.js
c:\users\Rene\378656245-Dateien\refresh.png
c:\users\Rene\378656245-Dateien\reload
c:\users\Rene\378656245-Dateien\script.js
c:\users\Rene\378656245-Dateien\tagline.png
c:\users\Rene\378656245-Dateien\text.png
c:\users\Rene\378656245-Dateien\yotsuba.css
c:\users\Rene\378656245-Dateien\yotsublue.css
c:\users\Rene\398173308-Dateien
c:\users\Rene\398173308-Dateien\1318633655994.png
c:\users\Rene\398173308-Dateien\1336392270380s.jpg
c:\users\Rene\398173308-Dateien\1336392385704s.jpg
c:\users\Rene\398173308-Dateien\1336392572943s.jpg
c:\users\Rene\398173308-Dateien\1336392678750s.jpg
c:\users\Rene\398173308-Dateien\1336392768990s.jpg
c:\users\Rene\398173308-Dateien\1336392880222s.jpg
c:\users\Rene\398173308-Dateien\1336393001622s.jpg
c:\users\Rene\398173308-Dateien\1336393017541s.jpg
c:\users\Rene\398173308-Dateien\1336393019165s.jpg
c:\users\Rene\398173308-Dateien\1336393031501s.jpg
c:\users\Rene\398173308-Dateien\1336393093921s.jpg
c:\users\Rene\398173308-Dateien\1336393226355s.jpg
c:\users\Rene\398173308-Dateien\1336393344943s.jpg
c:\users\Rene\398173308-Dateien\1336393424323s.jpg
c:\users\Rene\398173308-Dateien\1336393425678s.jpg
c:\users\Rene\398173308-Dateien\1336393444877s.jpg
c:\users\Rene\398173308-Dateien\1336393533354s.jpg
c:\users\Rene\398173308-Dateien\1336393542566s.jpg
c:\users\Rene\398173308-Dateien\1336393599134s.jpg
c:\users\Rene\398173308-Dateien\1336393673599s.jpg
c:\users\Rene\398173308-Dateien\1336393749961s.jpg
c:\users\Rene\398173308-Dateien\1336393928791s.jpg
c:\users\Rene\398173308-Dateien\1336393963156s.jpg
c:\users\Rene\398173308-Dateien\1336394012553s.jpg
c:\users\Rene\398173308-Dateien\1336394047223s.jpg
c:\users\Rene\398173308-Dateien\1336394089320s.jpg
c:\users\Rene\398173308-Dateien\1336394114514s.jpg
c:\users\Rene\398173308-Dateien\1336394164523s.jpg
c:\users\Rene\398173308-Dateien\1336394196905s.jpg
c:\users\Rene\398173308-Dateien\1336394286377s.jpg
c:\users\Rene\398173308-Dateien\1336394367872s.jpg
c:\users\Rene\398173308-Dateien\1336394391968s.jpg
c:\users\Rene\398173308-Dateien\1336394496897s.jpg
c:\users\Rene\398173308-Dateien\1336394587864s.jpg
c:\users\Rene\398173308-Dateien\1336394692577s.jpg
c:\users\Rene\398173308-Dateien\1336394789188s.jpg
c:\users\Rene\398173308-Dateien\1336394910913s.jpg
c:\users\Rene\398173308-Dateien\1336395018361s.jpg
c:\users\Rene\398173308-Dateien\1336395101973s.jpg
c:\users\Rene\398173308-Dateien\1336395183654s.jpg
c:\users\Rene\398173308-Dateien\1336395291525s.jpg
c:\users\Rene\398173308-Dateien\1336395390863s.jpg
c:\users\Rene\398173308-Dateien\1336395514295s.jpg
c:\users\Rene\398173308-Dateien\1336395526765s.jpg
c:\users\Rene\398173308-Dateien\1336395615377s.jpg
c:\users\Rene\398173308-Dateien\1336395707530s.jpg
c:\users\Rene\398173308-Dateien\1336395860348s.jpg
c:\users\Rene\398173308-Dateien\1336395894405s.jpg
c:\users\Rene\398173308-Dateien\1336396043396s.jpg
c:\users\Rene\398173308-Dateien\1336396116717s.jpg
c:\users\Rene\398173308-Dateien\1336396261878s.jpg
c:\users\Rene\398173308-Dateien\1336396387301s.jpg
c:\users\Rene\398173308-Dateien\1336396483632s.jpg
c:\users\Rene\398173308-Dateien\1336396670483s.jpg
c:\users\Rene\398173308-Dateien\1336396837412s.jpg
c:\users\Rene\398173308-Dateien\1336396864369s.jpg
c:\users\Rene\398173308-Dateien\1336396960837s.jpg
c:\users\Rene\398173308-Dateien\1336396997484s.jpg
c:\users\Rene\398173308-Dateien\1336397243108s.jpg
c:\users\Rene\398173308-Dateien\1336397460885s.jpg
c:\users\Rene\398173308-Dateien\1336397821010s.jpg
c:\users\Rene\398173308-Dateien\audio.png
c:\users\Rene\398173308-Dateien\burichan.css
c:\users\Rene\398173308-Dateien\challenge
c:\users\Rene\398173308-Dateien\cloudflare.js
c:\users\Rene\398173308-Dateien\futaba.css
c:\users\Rene\398173308-Dateien\ga.js
c:\users\Rene\398173308-Dateien\help.png
c:\users\Rene\398173308-Dateien\image.jpg
c:\users\Rene\398173308-Dateien\jpn-flag.gif
c:\users\Rene\398173308-Dateien\logo.png
c:\users\Rene\398173308-Dateien\quant.js
c:\users\Rene\398173308-Dateien\recaptcha.js
c:\users\Rene\398173308-Dateien\refresh.png
c:\users\Rene\398173308-Dateien\reload
c:\users\Rene\398173308-Dateien\reload_002
c:\users\Rene\398173308-Dateien\reload_003
c:\users\Rene\398173308-Dateien\reload_004
c:\users\Rene\398173308-Dateien\reload_005
c:\users\Rene\398173308-Dateien\reload_006
c:\users\Rene\398173308-Dateien\reload_007
c:\users\Rene\398173308-Dateien\reload_008
c:\users\Rene\398173308-Dateien\reload_009
c:\users\Rene\398173308-Dateien\reload_010
c:\users\Rene\398173308-Dateien\script.js
c:\users\Rene\398173308-Dateien\tagline.png
c:\users\Rene\398173308-Dateien\text.png
c:\users\Rene\398173308-Dateien\yotsuba.css
c:\users\Rene\398173308-Dateien\yotsublue.css
c:\users\Rene\6765.jpg
c:\users\Rene\6a0120a5f56aa0970c013488924df5970c-800wi.jpg
c:\users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum
c:\users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum\Live Security Platinum.lnk
c:\users\Rene\AppData\Roaming\trz4F16.tmp
c:\users\Rene\baaaaaaaaaaaaaaaart.jpg
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-06-14 bis 2012-07-14 ))))))))))))))))))))))))))))))
.
.
2012-07-14 10:51 . 2012-07-14 10:51 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-07-14 10:51 . 2012-07-14 10:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-14 10:03 . 2012-07-14 10:06 -------- d-----w- c:\windows\rescache
2012-07-13 16:44 . 2012-07-14 10:15 -------- d-----w- c:\programdata\0C1D146B00097B8A026961ECF875EF60
2012-07-13 02:14 . 2012-07-13 02:14 -------- d-----w- C:\FRST
2012-07-12 12:07 . 2012-07-03 16:21 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-07-12 11:51 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-12 11:13 . 2012-07-12 11:13 -------- d-----w- c:\users\Rene\AppData\Roaming\Malwarebytes
2012-07-12 11:13 . 2012-07-12 11:13 -------- d-----w- c:\programdata\Malwarebytes
2012-07-12 11:13 . 2012-07-03 11:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-12 11:13 . 2012-07-12 11:13 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-07-12 07:24 . 2012-04-24 05:37 1462272 ----a-w- c:\windows\system32\crypt32.dll
2012-07-10 14:00 . 2012-05-31 04:04 9013136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2B6E66C4-3262-4875-B3A0-5FE7DFA3D807}\mpengine.dll
2012-06-24 10:17 . 2012-06-24 10:17 -------- d-----w- c:\program files (x86)\OO Software
2012-06-22 10:28 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-22 10:28 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-22 10:28 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-22 10:28 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-22 10:28 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-22 10:28 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-22 10:28 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-22 10:28 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-22 10:28 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-17 11:41 . 2012-06-17 11:58 -------- d-----w- c:\users\Rene\Projektuhr
2012-06-14 16:54 . 2012-06-14 16:54 -------- d-----w- c:\users\Rene\AppData\Roaming\Waveform
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 16:21 . 2011-08-23 09:31 355856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-03 16:21 . 2011-08-23 09:31 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-03 16:21 . 2011-08-23 09:31 958400 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-03 16:21 . 2011-08-23 09:31 71064 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-07-03 16:21 . 2011-08-23 09:31 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-03 16:21 . 2011-08-23 09:30 41224 ----a-w- c:\windows\avastSS.scr
2012-07-03 16:21 . 2011-08-23 09:30 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-07-03 16:21 . 2011-08-23 09:31 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-06-14 16:54 . 2011-08-25 10:07 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2012-06-14 16:54 . 2011-08-25 10:07 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2012-06-14 16:54 . 2011-08-25 10:07 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2012-06-14 16:54 . 2011-08-25 10:07 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2012-06-07 18:14 . 2011-10-01 13:11 280856 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2012-06-07 18:14 . 2011-09-05 20:39 280856 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2012-06-07 18:13 . 2012-06-07 18:20 280856 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2012-05-05 07:12 . 2012-04-14 10:49 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-05 07:12 . 2011-08-23 14:23 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 196608]
"TBPanel"="c:\program files (x86)\Vtune\TBPanel.exe" [2011-03-11 2240512]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2008-08-03 36352]
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
EasySetPackage.lnk - c:\program files (x86)\LG Soft India\EasySetPackage\bin\EasySetPackage.exe [2011-8-23 159744]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [2011-01-08 87336]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-09-30 1431888]
R3 LGDDCDevice;LGDDCDevice;c:\windows\system32\LGI2CDriver.sys [x]
R3 LGII2CDevice;LGII2CDevice;c:\windows\system32\LGPII2CDriver.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-18 113120]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-09-24 1255736]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-07-03 71064]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-05-10 174184]
S3 RTL8023x64;Realtek 10/100-Netzwerkkartenfamilie-NDIS-x64-Treiber;c:\windows\system32\DRIVERS\Rtnic64.sys [2009-06-10 51712]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-08-16 12673128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.icq.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files (x86)\ICQ7.7\ICQ.exe
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\896b39mj.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.3&q=
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OOSAFEERASE04.00.00.01MSWINDOWS"="3BF85C04D507CB4F863D5B6FFD66C7A2001DE1C3B8C2068C6B959D8847443F580708A651D6A309897FD518F5DD929894B399FB57423B52B5CAE501B55CC528C397188399C0F54DAACFBC65C6DCD538E20C01B945E2EC6B8020B3B777870E9FD43CD789BE8E302C1AE4CBDD35A5D9CC3236F5D972919AB076F4894661AB975815FA5A2026AEA24B8161BDF09852E7936F0E7BEF47352811630555838C9D7F1952899586B9854466CE98B05D4BF272DCC7A7FAE12D2B9E93563FE81D952788BB9CD7634BE76832CD351529B9AB0D0B8CB0C8BF6B17C4AAD0A44678901E08972E4983835421232964A994FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6A0AC4980AC7933A6A0AC4980AC79335D575E7D6A3B980804F5B0660663ED9016E13E1C5A4D77982FC2E8D8825E38BBAF899545A3C6C8CDEB634B9B7AF5488B3BFA65353D10929AA014C6677EAB7AC2F6F29F2E2A6118093616C12910ACAB94463B0DE8021E08DFDF3D5E0AF4DC113C03399D2448F0CE2CF1065084046C04844D003D3A3C53E35C2D202AF1F562CEDADAE09C26261E9D459000B119373003E44A7A0520299DF9BA2A70A9C1B6C0C486EB47A924121FF71966A1A6C3B1079DF81B2FF507A702DF585FB9DD938C904A5807985B82FAC3179D2DE174D71B138D348376A44CB8166FC637D94F7274FDFA1FDE58C61C776B76FE0385E398C10ACE40AA7DABC3060647CA0380075E8EC8B6DD0EDE083CBE0BD61CE72AC043183624F619C42835D790C85F73B6154A9F459ECA8FD5BFA430ADBB0AC23FDB843575116B3D223C5A1F0A9AB0A2530C200EDB9B50433B128ACA6F6D8FDC080B7DD0BA6062E93D0D626ED828A08A0681BBE58AD78DEEE2A416B282F828621D26C54A8C9ED2D692C4717A791CC58ACF10EAD8DDC354BAF2A465332BAC8265E8096722051CE99CF4119C2179ECE6668657F3397D902BB267C009B7439E835CAC155E0051EE07B907237160FBCD85C554F90FFD21B6CCC60DAD06513725C21E7BAE9E2DB56F419242316C5A3A3ACF33B59E664513F1284C0923D4350ADD0AEA3DC00E16863CDEEA73F38256FD6FAC9EFD6E1B4EB5405FFA50DBE23C4F295AE1ADB3854E2FB4DCEEBAA91A3F2870B55B521A417CFB65C9EF2E9612E231A9E78A5CFA540C2EFEEB2D0E148EA3A98237A0AC5361D76F6770ABC019B64AECC797CC2D8B3B2815057117B6782D388AB0358ADA50760CAA1392117CAA19B7D3B18776585C72A089F106024FA0BA51E749E298FD4C706960F5A269A716F794CA540639696BA09747B8F3AACADAEE6B6F5DABAC0D86B3E3D2E4C762DBAB03EBCA6717A840B9E7531C8D3EAE6BF8F2256443AA1050C019925A76DB0A88BD6070E16072C08F4A56BC6AE9"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\02\00\05\0e:2?"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-07-14 13:01:12 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-07-14 11:01
.
Vor Suchlauf: 9 Verzeichnis(se), 11.494.875.136 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 11.661.484.032 Bytes frei
.
- - End Of File - - 36AFB2922C47636A69B759A0125755D4

 

[Broni]

Looks good

How is computer doing?

You can re-enable Avast now.

===============================================

Download Malwarebytes' Anti-Malware (MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
NOTE. If you already have MBAM installed, update it before running the scan.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer IF MBAM asks you to do so.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

==================================================

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click the Scan All Users checkbox.
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

 

[sulpher]

Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.12.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Rene :: CHRONOS [administrator]

Protection: Enabled

15.07.2012 11:17:49
mbam-log-2012-07-15 (11-17-49).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 230093
Time elapsed: 6 minute(s), 5 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Rene\Desktop\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Quarantined and deleted successfully.

(end)

 

[sulpher]

Thank you so much for your help!!!

After that quick scan the next quick scan didn't find any malware anymore. Is the system clean now?

 

[sulpher]

I scanned again - this time not quick scan but full scan. Found something again - but only in the quarantine folder of FRST. should those quarantined files get deleted somehow?


Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.15.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Rene :: CHRONOS [administrator]

Protection: Enabled

15.07.2012 14:24:07
mbam-log-2012-07-15 (14-24-07).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 137214
Time elapsed: 46 minute(s), 2 second(s) [aborted]

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\FRST\Quarantine\{fe12307a-d93b-c855-ecab-5fb11141fa17}\U\trz5CE2.tmp (Rootkit.0Access) -> Quarantined and deleted successfully.

(end)