Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


Log-Analyse und Auswertung: pdf aus gefälschter e-mail von "o2 telefonica" geöffnet

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Seite 1 von 2 1 2
Alt 12.07.2012, 00:11   #1
LaHzz
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


hallo!

ich habe trotteligerweise eine vermeintliche rechnung von "telefonica o2" für angebliche "zusatzdienstleistungen" geöffnet und fürchte nun, einen trojaner auf meinem rechner zu haben.

laut meinen recherchen (z.b. hxxp://www.virenguard.de/threads/vorsicht-mit-angeblichen-rechnungs-mails-von-telefonica-o2-germany.44/) sind dabei vor allem systeme mit älteren adobe-reader-versionen gefährdet. mein reader war zu dem zeitpunkt zwar aktuell, aber so ganz mag ich der sache nicht trauen, zumal in letzter zeit auch mein browser (opera, die neueste version) beim seitenscrollen stockte und eingebettete videos etwas mehr stotterten...

die suche mit diversen malwarescannern (avast antivirus, sophos virus remover, malwarebytes) war soweit erfolglos, aus deren perspektive scheint das system in ordnung zu sein.

im folgenden nun die logfiles von defogger und OTL. bei OTL besteht allerdings das problem, dass 1) die einstellung "extra-registrierung" bei start des quickscans immer wieder auf "aus" zurückspringt (ich also kein "extras"-logfile habe) und 2) das gleiche bei der einstellung "datei-alter" passiert - der vorfall ist leider schon mehr als 30 tage her (ich war in der zwischenzeit ohne computer außer landes und hab das problem aufgeschoben...). woran könnte das liegen?

gut, roman ende, nun die vorhandenen logs:


1. defogger disable:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:30 on 11/07/2012 (LaHzz)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


2. defogger enable:

defogger_enable by jpshortstuff (23.02.10.1)
Log created at 23:30 on 11/07/2012 (LaHzz)

Parsing file...


-=E.O.F=-


3. OTL quickscan (nur die letzten 30 tage...):

OTL logfile created on: 12.07.2012 00:33:40 - Run 8
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\LaHzz\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

5,90 Gb Total Physical Memory | 3,75 Gb Available Physical Memory | 63,54% Memory free
11,79 Gb Paging File | 9,38 Gb Available in Paging File | 79,57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 679,00 Gb Total Space | 370,67 Gb Free Space | 54,59% Space Free | Partition Type: NTFS
Drive D: | 2,11 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 931,51 Gb Total Space | 115,36 Gb Free Space | 12,38% Space Free | Partition Type: NTFS

Computer Name: LAHZZ-PC | User Name: LaHzz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\LaHzz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE ()
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE (SoftThinks - Dell)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
PRC - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
PRC - C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
PRC - C:\PROGRA~2\WinTV\TVServer\HAUPPA~1.EXE (Hauppauge Computer Works)


========== Modules (No Company Name) ==========

MOD - C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll ()
MOD - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (MySQL55) -- C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe ()
SRV:64bit: - (AMPPALR3) -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel Corporation)
SRV:64bit: - (EvtEng) Intel(R) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) Intel(R) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV:64bit: - (BTHSSecurityMgr) Intel(R) Centrino(R) Wireless Bluetooth(R) -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel(R) Corporation)
SRV:64bit: - (TurboBoost) Intel(R) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (AERTFilters) -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (Sony PC Companion) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe (Avanquest Software)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
SRV - (DragonSvc) -- C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe (Nuance Communications, Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (HauppaugeTVServer) -- C:\PROGRA~2\WinTV\TVServer\HAUPPA~1.EXE (Hauppauge Computer Works)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (nvkflt) -- C:\Windows\SysNative\drivers\nvkflt.sys (NVIDIA Corporation)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (RRNetCapMP) -- C:\Windows\SysNative\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV:64bit: - (RRNetCap) -- C:\Windows\SysNative\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV:64bit: - (tbhsd) -- C:\Windows\SysNative\drivers\tbhsd.sys (RapidSolution Software AG)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (AMPPALP) -- C:\Windows\SysNative\drivers\AmpPal.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (AMPPAL) -- C:\Windows\SysNative\drivers\AmpPal.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (NETwNs64) ___ Intel(R) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (iwdbus) -- C:\Windows\SysNative\drivers\iwdbus.sys (Intel Corporation)
DRV:64bit: - (intaud_WaveExtensible) -- C:\Windows\SysNative\drivers\intelaud.sys (Intel Corporation)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics)
DRV:64bit: - (NvStUSB) -- C:\Windows\SysNative\drivers\nvstusb.sys ()
DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys (Intel(R) Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel(R) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (s1039mdm) -- C:\Windows\SysNative\drivers\s1039mdm.sys (MCCI Corporation)
DRV:64bit: - (s1039unic) Sony Ericsson Device 1039 USB Ethernet Emulation (WDM) -- C:\Windows\SysNative\drivers\s1039unic.sys (MCCI Corporation)
DRV:64bit: - (s1039mgmt) Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM) -- C:\Windows\SysNative\drivers\s1039mgmt.sys (MCCI Corporation)
DRV:64bit: - (s1039obex) -- C:\Windows\SysNative\drivers\s1039obex.sys (MCCI Corporation)
DRV:64bit: - (s1039nd5) Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS) -- C:\Windows\SysNative\drivers\s1039nd5.sys (MCCI Corporation)
DRV:64bit: - (s1039mdfl) -- C:\Windows\SysNative\drivers\s1039mdfl.sys (MCCI Corporation)
DRV:64bit: - (s1039bus) Sony Ericsson Device 1039 driver (WDM) -- C:\Windows\SysNative\drivers\s1039bus.sys (MCCI Corporation)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (hcw17bda) -- C:\Windows\SysNative\drivers\hcw17bda.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE:64bit: - HKLM\..\SearchScopes\{D256AAB8-C681-4219-9470-DCF803B76A89}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE - HKLM\..\SearchScopes\{D256AAB8-C681-4219-9470-DCF803B76A89}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE - HKCU\..\SearchScopes\{3805E92B-14DB-44DC-BF7F-3F8DA19128C9}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{4C1513CC-1598-4BF1-BB36-6D53C9C69775}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{94EF8E66-42E2-4911-9798-CEDDCAEF17BB}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{A3E4DF99-0B9F-45ED-9C30-241B964AA304}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\LaHzz\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\LaHzz\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\LaHzz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\LaHzz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.07.08 02:07:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.22 16:02:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

[2012.03.07 14:46:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Extensions
[2012.03.07 14:46:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2012.03.07 14:46:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Sunbird\Profiles\4i6rirx8.default\extensions
[2011.10.03 06:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.26 20:49:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.
O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] c:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DNS7reminder] C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - Startup: C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\LaHzz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.191.92.87 62.109.123.6
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B0A42A4D-BDF2-4925-AE5B-33FFEDE5887F}: DhcpNameServer = 213.191.92.87 62.109.123.6
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.06.14 01:36:09 | 000,000,037 | RH-- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2009.09.29 19:37:31 | 000,000,067 | ---- | M] () - F:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\Shell - "" = AutoRun
O33 - MountPoints2\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\Shell\AutoRun\command - "" = F:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.12 00:32:27 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\LaHzz\Desktop\OTL.exe
[2012.07.11 19:25:01 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\Desktop\Trojaner
[2012.07.06 14:33:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.07.06 13:41:14 | 000,000,000 | ---D | C] -- C:\Breaking Bad
[2012.07.06 12:51:34 | 000,000,000 | ---D | C] -- C:\The King's Speech
[2012.07.04 17:49:08 | 000,000,000 | ---D | C] -- C:\cdex_151
[2012.07.04 14:15:50 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MP3Gain
[2012.07.04 14:15:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MP3Gain
[2012.07.04 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MP3Gain
[2012.06.29 21:59:21 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\Documents\Sony
[2012.06.29 21:58:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2012.06.29 21:57:49 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Local\Sony
[2012.06.29 21:57:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony
[2012.06.29 21:57:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony
[2012.06.17 13:34:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.17 13:34:25 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.17 13:34:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.06.17 11:04:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Sophos
[2012.06.17 11:03:31 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
[2012.06.17 11:03:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos
[2012.06.17 09:32:00 | 000,000,000 | ---D | C] -- C:\Sherlock1
[2012.06.16 23:17:54 | 000,000,000 | ---D | C] -- C:\Sherlock
[2012.06.16 18:00:49 | 000,000,000 | ---D | C] -- C:\Cheyenne
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.07.12 00:32:29 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\LaHzz\Desktop\OTL.exe
[2012.07.12 00:16:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-76685547-4292423041-290503021-1001UA.job
[2012.07.12 00:01:20 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.12 00:01:20 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.11 23:52:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.11 23:52:32 | 453,640,191 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.11 23:42:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.11 13:41:23 | 000,015,399 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-11.hrf
[2012.07.11 13:09:05 | 000,001,730 | ---- | M] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2012.07.11 13:09:05 | 000,001,203 | ---- | M] () -- C:\Users\LaHzz\Desktop\Downloads.lnk
[2012.07.11 13:09:05 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.07.11 13:03:17 | 000,000,850 | ---- | M] () -- C:\Users\LaHzz\.recently-used.xbel
[2012.07.11 11:01:31 | 000,000,422 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job
[2012.07.11 10:16:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-76685547-4292423041-290503021-1001Core.job
[2012.07.11 09:41:51 | 005,041,504 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.10 21:10:00 | 000,015,399 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-10.hrf
[2012.07.09 20:30:27 | 000,015,209 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-09.hrf
[2012.07.08 15:34:59 | 000,015,206 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-08.hrf
[2012.07.08 02:07:33 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.07.06 10:33:35 | 000,015,751 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-06.hrf
[2012.07.06 10:27:16 | 000,000,564 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2012.07.05 18:16:43 | 000,015,809 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-05.hrf
[2012.07.04 17:43:00 | 001,645,230 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.04 17:43:00 | 000,708,406 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.04 17:43:00 | 000,661,962 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.04 17:43:00 | 000,153,602 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.04 17:43:00 | 000,125,790 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.04 14:45:27 | 000,015,807 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-04.hrf
[2012.07.04 14:43:44 | 000,000,797 | ---- | M] () -- C:\Users\LaHzz\Desktop\aktuelle Bewerbungen.lnk
[2012.07.03 18:21:52 | 000,958,400 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2012.07.03 18:21:52 | 000,355,856 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2012.07.03 18:21:52 | 000,071,064 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012.07.03 18:21:52 | 000,059,728 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2012.07.03 18:21:52 | 000,054,072 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2012.07.03 18:21:51 | 000,025,232 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012.07.03 18:21:32 | 000,041,224 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.07.03 18:21:28 | 000,227,648 | ---- | M] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2012.07.03 18:21:18 | 000,285,328 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2012.07.03 15:59:19 | 000,015,620 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-03.hrf
[2012.06.30 23:10:30 | 000,015,614 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-30.hrf
[2012.06.29 14:44:58 | 000,015,233 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-29.hrf
[2012.06.27 17:33:43 | 000,015,044 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-27.hrf
[2012.06.23 20:42:47 | 000,015,229 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-23.hrf
[2012.06.22 10:09:14 | 000,015,410 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-22.hrf
[2012.06.20 15:42:01 | 000,015,376 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-20.hrf
[2012.06.19 16:37:29 | 000,050,477 | ---- | M] () -- C:\Users\LaHzz\Desktop\Defogger.exe
[2012.06.19 10:48:55 | 000,015,188 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-19.hrf
[2012.06.18 16:55:20 | 000,015,188 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-18.hrf
[2012.06.18 16:15:37 | 000,001,595 | ---- | M] () -- C:\Users\LaHzz\AppData\Roaming\SAS7_000.DAT
[2012.06.17 16:39:40 | 000,015,181 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-17.hrf
[2012.06.17 13:34:27 | 000,001,107 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.17 11:03:31 | 000,003,205 | ---- | M] () -- C:\Users\LaHzz\Desktop\Sophos Virus Removal Tool.lnk
[2012.06.16 21:01:52 | 000,014,997 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-16.hrf
[2012.06.15 11:15:47 | 000,015,375 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-15.hrf
[2012.06.14 11:53:22 | 000,015,406 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-14.hrf
[2012.06.13 01:12:58 | 000,015,406 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-13.hrf
[2012.06.12 20:12:37 | 000,015,405 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-12.hrf
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.07.11 23:26:29 | 000,050,477 | ---- | C] () -- C:\Users\LaHzz\Desktop\Defogger.exe
[2012.07.11 13:41:23 | 000,015,399 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-11.hrf
[2012.07.11 13:03:17 | 000,000,850 | ---- | C] () -- C:\Users\LaHzz\.recently-used.xbel
[2012.07.11 09:40:40 | 005,041,504 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.10 00:10:18 | 000,015,399 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-10.hrf
[2012.07.09 20:30:27 | 000,015,209 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-09.hrf
[2012.07.08 02:26:32 | 000,015,206 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-08.hrf
[2012.07.06 10:33:35 | 000,015,751 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-06.hrf
[2012.07.05 18:16:43 | 000,015,809 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-05.hrf
[2012.07.04 14:45:27 | 000,015,807 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-04.hrf
[2012.07.04 14:43:44 | 000,000,797 | ---- | C] () -- C:\Users\LaHzz\Desktop\aktuelle Bewerbungen.lnk
[2012.07.03 15:59:19 | 000,015,620 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-03.hrf
[2012.06.30 20:32:27 | 000,015,614 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-30.hrf
[2012.06.29 01:55:23 | 000,015,233 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-29.hrf
[2012.06.27 17:33:43 | 000,015,044 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-27.hrf
[2012.06.23 20:42:47 | 000,015,229 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-23.hrf
[2012.06.22 01:15:44 | 000,015,410 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-22.hrf
[2012.06.20 15:42:01 | 000,015,376 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-20.hrf
[2012.06.19 10:48:55 | 000,015,188 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-19.hrf
[2012.06.18 16:55:20 | 000,015,188 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-18.hrf
[2012.06.17 16:39:40 | 000,015,181 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-17.hrf
[2012.06.17 13:34:27 | 000,001,107 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.17 11:03:31 | 000,003,205 | ---- | C] () -- C:\Users\LaHzz\Desktop\Sophos Virus Removal Tool.lnk
[2012.06.16 21:01:52 | 000,014,997 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-16.hrf
[2012.06.15 09:30:01 | 000,015,375 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-15.hrf
[2012.06.14 11:53:22 | 000,015,406 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-14.hrf
[2012.06.13 01:12:58 | 000,015,406 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-13.hrf
[2012.06.12 15:42:20 | 000,685,859 | ---- | C] () -- C:\Users\LaHzz\Desktop\VOC0004 (2).WMA
[2012.06.12 11:57:58 | 000,015,405 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-12.hrf
[2012.06.06 18:42:36 | 000,007,597 | ---- | C] () -- C:\Users\LaHzz\AppData\Local\Resmon.ResmonCfg
[2012.03.07 17:54:02 | 000,000,132 | ---- | C] () -- C:\Users\LaHzz\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2012.01.21 19:44:07 | 000,000,132 | ---- | C] () -- C:\Users\LaHzz\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012.01.01 14:25:27 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2011.12.18 12:40:55 | 000,917,325 | ---- | C] () -- C:\Users\LaHzz\.fonts.cache-1
[2011.12.03 18:25:41 | 000,000,093 | ---- | C] () -- C:\Users\LaHzz\AppData\Local\fusioncache.dat
[2011.12.02 18:50:49 | 000,033,169 | ---- | C] () -- C:\Windows\Irremote.ini
[2011.12.02 18:50:28 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.12.02 18:50:27 | 000,000,418 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2011.12.02 18:50:09 | 000,142,337 | ---- | C] () -- C:\Windows\SysWow64\Wait.exe
[2011.12.02 18:45:20 | 000,006,082 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2011.11.04 11:24:42 | 000,001,595 | ---- | C] () -- C:\Users\LaHzz\AppData\Roaming\SAS7_000.DAT
[2011.10.27 18:36:06 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011.10.27 18:35:22 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.10.27 18:35:20 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.10.27 18:35:19 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2011.10.27 18:35:18 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.10.27 18:35:16 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.02.11 12:22:50 | 001,623,124 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

========== LOP Check ==========

[2012.04.18 20:52:22 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\1&1 Mail & Media GmbH
[2011.11.09 00:46:46 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Ableton
[2012.03.28 13:50:44 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\com.Rhapsody.Napster5
[2011.12.29 16:15:32 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\DeepBurner
[2012.07.11 23:54:16 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Dropbox
[2012.04.02 20:21:34 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\FileZilla
[2011.11.04 10:44:01 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Fingertapps
[2011.12.04 13:11:02 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\FOG Downloader
[2012.03.08 13:56:07 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\FreePDF
[2012.05.31 22:59:06 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\gtk-2.0
[2012.03.31 16:50:59 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\hdbADS
[2012.01.15 22:46:55 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\inkscape
[2012.01.15 00:00:03 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\IrfanView
[2012.04.28 16:11:38 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\KompoZer
[2011.11.08 19:59:59 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\LibreOffice
[2012.03.31 18:31:01 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\MySQL
[2011.11.04 11:06:23 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Nuance
[2011.11.12 15:45:12 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\OpenOffice.org
[2012.07.11 12:11:09 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Opera
[2011.11.09 00:17:30 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Propellerhead Software
[2011.11.11 19:33:47 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\SecondLife
[2012.07.11 23:51:49 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\SoftGrid Client
[2012.07.11 23:05:32 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Spotify
[2011.11.08 03:06:42 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Thunderbird
[2011.11.04 11:26:31 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\TP
[2011.11.12 11:05:29 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\ZinioReader4
[2011.12.20 00:16:26 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\{90140011-0066-0407-0000-0000000FF1CE}
[2012.07.06 10:27:16 | 000,000,564 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2012.06.18 09:29:53 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.07.11 11:01:31 | 000,000,422 | ---- | M] () -- C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 235 bytes -> C:\ProgramData\Temp:0FF263E8
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:B606BA34

< End of report >


ich hoffe, das hat trotz der OTL-probleme schon ein wenig aussagekraft. vielen dank schon jetzt für jede art von hilfe jedenfalls!

viele grüße!
lars

Alt 13.07.2012, 09:04   #2
kira
/// Helfer-Team
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


Hallo und Herzlich Willkommen!

Kontrolliere deine eigene Dateien (wie Dokumente, Musik, Bilder etc), ob der Trojaner sie nicht eventuell verschlüsselt hat?!
► Welche Art und Weise wurden die Daten (Eigene Dateien wie Bilder, Dokumente, Musik etc) bereits verschlüsselt? Kannst Du ein Beispiel nennen? Dateiändung wurden zugefügt (z.B "locked- .wxyz"), oder nach einem Zufallsprinzip besteht ein Dateiname aus Groß und Kleinbuchstaben (wie z.B QsEEUTODXNVqyssQ) andere?
Nämlich manche Varianten lassen sich entschlüsseln, andere wieder leider nicht..

wenn ja, die folgenden Tipps bitte folgen:
Vorgehen beim Verschlüsselungs-Trojaner :-> http://www.trojaner-board.de/114783-...ubersicht.html

am besten:
(Während der Aktion den Rechner vom Internet und Netzwerk trennen!)
-> Daten wiederherstellen mit ShadowExplorer
zur Info:
-> Systemabbild

-> Was ist ein Systemabbild?
-> Wiederherstellen des Computers von einer Systemabbildsicherung
kann ich Dir nur viel Glück wünschen
auf jeden Fall melde dich und berichte ob es Dir gelingen ist die Daten wieder herzustellen?

damit das nochmal nicht passiert, wie vermeide ich Datenverlust:
► Da sieht man wieder einmal wie wichtig ist, um die regelmäßige Sicherung (wichtigen Daten) zu kümmern
Denk daran: dein Hauptsystem ist doch kein Lagerhalle!
Wichtige Daten Regelmäßig sichern, am besten 2x an verschiedenen Orten!
- Externe Geräte (Festplatte USB-Stick etc) nicht ständig am PC anschließen, sondern nur kurzfristig während Du etwas sichern möchtest
E-Mail-Anhang - Öffne keine E-Mail-Anhänge (Attachments), wenn du den Absender nicht kennst!
-> Links und Anhang nicht anklicken,, Mails als Text oder in Druckversion anzeigen lassen. Mailprogramm grundsätzlich so einstellen

gruß
kira
__________________

__________________
Alt 13.07.2012, 17:30   #3
LaHzz
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


hey kira!

erst einmal vielen dank für die schnelle antwort!

verschlüsselte dateien kann ich - weder in den von dir genannten noch in anderen ordnern - bislang keine vorfinden. daten habe ich auch bisher keine verloren. meines wissens (-> google) handelt es sich bei der o2-fake-rechnung (das ist es ja überhaupt, ich bekomme meine o2-rechnungen per mail, der absender war auf den ersten blick gar nicht unbekannt...) nicht um einen verschlüsselungs- sondern eher um einen banking-trojaner, der eine sicherheitslücke in älteren adobe-reader-versionen ausnutzt. meine reader-version war zwar zu der zeit aktuell, aber mag ja sein, dass auch trojaner neuen umständen angepasst werden...

gibt es denn chancen, einen trojaner solcher art (falls er überhaupt vorhanden ist), im system aufzuspüren? und kann man das beschriebene seltsame verhalten von OTL (also: die bei scanstart immer wieder zurückspringenden einstellungen) irgendwie abstellen, sodass auch daten zur zeit der möglichen infektion vorhanden sind?

vielen dank, und viele grüße!!
lars
__________________
Alt 14.07.2012, 10:35   #4
kira
/// Helfer-Team
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


Zitat:
Zitat von LaHzz Beitrag anzeigen
gibt es denn chancen, einen trojaner solcher art (falls er überhaupt vorhanden ist), im system aufzuspüren?
können wir gerne versuchen:

► Erster Teil des 3-teiligen Verfahren, werden wir dein System auf Viren untersuchen, bzw nach einem anderen Verursacher suchen:
Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Lade Dir Malwarebytes Anti-Malware Lade Dir Malwarebytes Anti-Malware → von hier herunter
  • Installieren und per Doppelklick starten.
  • Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
  • "Komplett Scan durchführen" wählen (überall Haken setzen)
  • wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
  • Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
  • Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"
eine bebilderte Anleitung findest Du hier: Anleitung

2.
erneut einen Systemscan mit OTL
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

3.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
  • Download den CCleaner herunter
  • Software-Lizenzvereinbarung lesen, falls irgendeine Toolbar angeboten wird, bitte abwählen!-> starten -> Falls nötig, auf "Deutsch" einstellen.
  • starten-> klick auf `Extras` (um auf deinem System installierte Software zu anzeigen)-> dann auf `Als Textdatei speichern...`
  • ein Textdatei wird automatisch erstellt, poste auch dieses Logfile (also die Liste alle installierten Programme...eine Textdatei)

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw
gruß
kira
__________________

Warnung!:
Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein!
Anhang nicht öffnen, in unserem Forum erst nachfragen!
Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten!
Bitte diese Warnung weitergeben, wo Du nur kannst!
Alt 15.07.2012, 19:39   #5
LaHzz
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


oh, die code-tags hatte ich bei der ersten mail vergessen und einfach den ganzen text reingeschmissen, tut mir leid...

sollte mir nun aber gelungen sein. hab deine anleitung durchgearbeitet und folgende ergebnisse erhalten:


1. malwarebytes (hat soweit nix gefunden):

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.15.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
LaHzz :: LAHZZ-PC [Administrator]

15.07.2012 19:19:36
mbam-log-2012-07-15 (19-19-36).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 441949
Laufzeit: 52 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


2. OTL:

a) otl.txt
OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 15.07.2012 20:17:15 - Run 9
OTL by OldTimer - Version 3.2.46.1     Folder = C:\Users\LaHzz\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,90 Gb Total Physical Memory | 3,37 Gb Available Physical Memory | 57,10% Memory free
11,79 Gb Paging File | 9,12 Gb Available in Paging File | 77,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 679,00 Gb Total Space | 363,30 Gb Free Space | 53,50% Space Free | Partition Type: NTFS
 
Computer Name: LAHZZ-PC | User Name: LaHzz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Users\LaHzz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\LaHzz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE ()
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE (SoftThinks - Dell)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
PRC - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
PRC - C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
PRC - C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe ()
PRC - C:\PROGRA~2\WinTV\TVServer\HAUPPA~1.EXE (Hauppauge Computer Works)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\ca2eff60beb3ba00a529a2d42dceca22\UIAutomationProvider.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\2ec98ab0193d64e95b7d09d094deed97\Accessibility.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll ()
MOD - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (MySQL55) -- C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe ()
SRV:64bit: - (AMPPALR3) -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel Corporation)
SRV:64bit: - (EvtEng) Intel(R) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) Intel(R) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV:64bit: - (BTHSSecurityMgr) Intel(R) Centrino(R) Wireless Bluetooth(R) -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel(R) Corporation)
SRV:64bit: - (TurboBoost) Intel(R) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation)
SRV:64bit: - (Mcx2Svc) -- C:\Windows\SysNative\Mcx2Svc.dll (Microsoft Corporation)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (AERTFilters) -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (RemoteAccess) -- C:\Windows\SysNative\mprdim.dll (Microsoft Corporation)
SRV:64bit: - (SharedAccess) -- C:\Windows\SysNative\ipnathlp.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (Sony PC Companion) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe (Avanquest Software)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
SRV - (DragonSvc) -- C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe (Nuance Communications, Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (RemoteAccess) -- C:\Windows\SysWOW64\mprdim.dll (Microsoft Corporation)
SRV - (HauppaugeTVServer) -- C:\PROGRA~2\WinTV\TVServer\HAUPPA~1.EXE (Hauppauge Computer Works)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_64) -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (nvkflt) -- C:\Windows\SysNative\drivers\nvkflt.sys (NVIDIA Corporation)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (RRNetCapMP) -- C:\Windows\SysNative\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV:64bit: - (RRNetCap) -- C:\Windows\SysNative\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV:64bit: - (tbhsd) -- C:\Windows\SysNative\drivers\tbhsd.sys (RapidSolution Software AG)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (AMPPALP) -- C:\Windows\SysNative\drivers\AmpPal.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (AMPPAL) -- C:\Windows\SysNative\drivers\AmpPal.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (NETwNs64) ___ Intel(R) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (iwdbus) -- C:\Windows\SysNative\drivers\iwdbus.sys (Intel Corporation)
DRV:64bit: - (intaud_WaveExtensible) -- C:\Windows\SysNative\drivers\intelaud.sys (Intel Corporation)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics)
DRV:64bit: - (NvStUSB) -- C:\Windows\SysNative\drivers\nvstusb.sys ()
DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys (Intel(R) Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (udfs) -- C:\Windows\SysNative\drivers\udfs.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel(R) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (s1039mdm) -- C:\Windows\SysNative\drivers\s1039mdm.sys (MCCI Corporation)
DRV:64bit: - (s1039unic) Sony Ericsson Device 1039 USB Ethernet Emulation (WDM) -- C:\Windows\SysNative\drivers\s1039unic.sys (MCCI Corporation)
DRV:64bit: - (s1039mgmt) Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM) -- C:\Windows\SysNative\drivers\s1039mgmt.sys (MCCI Corporation)
DRV:64bit: - (s1039obex) -- C:\Windows\SysNative\drivers\s1039obex.sys (MCCI Corporation)
DRV:64bit: - (s1039nd5) Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS) -- C:\Windows\SysNative\drivers\s1039nd5.sys (MCCI Corporation)
DRV:64bit: - (s1039mdfl) -- C:\Windows\SysNative\drivers\s1039mdfl.sys (MCCI Corporation)
DRV:64bit: - (s1039bus) Sony Ericsson Device 1039 driver (WDM) -- C:\Windows\SysNative\drivers\s1039bus.sys (MCCI Corporation)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (crcdisk) -- C:\Windows\SysNative\drivers\crcdisk.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ws2ifsl) -- C:\Windows\SysNative\drivers\ws2ifsl.sys (Microsoft Corporation)
DRV:64bit: - (cdfs) -- C:\Windows\SysNative\drivers\cdfs.sys (Microsoft Corporation)
DRV:64bit: - (hcw17bda) -- C:\Windows\SysNative\drivers\hcw17bda.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE:64bit: - HKLM\..\SearchScopes\{D256AAB8-C681-4219-9470-DCF803B76A89}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE - HKLM\..\SearchScopes\{D256AAB8-C681-4219-9470-DCF803B76A89}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE - HKCU\..\SearchScopes\{3805E92B-14DB-44DC-BF7F-3F8DA19128C9}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{4C1513CC-1598-4BF1-BB36-6D53C9C69775}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{94EF8E66-42E2-4911-9798-CEDDCAEF17BB}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{A3E4DF99-0B9F-45ED-9C30-241B964AA304}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\LaHzz\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\LaHzz\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\LaHzz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\LaHzz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.07.08 02:07:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.13 19:48:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.12 08:04:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.22 16:02:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.03.07 14:46:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Extensions
[2012.03.07 14:46:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2012.07.14 19:51:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Firefox\Profiles\aruwtym7.default\extensions
[2012.07.13 19:51:30 | 000,000,000 | ---D | M] (FoxTrick) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Firefox\Profiles\aruwtym7.default\extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba}
[2012.03.07 14:46:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Sunbird\Profiles\4i6rirx8.default\extensions
[2012.07.13 19:48:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.06.15 00:19:07 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.03 06:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.26 20:49:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.06.15 00:46:57 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.15 00:46:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.15 00:46:57 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.15 00:46:57 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.15 00:46:57 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.15 00:46:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.
O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] c:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DNS7reminder] C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - Startup: C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\LaHzz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.109.123.197 213.191.74.19
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B0A42A4D-BDF2-4925-AE5B-33FFEDE5887F}: DhcpNameServer = 62.109.123.197 213.191.74.19
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\Shell - "" = AutoRun
O33 - MountPoints2\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\Shell\AutoRun\command - "" = F:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 60 Days ==========
 
[2012.07.15 20:13:48 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\LaHzz\Desktop\OTL.exe
[2012.07.13 19:52:38 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Local\Macromedia
[2012.07.13 19:48:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.07.13 19:48:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.07.12 19:25:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
[2012.07.12 19:24:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Comodo
[2012.07.12 19:23:45 | 001,700,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gdiplus.dll
[2012.07.12 01:22:53 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.07.12 01:22:53 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.07.12 01:22:52 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.07.12 01:22:52 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.07.12 01:22:51 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.07.12 01:22:51 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.07.12 01:22:51 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.07.12 01:22:51 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.07.12 01:22:50 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.07.12 01:22:50 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.07.12 01:22:50 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.07.12 01:22:50 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.07.12 01:22:49 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.07.12 00:02:15 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012.07.12 00:02:15 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012.07.12 00:02:12 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.07.12 00:02:05 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.07.12 00:02:04 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.07.11 19:25:01 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\Desktop\Trojaner
[2012.07.07 19:02:09 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2012.07.06 14:33:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.07.06 13:41:14 | 000,000,000 | ---D | C] -- C:\Breaking Bad
[2012.07.06 12:51:34 | 000,000,000 | ---D | C] -- C:\The King's Speech
[2012.07.04 17:49:08 | 000,000,000 | ---D | C] -- C:\cdex_151
[2012.07.04 14:15:50 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MP3Gain
[2012.07.04 14:15:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MP3Gain
[2012.07.04 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MP3Gain
[2012.06.29 21:59:21 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\Documents\Sony
[2012.06.29 21:58:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2012.06.29 21:57:49 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Local\Sony
[2012.06.29 21:57:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony
[2012.06.29 21:57:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony
[2012.06.23 09:45:17 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012.06.23 09:45:17 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012.06.23 09:45:17 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012.06.23 09:45:06 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012.06.23 09:45:06 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012.06.23 09:45:06 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012.06.23 09:44:51 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012.06.23 09:44:51 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2012.06.17 13:34:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.17 13:34:25 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.17 13:34:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.06.17 11:04:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Sophos
[2012.06.17 11:03:31 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
[2012.06.17 11:03:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos
[2012.06.17 09:32:00 | 000,000,000 | ---D | C] -- C:\Sherlock1
[2012.06.16 23:17:54 | 000,000,000 | ---D | C] -- C:\Sherlock
[2012.06.16 18:00:49 | 000,000,000 | ---D | C] -- C:\Cheyenne
[2012.06.14 11:16:47 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll
[2012.06.14 11:16:47 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll
[2012.06.14 11:16:47 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe
[2012.06.14 11:16:40 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.06.14 11:16:40 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.06.14 11:16:39 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.06.14 11:16:29 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll
[2012.06.14 11:16:27 | 001,462,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.06.14 11:16:26 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.06.06 15:07:50 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Roaming\Malwarebytes
[2012.06.06 15:07:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.05 21:27:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.06.05 21:27:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2012.06.05 21:21:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2012.05.30 15:26:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audials 9
[2012.05.29 12:50:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler
[2012.05.29 12:50:35 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler
[2012.05.18 18:23:46 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hauppauge WinTV
[2012.05.18 18:23:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hauppauge WinTV
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 60 Days ==========
 
[2012.07.15 20:16:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-76685547-4292423041-290503021-1001UA.job
[2012.07.15 19:42:24 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.15 19:07:50 | 000,015,191 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-15.hrf
[2012.07.15 11:01:34 | 000,000,422 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job
[2012.07.15 10:16:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-76685547-4292423041-290503021-1001Core.job
[2012.07.15 08:28:09 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.15 08:28:09 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.15 08:19:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.15 08:19:44 | 453,640,191 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.14 22:15:35 | 000,017,980 | ---- | M] () -- C:\Users\LaHzz\Desktop\Document 1.rns
[2012.07.14 21:33:56 | 035,280,172 | ---- | M] () -- C:\Users\LaHzz\Desktop\Document 1.wav
[2012.07.14 20:50:53 | 000,015,375 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-14.hrf
[2012.07.14 17:38:04 | 000,021,313 | ---- | M] () -- C:\Users\LaHzz\Desktop\2012-07-14 Rendered.aif.asd
[2012.07.14 17:38:03 | 001,615,930 | ---- | M] () -- C:\Users\LaHzz\Desktop\2012-07-14 Rendered.aif
[2012.07.14 16:57:33 | 000,025,769 | ---- | M] () -- C:\Users\LaHzz\Desktop\2012-07-14 Rendered.wav.asd
[2012.07.14 16:57:32 | 002,116,844 | ---- | M] () -- C:\Users\LaHzz\Desktop\2012-07-14 Rendered.wav
[2012.07.14 16:40:00 | 001,645,230 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.14 16:40:00 | 000,708,406 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.14 16:40:00 | 000,661,962 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.14 16:40:00 | 000,153,602 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.14 16:40:00 | 000,125,790 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.14 13:51:18 | 000,001,107 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.13 19:48:10 | 000,001,128 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.07.13 19:10:52 | 000,015,586 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-13.hrf
[2012.07.13 00:25:01 | 000,014,892 | ---- | M] () -- C:\Users\LaHzz\Desktop\9518-B0ACEBF47B32F740DA27D2E8DD3CD355.pdf
[2012.07.12 19:23:45 | 001,700,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\gdiplus.dll
[2012.07.12 19:14:46 | 000,015,399 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-12.hrf
[2012.07.12 18:46:06 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.07.12 18:46:06 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.07.12 09:58:01 | 005,041,504 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.11 13:41:23 | 000,015,399 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-11.hrf
[2012.07.11 13:09:05 | 000,001,730 | ---- | M] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2012.07.11 13:09:05 | 000,001,203 | ---- | M] () -- C:\Users\LaHzz\Desktop\Downloads.lnk
[2012.07.11 13:09:05 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.07.11 13:03:17 | 000,000,850 | ---- | M] () -- C:\Users\LaHzz\.recently-used.xbel
[2012.07.10 21:10:00 | 000,015,399 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-10.hrf
[2012.07.09 20:30:27 | 000,015,209 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-09.hrf
[2012.07.08 15:34:59 | 000,015,206 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-08.hrf
[2012.07.08 02:07:33 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.07.06 10:33:35 | 000,015,751 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-06.hrf
[2012.07.06 10:27:16 | 000,000,564 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2012.07.05 18:16:43 | 000,015,809 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-05.hrf
[2012.07.04 14:45:27 | 000,015,807 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-04.hrf
[2012.07.04 14:43:44 | 000,000,797 | ---- | M] () -- C:\Users\LaHzz\Desktop\aktuelle Bewerbungen.lnk
[2012.07.03 18:21:52 | 000,958,400 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2012.07.03 18:21:52 | 000,355,856 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2012.07.03 18:21:52 | 000,071,064 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012.07.03 18:21:52 | 000,059,728 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2012.07.03 18:21:52 | 000,054,072 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2012.07.03 18:21:51 | 000,025,232 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012.07.03 18:21:32 | 000,041,224 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.07.03 18:21:28 | 000,227,648 | ---- | M] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2012.07.03 18:21:18 | 000,285,328 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2012.07.03 15:59:19 | 000,015,620 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-03.hrf
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.30 23:10:30 | 000,015,614 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-30.hrf
[2012.06.29 14:44:58 | 000,015,233 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-29.hrf
[2012.06.27 17:33:43 | 000,015,044 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-27.hrf
[2012.06.23 20:42:47 | 000,015,229 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-23.hrf
[2012.06.22 10:09:14 | 000,015,410 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-22.hrf
[2012.06.20 15:42:01 | 000,015,376 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-20.hrf
[2012.06.19 10:48:55 | 000,015,188 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-19.hrf
[2012.06.18 16:55:20 | 000,015,188 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-18.hrf
[2012.06.18 16:15:37 | 000,001,595 | ---- | M] () -- C:\Users\LaHzz\AppData\Roaming\SAS7_000.DAT
[2012.06.17 16:39:40 | 000,015,181 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-17.hrf
[2012.06.17 11:03:31 | 000,003,205 | ---- | M] () -- C:\Users\LaHzz\Desktop\Sophos Virus Removal Tool.lnk
[2012.06.16 21:01:52 | 000,014,997 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-16.hrf
[2012.06.15 11:15:47 | 000,015,375 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-15.hrf
[2012.06.14 11:53:22 | 000,015,406 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-14.hrf
[2012.06.13 01:12:58 | 000,015,406 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-13.hrf
[2012.06.12 20:12:37 | 000,015,405 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-12.hrf
[2012.06.11 18:25:54 | 000,015,567 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-11.hrf
[2012.06.10 13:35:54 | 000,015,564 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-10.hrf
[2012.06.09 13:54:06 | 000,015,566 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-09.hrf
[2012.06.08 20:48:18 | 000,015,583 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-08.hrf
[2012.06.08 08:07:36 | 000,685,859 | ---- | M] () -- C:\Users\LaHzz\Desktop\VOC0004 (2).WMA
[2012.06.07 17:44:46 | 000,015,582 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-07.hrf
[2012.06.06 18:42:36 | 000,007,597 | ---- | M] () -- C:\Users\LaHzz\AppData\Local\Resmon.ResmonCfg
[2012.06.06 15:36:09 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\LaHzz\Desktop\OTL.exe
[2012.06.06 13:04:10 | 000,015,398 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-06.hrf
[2012.06.06 11:06:01 | 000,001,053 | ---- | M] () -- C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012.06.06 08:02:54 | 001,133,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.06.06 07:03:06 | 000,805,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.06.05 22:21:36 | 000,015,397 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-05.hrf
[2012.06.04 21:42:10 | 000,015,416 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-04.hrf
[2012.06.03 00:19:46 | 000,038,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012.06.03 00:19:42 | 000,057,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012.06.03 00:19:42 | 000,044,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012.06.03 00:19:23 | 000,701,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012.06.03 00:15:31 | 002,622,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012.06.03 00:15:08 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012.06.02 15:19:42 | 000,186,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012.06.02 15:15:12 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2012.06.02 14:12:17 | 002,311,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.06.02 14:04:50 | 001,494,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.06.02 14:04:25 | 000,237,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.06.02 14:01:40 | 000,173,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.06.02 14:00:33 | 000,818,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.06.02 13:57:36 | 000,096,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.06.02 13:54:06 | 000,248,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.06.02 10:25:03 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.06.02 10:23:26 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.06.02 10:20:33 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.06.02 10:19:58 | 000,716,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.06.02 10:17:15 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.06.02 10:14:19 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.06.02 07:44:21 | 000,307,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.06.01 07:52:29 | 000,014,871 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-01.hrf
[2012.05.30 19:36:08 | 000,014,877 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-05-30.hrf
[2012.05.29 21:16:33 | 000,014,240 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-05-29.hrf
[2012.05.29 18:50:56 | 000,000,132 | ---- | M] () -- C:\Users\LaHzz\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012.05.28 11:28:10 | 000,014,808 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-05-28.hrf
[2012.05.27 19:22:04 | 000,014,807 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-05-27.hrf
[2012.05.26 12:30:57 | 000,014,746 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-05-26.hrf
[2012.05.25 08:07:28 | 000,014,745 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-05-25.hrf
[2012.05.23 23:45:24 | 000,014,739 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-05-23.hrf
[2012.05.20 02:52:23 | 000,014,381 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-05-20.hrf
[2012.05.18 20:41:52 | 000,014,586 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-05-18.hrf
[2012.05.18 18:23:46 | 000,033,169 | ---- | M] () -- C:\Windows\Irremote.ini
[2012.05.18 18:23:24 | 000,000,418 | ---- | M] () -- C:\Windows\ODBCINST.INI
[2012.05.18 18:23:24 | 000,000,135 | ---- | M] () -- C:\Windows\ODBC.INI
[2012.05.18 18:23:08 | 000,006,082 | ---- | M] () -- C:\Windows\HCWPNP.INI
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.15 19:07:50 | 000,015,191 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-15.hrf
[2012.07.14 20:03:27 | 035,280,172 | ---- | C] () -- C:\Users\LaHzz\Desktop\Document 1.wav
[2012.07.14 18:00:08 | 000,017,980 | ---- | C] () -- C:\Users\LaHzz\Desktop\Document 1.rns
[2012.07.14 17:38:03 | 001,615,930 | ---- | C] () -- C:\Users\LaHzz\Desktop\2012-07-14 Rendered.aif
[2012.07.14 17:38:03 | 000,021,313 | ---- | C] () -- C:\Users\LaHzz\Desktop\2012-07-14 Rendered.aif.asd
[2012.07.14 16:57:32 | 002,116,844 | ---- | C] () -- C:\Users\LaHzz\Desktop\2012-07-14 Rendered.wav
[2012.07.14 16:57:32 | 000,025,769 | ---- | C] () -- C:\Users\LaHzz\Desktop\2012-07-14 Rendered.wav.asd
[2012.07.14 00:45:05 | 000,015,375 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-14.hrf
[2012.07.13 19:48:10 | 000,001,140 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.07.13 19:48:10 | 000,001,128 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.07.13 00:30:58 | 000,015,586 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-13.hrf
[2012.07.13 00:25:01 | 000,014,892 | ---- | C] () -- C:\Users\LaHzz\Desktop\9518-B0ACEBF47B32F740DA27D2E8DD3CD355.pdf
[2012.07.12 01:20:08 | 000,015,399 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-12.hrf
[2012.07.11 13:41:23 | 000,015,399 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-11.hrf
[2012.07.11 13:03:17 | 000,000,850 | ---- | C] () -- C:\Users\LaHzz\.recently-used.xbel
[2012.07.11 09:40:40 | 005,041,504 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.10 00:10:18 | 000,015,399 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-10.hrf
[2012.07.09 20:30:27 | 000,015,209 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-09.hrf
[2012.07.08 02:26:32 | 000,015,206 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-08.hrf
[2012.07.06 10:33:35 | 000,015,751 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-06.hrf
[2012.07.05 18:16:43 | 000,015,809 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-05.hrf
[2012.07.04 14:45:27 | 000,015,807 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-04.hrf
[2012.07.04 14:43:44 | 000,000,797 | ---- | C] () -- C:\Users\LaHzz\Desktop\aktuelle Bewerbungen.lnk
[2012.07.03 15:59:19 | 000,015,620 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-03.hrf
[2012.06.30 20:32:27 | 000,015,614 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-30.hrf
[2012.06.29 01:55:23 | 000,015,233 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-29.hrf
[2012.06.27 17:33:43 | 000,015,044 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-27.hrf
[2012.06.23 20:42:47 | 000,015,229 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-23.hrf
[2012.06.22 01:15:44 | 000,015,410 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-22.hrf
[2012.06.20 15:42:01 | 000,015,376 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-20.hrf
[2012.06.19 10:48:55 | 000,015,188 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-19.hrf
[2012.06.18 16:55:20 | 000,015,188 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-18.hrf
[2012.06.17 16:39:40 | 000,015,181 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-17.hrf
[2012.06.17 13:34:27 | 000,001,107 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.17 11:03:31 | 000,003,205 | ---- | C] () -- C:\Users\LaHzz\Desktop\Sophos Virus Removal Tool.lnk
[2012.06.16 21:01:52 | 000,014,997 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-16.hrf
[2012.06.15 09:30:01 | 000,015,375 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-15.hrf
[2012.06.14 11:53:22 | 000,015,406 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-14.hrf
[2012.06.13 01:12:58 | 000,015,406 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-13.hrf
[2012.06.12 15:42:20 | 000,685,859 | ---- | C] () -- C:\Users\LaHzz\Desktop\VOC0004 (2).WMA
[2012.06.12 11:57:58 | 000,015,405 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-12.hrf
[2012.06.11 18:25:54 | 000,015,567 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-11.hrf
[2012.06.10 13:35:54 | 000,015,564 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-10.hrf
[2012.06.09 13:54:06 | 000,015,566 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-09.hrf
[2012.06.08 08:11:33 | 000,015,583 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-08.hrf
[2012.06.07 17:44:46 | 000,015,582 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-07.hrf
[2012.06.06 18:42:36 | 000,007,597 | ---- | C] () -- C:\Users\LaHzz\AppData\Local\Resmon.ResmonCfg
[2012.06.06 09:56:22 | 000,015,398 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-06.hrf
[2012.06.05 21:21:46 | 000,002,096 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
[2012.06.05 20:19:51 | 000,015,397 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-05.hrf
[2012.06.04 21:42:10 | 000,015,416 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-04.hrf
[2012.06.01 07:52:29 | 000,014,871 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-01.hrf
[2012.05.30 11:49:11 | 000,014,877 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-05-30.hrf
[2012.05.29 20:04:51 | 000,014,240 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-05-29.hrf
[2012.05.29 12:50:36 | 000,001,730 | ---- | C] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2012.05.28 11:28:10 | 000,014,808 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-05-28.hrf
[2012.05.27 02:06:10 | 000,014,807 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-05-27.hrf
[2012.05.26 12:30:57 | 000,014,746 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-05-26.hrf
[2012.05.25 08:07:28 | 000,014,745 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-05-25.hrf
[2012.05.23 10:53:13 | 000,014,739 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-05-23.hrf
[2012.05.20 02:52:23 | 000,014,381 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-05-20.hrf
[2012.05.18 09:33:01 | 000,014,586 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-05-18.hrf
[2012.03.07 17:54:02 | 000,000,132 | ---- | C] () -- C:\Users\LaHzz\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2012.01.21 19:44:07 | 000,000,132 | ---- | C] () -- C:\Users\LaHzz\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012.01.01 14:25:27 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2011.12.03 18:25:41 | 000,000,093 | ---- | C] () -- C:\Users\LaHzz\AppData\Local\fusioncache.dat
[2011.12.02 18:50:49 | 000,033,169 | ---- | C] () -- C:\Windows\Irremote.ini
[2011.12.02 18:50:28 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.12.02 18:50:27 | 000,000,418 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2011.12.02 18:50:09 | 000,142,337 | ---- | C] () -- C:\Windows\SysWow64\Wait.exe
[2011.12.02 18:45:20 | 000,006,082 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2011.11.04 11:24:42 | 000,001,595 | ---- | C] () -- C:\Users\LaHzz\AppData\Roaming\SAS7_000.DAT
[2011.10.27 18:36:06 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011.10.27 18:35:22 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.10.27 18:35:20 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.10.27 18:35:19 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2011.10.27 18:35:18 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.10.27 18:35:16 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.02.11 12:22:50 | 001,623,124 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 235 bytes -> C:\ProgramData\Temp:0FF263E8
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:B606BA34

< End of report >
--- --- ---


b) extras.txt

OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 15.07.2012 20:17:15 - Run 9
OTL by OldTimer - Version 3.2.46.1     Folder = C:\Users\LaHzz\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,90 Gb Total Physical Memory | 3,37 Gb Available Physical Memory | 57,10% Memory free
11,79 Gb Paging File | 9,12 Gb Available in Paging File | 77,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 679,00 Gb Total Space | 363,30 Gb Free Space | 53,50% Space Free | Partition Type: NTFS
 
Computer Name: LAHZZ-PC | User Name: LaHzz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = DragonHTML] -- "C:\Program Files (x86)\Comodo\Dragon\dragon.exe" -- "%1"
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = DragonHTML] -- "C:\Program Files (x86)\Comodo\Dragon\dragon.exe" -- "%1"
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files (x86)\Comodo\Dragon\dragon.exe" -- "%1"
https [open] -- "C:\Program Files (x86)\Comodo\Dragon\dragon.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Comodo\Dragon\dragon.exe" -- "%1"
https [open] -- "C:\Program Files (x86)\Comodo\Dragon\dragon.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03E03E3D-25AF-4006-B7C6-B16050F27C97}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{0501D775-D4AB-48C2-9554-378999DABC51}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{0B2C487A-FC9C-4B33-AAAA-54B61375ABA2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2A60CADF-5BAD-432C-AE6D-07BBDB955850}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{2DA1FAFE-212E-4DD2-AF5D-C4F39DAD542C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{663ED1E5-2C2D-42D5-8885-3681F51451F1}" = lport=31931 | protocol=6 | dir=in | name=audials localhttpserver 31931 | 
"{6AB632CB-BA01-4B46-9BC3-F525E2D4504F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{70882CFB-3571-454C-93BA-396A387F7501}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{7DDA2C1E-4775-4587-8E72-1C9900310A2D}" = lport=12972 | protocol=6 | dir=in | name=audials localhttpserver 12972 | 
"{A52416F5-47B6-45FB-B711-A1AD5968A088}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B10B552F-69AA-48B0-AD2F-DE42FBE2F8E9}" = lport=14714 | protocol=6 | dir=in | name=audials localhttpserver 14714 | 
"{B60A0C8E-AEEF-4E37-9516-8EEBA4AFB1F0}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{BEB6C398-9C2A-4938-8F14-FDFF47F82946}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D2D8B130-B579-4217-8803-646968CE6964}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{E92F8486-CC54-4130-8393-1B628A6EBDE5}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{EF041308-F65C-4032-8AF6-510B734219AD}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02C72949-D522-47D3-8A6C-D239918AB077}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{08D5AF8B-04CB-49DD-AB13-3DA06328CC61}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grand theft auto iv episodes from liberty city\eflc\launcheflc.exe | 
"{08F06A42-5131-44FD-90DA-44DB11C9B116}" = dir=in | app=c:\program files (x86)\rapidsolution\audials 9\audials.exe | 
"{0E2FB9FA-6527-49C4-8D26-B26EC31CE48A}" = protocol=6 | dir=in | app=c:\users\lahzz\appdata\roaming\spotify\spotify.exe | 
"{10C50E34-40F9-47C8-9FBD-D4049AC6741E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{1126BF93-4968-4B83-8577-1C1645AA7D8B}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe | 
"{2492BEDC-B5AA-4540-A322-0A25AE8A9D6F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\launchgtaiv.exe | 
"{29EE49AD-44AC-4FFF-8A42-6CF7C79C6818}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\oblivion\oblivionlauncher.exe | 
"{2A0BE726-633D-4B6E-AE08-94530222295B}" = protocol=6 | dir=in | app=c:\users\lahzz\appdata\roaming\spotify\spotify.exe | 
"{2A926773-C2F0-4FAF-BAC5-35A3E7B57D50}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{3081302F-090C-4FF1-9993-7930C220D941}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grand theft auto iv episodes from liberty city\eflc\launcheflc.exe | 
"{38F4E2BB-47D8-4315-AA27-3CE3C03FE647}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{422AC1FC-C783-4B61-AAE4-E4AD3C9FB16E}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{42A2906E-2289-4119-9371-802D345FDCD2}" = protocol=17 | dir=in | app=c:\users\lahzz\appdata\roaming\spotify\spotify.exe | 
"{4A0264A5-9265-414F-842E-0604A1DFACF2}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{4F215699-FFCB-4E6E-9AC6-A003A4D5997D}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{503C5F75-1424-41E5-B3BA-A5E2226D3D67}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{51A1B2D2-D1A1-4478-9158-D809F3DA3DB5}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{549E005C-0BE4-4793-BAAD-A054C2BC41BE}" = protocol=6 | dir=in | app=c:\users\lahzz\appdata\roaming\dropbox\bin\dropbox.exe | 
"{55094661-0CC1-4992-9CFB-69905F3CFFF9}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{58846385-5A22-4E37-B7A3-5F9472AE9978}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{5D342C33-0177-4ECB-84B5-967410F55866}" = protocol=17 | dir=in | app=c:\users\lahzz\appdata\roaming\spotify\spotify.exe | 
"{691EA05A-C748-4C8B-B0FE-CF46450B8B73}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{698F65EF-C98A-4FAC-9D4F-A3B1F1D2F23C}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{75EC6079-B96C-4AF7-80E3-2AF924091863}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{856A3689-A9E7-43F4-9758-7E8A21F213B9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{8589AB71-AB29-4023-8F84-41D64A85DC66}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{8B8D7A70-CFFA-4A13-A404-5D4F264149FC}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{9B297FB2-E5CC-4C93-9910-5FC6F38F9A78}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\oblivion\oblivionlauncher.exe | 
"{9FCC83DA-AC09-4863-97A3-96F95B52E812}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{A5F7444E-DCA5-460F-9E5D-C2119815CB6A}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{A90360AB-7D58-4804-9844-EF06ABE8D2E0}" = protocol=6 | dir=out | app=system | 
"{BD767E7E-F810-4C41-9A3F-6ED5B3E45AE9}" = protocol=6 | dir=in | app=c:\users\lahzz\appdata\local\google\google talk plugin\googletalkplugin.exe | 
"{BF787445-5C5A-4FE6-A641-BAB0963F2B59}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{C1739F8D-B061-42BF-AB08-BE5459C07471}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{C9F23511-8138-4CA9-BF03-C1864F09B4F4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{CC24031A-BE44-4B23-8A89-E8B26FDD9DAD}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{D387BBC0-9E59-43C0-9013-A36223524F90}" = protocol=17 | dir=in | app=c:\users\lahzz\appdata\roaming\dropbox\bin\dropbox.exe | 
"{DFE7769D-1076-48D9-91FF-FCB5890A2C88}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{E3B2DF12-25A3-4A04-8452-9B6D37F5FA5F}" = protocol=17 | dir=in | app=c:\users\lahzz\appdata\local\google\google talk plugin\googletalkplugin.exe | 
"{EA3DF377-917F-40B9-8688-63B4689E9828}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{F04E6A7C-C2E7-43B5-8FC2-6D323BF1E87D}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | 
"{F24A970B-8735-4A09-B7CA-AE242B2E5F4A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\launchgtaiv.exe | 
"{F8960EF0-08AA-42AB-9AA5-C6089D472AA5}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F9E91CE8-267A-4D88-B374-F1890FBA3ED1}" = dir=in | app=c:\program files (x86)\intel corporation\intel widi\widiapp.exe | 
"{FC1CB314-45F7-4A8B-B967-2C4323EEB44C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{FE7B26B6-EE75-46AB-9FE5-2823CFB47916}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"TCP Query User{2F337C01-E2C6-48DF-8EE0-02053760EBB7}C:\users\lahzz\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\lahzz\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{47C9F8D3-7F75-4AC4-983D-5C42967C30BF}C:\users\lahzz\downloads\runes_of_magic_4_0_5_2467_eu_full.exe" = protocol=6 | dir=in | app=c:\users\lahzz\downloads\runes_of_magic_4_0_5_2467_eu_full.exe | 
"TCP Query User{666C7895-BEFF-4DCE-B5A1-D6D4DBA29F02}C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe | 
"TCP Query User{79A9B4E0-A728-42F6-8503-861A31592EEF}C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe | 
"TCP Query User{8977E979-6DFD-49D9-A335-5DAB5D1638C9}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | 
"TCP Query User{936BFA29-F432-4C4A-B8A8-75D18D098570}C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe | 
"TCP Query User{C34644ED-7422-4869-918A-F989796E0F01}C:\program files (x86)\steam\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe | 
"TCP Query User{C9DB32E7-CB75-495A-828F-268CBE9FF6E3}C:\program files (x86)\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"UDP Query User{0A68EEC3-E06E-4040-A127-15EB8D6B8EAB}C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe | 
"UDP Query User{0E23EEDC-C304-453B-8ED8-BB90FF722BF1}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | 
"UDP Query User{514035C9-1310-4DC5-AACE-82B762C18ADD}C:\program files (x86)\steam\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grand theft auto iv episodes from liberty city\eflc\eflc.exe | 
"UDP Query User{7B40BEF7-5CA2-4B2F-A59F-6670711E1372}C:\users\lahzz\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\lahzz\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{8CEBBED9-4948-4521-B771-53395052EAD8}C:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\turbine\der herr der ringe online\lotroclient.exe | 
"UDP Query User{BE17A347-4565-4026-BF51-807B99C7C6CD}C:\users\lahzz\downloads\runes_of_magic_4_0_5_2467_eu_full.exe" = protocol=17 | dir=in | app=c:\users\lahzz\downloads\runes_of_magic_4_0_5_2467_eu_full.exe | 
"UDP Query User{FAE7F532-CC4C-4435-B1CA-0FA9EE9B1A6A}C:\program files (x86)\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"UDP Query User{FC917CF8-A092-42CA-89A3-73EA9EF31932}C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{25FBDA9A-E868-4B3B-B9FF-D923818511A1}" = Intel(R) PROSet/Wireless WiFi-Software
"{26A24AE4-039D-4CA4-87B4-2F86416027FF}" = Java(TM) 6 Update 27 (64-bit)
"{28EF7372-9087-4AC3-9B9F-D9751FCDF830}" = Intel(R) Wireless Display
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4A5A427F-BA39-4BF0-7777-9A47FBE60C9F}" = Visual C++ 9.0 Runtime for Dragon NaturallySpeaking 64bit (x64)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{90BF0360-A1DB-4599-A643-95AB90A52C1E}" = Microsoft_VC90_MFCLOC_x86_x64
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 296.10
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.12.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}" = Überwachungstool für die Intel® Turbo-Boost-Technik 2.0
"{C29568FB-A922-4341-90BF-D66E8BA040F1}" = MySQL Server 5.5
"{C44218B2-EC4D-4EB9-A3E3-F8F4A46927EC}" = MySQL Connector/ODBC 5.1
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"Dell Support Center" = Dell Support Center
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"ProInst" = Intel PROSet Wireless
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinGimp-2.0_is1" = GIMP 2.6.8
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0DD706AF-B542-438C-999E-B30C7F625C8D}" = Intel(R) WiDi
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 29
"{2B652926-DA25-4CE1-BD07-62354D672D03}" = Audials
"{2C9EE786-1DDB-4C98-8FA4-B1B9B5A66B77}" = Microsoft Games for Windows - LIVE
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{455D9FD3-2AB6-44E0-BF49-B9E13911401A}" = MySQL Workbench 5.2 CE
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{820B6609-4C97-3A2B-B644-573B06A0F0CC}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{87434D51-51DB-4109-B68F-A829ECDCF380}" = AccelerometerP11
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{9158FF30-78D7-40EF-B83E-451AC5334640}" = Adobe Photoshop CS5.1
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{975C3A93-2491-3D44-A071-F6CBF153E46D}" = Google Talk Plugin
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AB9FC2F9-7FC7-11D7-9D82-00065BABCB42}" = Reason
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X (10.1.3) MUI
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2C3BB6B-E005-4246-B8E5-DF0A4D073CDC}" = PixiePack Codec Pack
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B829E117-D072-41EA-9606-9826A38D34C1}" = Sophos Virus Removal Tool
"{B9A129AB-CA6B-4CD1-B55C-792722E2B947}" = MySQL Installer
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EFFA53BC-8C04-2E21-3D90-A13B1697B0CA}" = Dragon NaturallySpeaking 11
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.065
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"12bbe590-c890-11d9-9669-0800200c9a66_is1" = Der Herr der Ringe Online v03.03.05.8039
"Ableton Live_is1" = Ableton Live v6.0.7
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"ASIO4ALL" = ASIO4ALL
"AudibleManager" = AudibleManager
"avast" = avast! Free Antivirus
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"DVD Shrink_is1" = DVD Shrink 3.2
"FileZilla Client" = FileZilla Client 3.5.3
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 9.04" = GPL Ghostscript
"Hattrick Organizer" = Hattrick Organizer (remove only)
"Hauppauge WinTV 7" = Hauppauge WinTV 7
"Inkscape" = Inkscape 0.48.2
"IrfanView" = IrfanView (remove only)
"Klavierakkorde_is1" = Klavierakkorde 1.4.0
"LastFM_is1" = Last.fm 1.5.4.27091
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"Mozilla Thunderbird 13.0.1 (x86 de)" = Mozilla Thunderbird 13.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"ProInst" = Intel PROSet Wireless
"Steam App 12210" = Grand Theft Auto IV
"Steam App 22330" = The Elder Scrolls IV: Oblivion 
"VLC media player" = VLC media player 2.0.2
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"bd4d3a0508d364f5" = Dell Driver Download Manager
"Dropbox" = Dropbox
"Spotify" = Spotify
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 29.06.2012 07:05:53 | Computer Name = LaHzz-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 29.06.2012 08:23:14 | Computer Name = LaHzz-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 30.06.2012 02:20:28 | Computer Name = LaHzz-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 30.06.2012 04:56:13 | Computer Name = LaHzz-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 30.06.2012 09:18:53 | Computer Name = LaHzz-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 30.06.2012 09:29:23 | Computer Name = LaHzz-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  (Patch task for {90140011-0066-0407-0000-0000000FF1CE}):
 DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar.
 Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

 
Error - 01.07.2012 03:40:30 | Computer Name = LaHzz-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.07.2012 13:00:01 | Computer Name = LaHzz-PC | Source = Windows Backup | ID = 4103
Description = 
 
Error - 02.07.2012 04:24:56 | Computer Name = LaHzz-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 03.07.2012 02:27:23 | Computer Name = LaHzz-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 12.07.2012 04:33:55 | Computer Name = LaHzz-PC | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus
 lautet: 107.
 
Error - 12.07.2012 04:33:55 | Computer Name = LaHzz-PC | Source = Schannel | ID = 36874
Description = Eine SSL 3.0-Verbindungsanforderung wurde von einer Remoteclientanwendung
 übermittelt, jedoch werden keine der Verschlüsselungssammlungen, die von der Clientanwendung
 unterstützt werden, vom Server unterstützt. Fehler bei der SSL-Verbindungsanforderung.
 
Error - 12.07.2012 04:33:55 | Computer Name = LaHzz-PC | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus
 lautet: 107.
 
Error - 12.07.2012 04:33:55 | Computer Name = LaHzz-PC | Source = Schannel | ID = 36874
Description = Eine SSL 3.0-Verbindungsanforderung wurde von einer Remoteclientanwendung
 übermittelt, jedoch werden keine der Verschlüsselungssammlungen, die von der Clientanwendung
 unterstützt werden, vom Server unterstützt. Fehler bei der SSL-Verbindungsanforderung.
 
Error - 12.07.2012 04:33:55 | Computer Name = LaHzz-PC | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus
 lautet: 107.
 
Error - 13.07.2012 11:41:22 | Computer Name = LaHzz-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?13.?07.?2012 um 08:33:24 unerwartet heruntergefahren.
 
Error - 13.07.2012 11:43:45 | Computer Name = LaHzz-PC | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Client Virtualization Handler" wurde nicht richtig gestartet.
 
Error - 13.07.2012 11:43:45 | Computer Name = LaHzz-PC | Source = Service Control Manager | ID = 7022
Description = Der Dienst "HauppaugeTVServer" wurde nicht richtig gestartet.
 
Error - 14.07.2012 07:53:06 | Computer Name = LaHzz-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 HauppaugeTVServer erreicht.
 
Error - 14.07.2012 07:53:06 | Computer Name = LaHzz-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "HauppaugeTVServer" wurde aufgrund folgenden Fehlers nicht
 gestartet:   %%1053
 
 
< End of report >
--- --- ---


3. CCleaner:

Code:
ATTFilter
7-Zip 9.20 (x64 edition)	Igor Pavlov	02.04.2012	4,53MB	9.20.00.0
Ableton Live v6.0.7	AiR, Inc.	20.11.2011		
AccelerometerP11	STMicroelectronics	27.10.2011		2.00.11.22
Adobe AIR	Adobe Systems Incorporated	28.03.2012		3.2.0.2070
Adobe Community Help	Adobe Systems Incorporated.	30.12.2011		3.4.980
Adobe Flash Player 11 ActiveX	Adobe Systems Incorporated	12.07.2012	6,00MB	11.3.300.265
Adobe Flash Player 11 Plugin	Adobe Systems Incorporated	12.07.2012	6,00MB	11.3.300.265
Adobe Photoshop CS5.1	Adobe Systems Incorporated	30.12.2011	2,94GB	12.1
Adobe Reader X (10.1.3) MUI	Adobe Systems Incorporated	11.04.2012	479MB	10.1.3
Advanced Audio FX Engine	Creative Technology Ltd	27.10.2011		1.12.05
ASIO4ALL	Michael Tippach	20.11.2011		2.10
Audials	RapidSolution Software AG	30.05.2012	329MB	9.1.23700.0
AudibleManager	Audible, Inc.	06.04.2012		1998339310.48.56.43526554
avast! Free Antivirus	AVAST Software	08.07.2012		7.0.1456.0
CCleaner	Piriform	22.06.2012		3.20
Defraggler	Piriform	29.05.2012		2.10
Dell DataSafe Local Backup	Dell Inc.	27.10.2011		9.4.57
Dell DataSafe Local Backup - Support Software	Dell Inc.	27.10.2011		9.4.57
Dell Driver Download Manager	Dell Inc	20.11.2011		3.0.0.0
Dell Support Center	Dell Inc.	27.10.2011	128MB	3.1.5803.11
Der Herr der Ringe Online v03.03.05.8039	Turbine, Inc.	14.02.2012		03.03.05.8039
Dragon NaturallySpeaking 11.5	Nuance Communications Inc.	04.11.2011	2,49GB	11.50.100
Dropbox	Dropbox, Inc.	06.06.2012		1.4.7
DVD Shrink 3.2	DVD Shrink	31.12.2011		
FileZilla Client 3.5.3	FileZilla Project	31.03.2012	16,5MB	3.5.3
FreePDF (Remove only)		26.04.2012		
GIMP 2.6.8		18.12.2011		
Google Talk Plugin	Google	25.06.2012	18,8MB	3.1.4.8140
GPL Ghostscript	Artifex Software Inc.	12.11.2011		9.04
Grand Theft Auto IV	Rockstar	01.01.2012		
Hattrick Organizer (remove only)		14.04.2012		
Hauppauge WinTV 7		18.05.2012		
Inkscape 0.48.2		18.12.2011		0.48.2
Intel(R) Control Center	Intel Corporation	17.06.2012		1.2.1.1007
Intel(R) Management Engine Components	Intel Corporation	17.06.2012		7.0.0.1144
Intel(R) Processor Graphics	Intel Corporation	17.06.2012		8.15.10.2455
Intel(R) PROSet/Wireless WiFi-Software	Intel Corporation	27.10.2011	137MB	14.2.0000
Intel(R) WiDi	Intel Corporation	27.10.2011	139MB	2.1.39.0
IrfanView (remove only)	Irfan Skiljan	15.01.2012	1,50MB	4.32
Java(TM) 6 Update 22	Oracle	12.11.2011	97,0MB	6.0.220
Java(TM) 6 Update 27 (64-bit)	Oracle	27.10.2011	91,6MB	6.0.270
Java(TM) 6 Update 29	Oracle	27.10.2011	97,0MB	6.0.290
Klavierakkorde 1.4.0	AB-Tools.com	16.03.2012	1,15MB	1.4.0
Last.fm 1.5.4.27091	Last.fm	08.11.2011		
Malwarebytes Anti-Malware Version 1.62.0.1300	Malwarebytes Corporation	14.07.2012	18,7MB	1.62.0.1300
Microsoft .NET Framework 1.1		03.12.2011		
Microsoft .NET Framework 4 Client Profile	Microsoft Corporation	11.02.2011	38,8MB	4.0.30319
Microsoft .NET Framework 4 Extended	Microsoft Corporation	11.02.2011	51,9MB	4.0.30319
Microsoft Games for Windows - LIVE	Microsoft Corporation	04.01.2012	8,31MB	3.1.186.0
Microsoft Games for Windows - LIVE Redistributable	Microsoft Corporation	04.01.2012	31,3MB	3.5.92.0
Microsoft Office 2010	Microsoft Corporation	27.10.2011	6,31MB	14.0.4763.1000
Microsoft Office Klick-und-Los 2010	Microsoft Corporation	04.11.2011		14.0.4763.1000
Microsoft Office Starter 2010 - Deutsch	Microsoft Corporation	04.11.2011		14.0.4763.1000
Microsoft Silverlight	Microsoft Corporation	12.05.2012	80,3MB	4.1.10329.0
Microsoft SQL Server 2005 Compact Edition [ENU]	Microsoft Corporation	27.10.2011	1,69MB	3.1.0000
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	03.12.2011	2,38MB	8.0.59193
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022	Microsoft Corporation	08.11.2011	1,70MB	9.0.21022
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17	Microsoft Corporation	27.10.2011	788KB	9.0.30729
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161	Microsoft Corporation	05.11.2011	788KB	9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729	Microsoft Corporation	27.10.2011	598KB	9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	27.10.2011	596KB	9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	27.10.2011	586KB	9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161	Microsoft Corporation	05.11.2011	600KB	9.0.30729.6161
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319	Microsoft Corporation	27.11.2011	11,0MB	10.0.30319
Mozilla Firefox 13.0.1 (x86 de)	Mozilla	13.07.2012	36,4MB	13.0.1
Mozilla Maintenance Service	Mozilla	13.07.2012	199KB	13.0.1
Mozilla Thunderbird 13.0.1 (x86 de)	Mozilla	22.06.2012	39,1MB	13.0.1
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	05.11.2011	1,27MB	4.20.9870.0
MSXML 4.0 SP2 (KB973688)	Microsoft Corporation	05.11.2011	1,33MB	4.20.9876.0
MySQL Connector/ODBC 5.1	Oracle Corporation	31.03.2012	40,9MB	5.1.8
MySQL Installer	Oracle Corporation	31.03.2012	190MB	1.0.17.0
MySQL Server 5.5	Oracle Corporation	31.03.2012	123MB	5.5.22
MySQL Workbench 5.2 CE	Oracle Corporation	31.03.2012	67,2MB	5.2.38
NVIDIA 3D Vision Treiber 296.10	NVIDIA Corporation	13.03.2012		296.10
NVIDIA Grafiktreiber 296.10	NVIDIA Corporation	13.03.2012		296.10
NVIDIA HD-Audiotreiber 1.3.12.0	NVIDIA Corporation	13.03.2012		1.3.12.0
NVIDIA PhysX-Systemsoftware 9.12.0213	NVIDIA Corporation	13.03.2012		9.12.0213
NVIDIA Update 1.7.11	NVIDIA Corporation	13.03.2012		1.7.11
OpenOffice.org 3.3	OpenOffice.org	12.11.2011	414MB	3.3.9567
Pando Media Booster	Pando Networks Inc.	03.12.2011	5,46MB	2.6.0.1
Phase 5 HTML-Editor	Systemberatung Schommer	31.03.2012	3,72MB	5.6.2.3
PixiePack Codec Pack	None	08.11.2011	11,8MB	1.0.100.0
Quickset64	Dell Inc.	27.10.2011		11.0.10
Realtek High Definition Audio Driver	Realtek Semiconductor Corp.	20.11.2011		6.0.1.6312
Reason	Propellerhead Software AB	20.11.2011	43,2MB	2.5
RedMon - Redirection Port Monitor		12.11.2011		
Skype Click to Call	Skype Technologies S.A.	04.07.2012	18,7MB	6.0.10297
Skype™ 5.10	Skype Technologies S.A.	28.06.2012	19,4MB	5.10.114
Sony PC Companion 2.10.065	Sony	29.06.2012	19,2MB	2.10.065
Sophos Virus Removal Tool	Sophos Limited	17.06.2012	76,3MB	2.1
Spotify	Spotify AB	10.07.2012		0.8.4.93.gd9f49c35
Steam	Valve Corporation	31.12.2011	35,4MB	1.0.0.0
Synaptics Pointing Device Driver	Synaptics Incorporated	27.10.2011	46,4MB	15.2.6.0
The Elder Scrolls IV: Oblivion	Bethesda Softworks	17.06.2012		
Visual C++ 9.0 Runtime for Dragon NaturallySpeaking 64bit (x64)	Nuance Communications Inc.	04.11.2011	38,0MB	11.0.200
VLC media player 2.0.2	VideoLAN	06.07.2012		2.0.2
Winamp	Nullsoft, Inc	30.06.2012		5.63 
Winamp Erkennungs-Plug-in	Nullsoft, Inc	25.06.2012	63,0KB	1.0.0.1
Windows Live Essentials	Microsoft Corporation	27.10.2011		15.4.3508.1109
Windows Live Mesh ActiveX control for remote connections	Microsoft Corporation	27.10.2011	5,57MB	15.4.5722.2
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0	Intel	27.10.2011		2.1.23.0
viele grüße!!
lars


Alt 16.07.2012, 07:40   #6
kira
/// Helfer-Team
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


Systemreinigung und Prüfung:

1.
Zitat:
Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript also - nach dem "Code", alles was in der Codebox steht - (also beginnend mit :OTL und am Ende [emptytemp]), alles was in der Codebox steht (ohne "code"!) :
Code:
ATTFilter
:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE:64bit: - HKLM\..\SearchScopes\{D256AAB8-C681-4219-9470-DCF803B76A89}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKLM\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE - HKLM\..\SearchScopes\{D256AAB8-C681-4219-9470-DCF803B76A89}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/USCON/8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE - HKCU\..\SearchScopes\{3805E92B-14DB-44DC-BF7F-3F8DA19128C9}: "URL" = http://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{4C1513CC-1598-4BF1-BB36-6D53C9C69775}: "URL" = http://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{94EF8E66-42E2-4911-9798-CEDDCAEF17BB}: "URL" = http://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{A3E4DF99-0B9F-45ED-9C30-241B964AA304}: "URL" = http://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\LaHzz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\LaHzz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
[2012.06.15 00:46:57 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.15 00:46:56 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.15 00:46:57 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.15 00:46:57 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.15 00:46:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKCU..\Run: [AdobeBridge]  File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\Shell - "" = AutoRun
O33 - MountPoints2\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\Shell\AutoRun\command - "" = F:\Startme.exe
[2012.07.15 20:16:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-76685547-4292423041-290503021-1001UA.job
[2012.07.15 11:01:34 | 000,000,422 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job
[2012.07.15 10:16:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-76685547-4292423041-290503021-1001Core.job
[2012.07.06 10:27:16 | 000,000,564 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
@Alternate Data Stream - 235 bytes -> C:\ProgramData\Temp:0FF263E8
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:B606BA34

:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
  • und füge es hier ein:
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Klick auf .
  • OTL verlangt einen Neustart. Bitte zulassen.
  • Nach dem Neustart findest Du ein Textdokument.
    Kopiere den Inhalt hier in Deinen Thread.

2.
Java 32 und 64 Bit aktualisieren- über Systemsteuerung-> Nach Update suchen...
oder:
Downloade nun die Offline-Version von Java "Empfohlen Version Java(TM) 7 Update 5 " von Oracle und installiere sie. Achte darauf, eventuell angebotene Toolbars nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar entfernen.

3.
Tipps (unabhängig davon ob man den Internet Explorer benutzt oder nicht!) - zeitweise kontrollieren:
-> Tipps zu Internet Explorer
-> Standard Suchmaschine des Explorers ändern
-> Ändern oder Auswählen eines Suchanbieters in Internet Explorer 7/8
-> Wie kann ich den Cache im Internet Explorer leeren?

4.
reinige dein System mit CCleaner:
  • "CCleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
  • "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
  • Starte dein System neu auf

5.
  • lade Dir SUPERAntiSpyware FREE Edition herunter.
    Achte darauf, eventuell angebotene Toolbar nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar (falls nötig), entfernen.
  • installiere das Programm und update online.
  • starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
  • setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
  • anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
  • auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
  • um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
  • drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

6.
Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware ("Worm.Win32.Autorun") verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen.
Schließe jetzt alle externe Datenträgeran (USB Sticks etc) Deinen Rechner an, dabei die Hochstell-Taste [Shift-Taste] gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. (So verhindest Du die Ausführung der AUTORUN-Funktion) - Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung

7.
-> Führe dann einen Komplett-Systemcheck mit Eset Online Scanner (NOD32)Kostenlose Online Scanner durch
Achtung!: >>Du sollst nicht die Antivirus-Sicherheitssoftware installieren, sondern dein System nur online scannen<<

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?
__________________
--> pdf aus gefälschter e-mail von "o2 telefonica" geöffnet

Alt 17.07.2012, 18:06   #7
LaHzz
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


so, dauerte alles ein wenig (der eset hat wirklich volle sechs stunden durchgescannt, wow...:-)), hier sind die ergebnisse:

1. das OTL-löschprotokoll:
Code:
ATTFilter
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D256AAB8-C681-4219-9470-DCF803B76A89}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D256AAB8-C681-4219-9470-DCF803B76A89}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D256AAB8-C681-4219-9470-DCF803B76A89}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D256AAB8-C681-4219-9470-DCF803B76A89}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3805E92B-14DB-44DC-BF7F-3F8DA19128C9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3805E92B-14DB-44DC-BF7F-3F8DA19128C9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4C1513CC-1598-4BF1-BB36-6D53C9C69775}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4C1513CC-1598-4BF1-BB36-6D53C9C69775}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{94EF8E66-42E2-4911-9798-CEDDCAEF17BB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{94EF8E66-42E2-4911-9798-CEDDCAEF17BB}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A3E4DF99-0B9F-45ED-9C30-241B964AA304}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3E4DF99-0B9F-45ED-9C30-241B964AA304}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
C:\Users\LaHzz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll moved successfully.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Users\LaHzz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll not found.
C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\ not found.
File F:\Startme.exe not found.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76685547-4292423041-290503021-1001UA.job moved successfully.
C:\Windows\Tasks\SystemToolsDailyTest.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-76685547-4292423041-290503021-1001Core.job moved successfully.
C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job moved successfully.
ADS C:\ProgramData\Temp:0FF263E8 deleted successfully.
ADS C:\ProgramData\Temp:B606BA34 deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\LaHzz\Desktop\cmd.bat deleted successfully.
C:\Users\LaHzz\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56466 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: LaHzz
->Temp folder emptied: 12683761 bytes
->Temporary Internet Files folder emptied: 13246619 bytes
->Java cache emptied: 22145827 bytes
->FireFox cache emptied: 621240652 bytes
->Flash cache emptied: 61926 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56466 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 573500 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50635 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 639,00 mb
 
 
OTL by OldTimer - Version 3.2.46.1 log created on 07162012_124324

Files\Folders moved on Reboot...
C:\Users\LaHzz\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...
2. das log von super-antispyware:
Code:
ATTFilter
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 07/16/2012 at 01:58 PM

Application Version : 5.5.1012

Core Rules Database Version : 8903
Trace Rules Database Version: 6715

Scan type       : Complete Scan
Total Scan Time : 00:34:47

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC Off - Administrator

Memory items scanned      : 689
Memory threats detected   : 0
Registry items scanned    : 72875
Registry threats detected : 0
File items scanned        : 84476
File threats detected     : 0
und ESET hat beim durchscannen noch einige (ich schätze mal, schon etwas ältere) dateien gefunden, ich poste den log auch einfach mal ungefragt hier:
Code:
ATTFilter
C:\Users\LaHzz\Downloads\PDFCreator-1_2_3_setup.exe	Win32/Toolbar.Widgi application	cleaned by deleting - quarantined
E:\Maxtor backup\LAHZZ-PC\C\Users\LaHzz\Downloads\HSS-1.15-install-anchorfree-76-conduit.zip	a variant of Win32/HotSpotShield application	deleted - quarantined
G:\Austen\Renamer\SoftonicDownloader_fuer_flexible-renamer.exe	a variant of Win32/SoftonicDownloader.A application	cleaned by deleting - quarantined
G:\Dox\Austen-Ordner Bibliothekslaufwerk 2011-10-17\Austen\Renamer\SoftonicDownloader_fuer_flexible-renamer.exe	a variant of Win32/SoftonicDownloader.A application	cleaned by deleting - quarantined
G:\Dox\Austen-Ordner Postlaufwerk 2011-10-18\Austen\Renamer\SoftonicDownloader_fuer_flexible-renamer.exe	a variant of Win32/SoftonicDownloader.A application	cleaned by deleting - quarantined
G:\LAHZZ-PC\Backup Set 2011-11-20 190000\Backup Files 2011-12-18 210045\Backup files 2.zip	Win32/Toolbar.Widgi application	deleted - quarantined
G:\LAHZZ-PC\Backup Set 2012-01-08 190000\Backup Files 2012-01-08 190000\Backup files 10.zip	Win32/Toolbar.Widgi application	deleted - quarantined
G:\LAHZZ-PC\Backup Set 2012-02-26 190000\Backup Files 2012-02-26 190000\Backup files 11.zip	Win32/Toolbar.Widgi application	deleted - quarantined
G:\LAHZZ-PC\Backup Set 2012-02-26 190000\Backup Files 2012-03-12 120929\Backup files 4.zip	Win32/Toolbar.Widgi application	deleted - quarantined
G:\LAHZZ-PC\Backup Set 2012-03-25 200402\Backup Files 2012-03-25 200402\Backup files 8.zip	Win32/Toolbar.Widgi application	deleted - quarantined
G:\recovery etc\Nero_BackItUpAndBurn-1.0.0_trial.exe	Win32/Toolbar.AskSBar application	deleted - quarantined
G:\WINDOWS.OLD-BACKUP\Windows.old\Users\LaHzz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\603860b2-10f4a874	multiple threats	deleted - quarantined
G:\WINDOWS.OLD-BACKUP\Windows.old\Users\LaHzz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\52612d3a-2deb4b68	multiple threats	deleted - quarantined
G:\WINDOWS.OLD-BACKUP\Windows.old\Users\LaHzz\AppData\Roaming\OpenCandy\OpenCandy_480978AA01FF459DA52FB4153BBEFE4F\registrybooster(9).exe	a variant of Win32/RegistryBooster application	cleaned by deleting - quarantined
G:\WINDOWS.OLD-BACKUP\Windows.old\Users\LaHzz\Downloads\Setup_FreeVideoConverter.exe	Win32/Toolbar.Widgi application	cleaned by deleting - quarantined
viele grüße (und vielen dank für alles bisherige natürlich auch schon...)!
lars

Alt 19.07.2012, 05:52   #8
kira
/// Helfer-Team
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?
__________________

Warnung!:
Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein!
Anhang nicht öffnen, in unserem Forum erst nachfragen!
Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten!
Bitte diese Warnung weitergeben, wo Du nur kannst!
Alt 19.07.2012, 18:38   #9
LaHzz
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


wirkt alles soweit ok, aber viele besondere fisimatenten gabs ja auch vorher nicht (wie gesagt, hatte ja eher den verdacht, dass es ein banking-trojaner ist). da ich in der zwischenzeit opera (unter dem ja alles stockte: videos, aber auch simples scrollen auf internetseiten) durch den aktuellen firefox ersetzt habe, habe ich nicht den direkten vergleich. der browser wirkt jedenfalls nicht schon beim scrollen überlastet. videos laufen immer noch etwas stockend, aber schon besser, und so ein performance-abbau kann ja sicher auch anderswo herrühren, oder? ansonsten verhält sich das system nach meinem urteil an sich unauffällig.

viele grüße!
lars

Alt 20.07.2012, 06:31   #10
kira
/// Helfer-Team
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


lade Dir HijackThis v2.0.4 herunter
Vista und Win7-> Rechtsklick drauf-> "Als Administrator ausführen" wählen
HijackThis starten→ "Do a system scan and save a logfile" klicken→ das erhaltene Logfile "markieren" → "kopieren"→ hier in deinem Thread (rechte Maustaste) "einfügen"
__________________

Warnung!:
Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein!
Anhang nicht öffnen, in unserem Forum erst nachfragen!
Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten!
Bitte diese Warnung weitergeben, wo Du nur kannst!
Alt 24.07.2012, 11:00   #11
LaHzz
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


so, und hier das hijackthis-logfile (war ein paar tage weg, daher erst jetzt...):

Code:
ATTFilter
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:57:54, on 24.07.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Users\LaHzz\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
C:\Users\LaHzz\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\FreePDF_XP\fpassist.exe
C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE
C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking11\Ereg.ini"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [FreePDF Assistant] "C:\Program Files (x86)\FreePDF_XP\fpassist.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\LaHzz\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-76685547-4292423041-290503021-1006\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-76685547-4292423041-290503021-1006\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Startup: Dropbox.lnk = LaHzz\AppData\Roaming\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel(R) Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: Dragon Service (DragonSvc) - Nuance Communications, Inc. - C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~2\WinTV\TVServer\HAUPPA~1.EXE
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MySQL55 - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: Intel(R) Turbo Boost Technology Monitor 2.0 (TurboBoost) - Intel(R) Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12571 bytes
viele grüße!!
lars

Alt 25.07.2012, 06:33   #12
kira
/// Helfer-Team
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


1.
Schliesse alle Programme einschliesslich Internet Explorer und fixe mit Hijackthis die Einträge aus der nachfolgenden Codebox (HijackThis starten→ "Do a system scan only"→ Einträge auswählen→ Häckhen setzen→ "Fix checked" klicken→ PC neu aufstarten):
HijackThis erstellt ein Backup, Falls bei "Fixen" etwas schief geht, kann man unter "View the list of backups"- die Objekte wiederherstellen
Code:
ATTFilter
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-76685547-4292423041-290503021-1006\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
2.
poste erneut - nach der vorgenommenen Reinigungsaktion:
TrendMicro™ HijackThis™ -Logfile - Keine offenen Fenster, solang bis HijackThis läuft!!

► Es muss alles im grünen Bereich sein!
__________________

Warnung!:
Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein!
Anhang nicht öffnen, in unserem Forum erst nachfragen!
Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten!
Bitte diese Warnung weitergeben, wo Du nur kannst!
Alt 26.07.2012, 12:31   #13
LaHzz
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


hallo kira!
alles getan, hier dann noch einmal das hijackthis-logfile:

Code:
ATTFilter
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:28:34, on 26.07.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Users\LaHzz\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\FreePDF_XP\fpassist.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe
C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking11\Ereg.ini"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [FreePDF Assistant] "C:\Program Files (x86)\FreePDF_XP\fpassist.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\LaHzz\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-76685547-4292423041-290503021-1006\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - Startup: Dropbox.lnk = LaHzz\AppData\Roaming\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel(R) Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: Dragon Service (DragonSvc) - Nuance Communications, Inc. - C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~2\WinTV\TVServer\HAUPPA~1.EXE
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MySQL55 - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: Intel(R) Turbo Boost Technology Monitor 2.0 (TurboBoost) - Intel(R) Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12183 bytes
viele grüße wieder!
lars

Alt 27.07.2012, 08:35   #14
kira
/// Helfer-Team
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


alles in Ordnung wieder?
__________________

Warnung!:
Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein!
Anhang nicht öffnen, in unserem Forum erst nachfragen!
Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten!
Bitte diese Warnung weitergeben, wo Du nur kannst!
Alt 31.07.2012, 09:02   #15
LaHzz
 
pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - Standard

pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


hey kira!

es wirkt jedenfalls alles soweit normal und ok, computer macht keine seltsamen sachen. kann man davon ausgehen, dass er dann wohl (wieder) sauber ist?

grüße!
lars

Antwort
Seite 1 von 2 1 2

Themen zu pdf aus gefälschter e-mail von "o2 telefonica" geöffnet
alternate, antivirus, avast, avast antivirus, bho, browser, computer, defender, e-mail, einstellung, error, explorer, firefox, flash player, format, home, nvidia, nvidia update, nvpciflt.sys, opera, origin, pdf, plug-in, problem, realtek, registry, searchscopes, software, spotify web helper, trojaner, usb, windows, wscript.exe


« GVU-Trojaner auf Windows 7 | BKA-Trojaner: OPLTE mit anschliessendem Scan ausgefuehrt, wie geht es nun weiter? »


Ähnliche Themen: pdf aus gefälschter e-mail von "o2 telefonica" geöffnet


  1. Windows 7: zip-File aus Mail von DirectPay mit Betreff "Offener Rechnung ..." geöffnet. Trojaner?
    Log-Analyse und Auswertung - 07.09.2015 (13)
  2. Bekomme massen E-Mail "This message was created automatically by mail delivery software."
    Plagegeister aller Art und deren Bekämpfung - 31.08.2015 (2)
  3. Phishing Mail Amazon geöffnet und Link "gedrückt", dadurch schädliche Software eingefangen?
    Log-Analyse und Auswertung - 15.07.2015 (5)
  4. Virus E-Mail "UPS" mit IPhone geöffnet
    Smartphone, Tablet & Handy Security - 06.03.2015 (3)
  5. E-Mail von "dirk schirakowski und uwe schütze" erhalten und geöffnet
    Plagegeister aller Art und deren Bekämpfung - 11.02.2015 (3)
  6. Mail mit Makro-Viren von "dirk schirakowski und uwe schütze" geöffnet
    Plagegeister aller Art und deren Bekämpfung - 07.02.2015 (40)
  7. Diverse Malware ("CoolSaleCoupon", "ddownlloaditkeep", "omiga-plus", "SaveSense", "SaleItCoupon"); lahmer PC & viel Werbung!
    Plagegeister aller Art und deren Bekämpfung - 11.01.2015 (16)
  8. Mail von "Telekom" auf ungeschütztem MotoG geöffnet.
    Log-Analyse und Auswertung - 05.12.2014 (3)
  9. Telekom-Trojaner in gefälschter E-Mail->Link geöffnet. Nun weiß ich nicht, ob mein PC befallen ist. Avira und AVG Antivirus finden nichts
    Plagegeister aller Art und deren Bekämpfung - 23.05.2014 (10)
  10. Windows 7: Mail "Luftfrachsendung AWB" zip im Anhang geöffnet, was tun
    Log-Analyse und Auswertung - 18.01.2014 (10)
  11. Windows 7: vermutlich infizierte Mail "Luftfrachsendung AWB" Attachment geöffnet
    Plagegeister aller Art und deren Bekämpfung - 30.12.2013 (15)
  12. Spam-Mail "Abmahnung" - Dateianhang geöffnet
    Plagegeister aller Art und deren Bekämpfung - 13.12.2013 (7)
  13. "monstermarketplace.com" Infektion und ihre Folgen; "Anti-Virus-Blocker"," unsichtbare Toolbars" + "Browser-Hijacker" von selbst installiert
    Log-Analyse und Auswertung - 16.11.2013 (21)
  14. Zip-Datei im E-Mail-Anhang von "Bestellung bei Amazon Buyvip" geöffnet
    Log-Analyse und Auswertung - 05.04.2013 (9)
  15. "Falsche" E-Mail von Freund mit Link ins Netz -> Virus oder nur "Werbung"?
    Log-Analyse und Auswertung - 30.07.2012 (1)
  16. Heute schon über 30 "Mail Delivery System "Mail Delivery System" Mail bekommen
    Log-Analyse und Auswertung - 26.05.2008 (4)
  17. "mailer return": gefälschter Absender oder Virus?
    Überwachung, Datenschutz und Spam - 20.08.2007 (2)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema pdf aus gefälschter e-mail von "o2 telefonica" geöffnet - hallo! ich habe trotteligerweise eine vermeintliche rechnung von "telefonica o2" für angebliche "zusatzdienstleistungen" geöffnet und fürchte nun, einen trojaner auf meinem rechner zu haben. laut meinen recherchen (z.b. hxxp://www.virenguard.de/threads/vorsicht-mit-angeblichen-rechnungs-mails-von-telefonica-o2-germany.44/) sind - pdf aus gefälschter e-mail von "o2 telefonica" geöffnet...
Archiv
Du betrachtest: pdf aus gefälschter e-mail von "o2 telefonica" geöffnet auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131