pdf aus gefälschter e-mail von "o2 telefonica" geöffnet

LaHzz

hallo!

ich habe trotteligerweise eine vermeintliche rechnung von "telefonica o2" für angebliche "zusatzdienstleistungen" geöffnet und fürchte nun, einen trojaner auf meinem rechner zu haben.

laut meinen recherchen (z.b. hxxp://www.virenguard.de/threads/vorsicht-mit-angeblichen-rechnungs-mails-von-telefonica-o2-germany.44/) sind dabei vor allem systeme mit älteren adobe-reader-versionen gefährdet. mein reader war zu dem zeitpunkt zwar aktuell, aber so ganz mag ich der sache nicht trauen, zumal in letzter zeit auch mein browser (opera, die neueste version) beim seitenscrollen stockte und eingebettete videos etwas mehr stotterten...

die suche mit diversen malwarescannern (avast antivirus, sophos virus remover, malwarebytes) war soweit erfolglos, aus deren perspektive scheint das system in ordnung zu sein.

im folgenden nun die logfiles von defogger und OTL. bei OTL besteht allerdings das problem, dass 1) die einstellung "extra-registrierung" bei start des quickscans immer wieder auf "aus" zurückspringt (ich also kein "extras"-logfile habe) und 2) das gleiche bei der einstellung "datei-alter" passiert - der vorfall ist leider schon mehr als 30 tage her (ich war in der zwischenzeit ohne computer außer landes und hab das problem aufgeschoben...). woran könnte das liegen?

gut, roman ende, nun die vorhandenen logs:


1. defogger disable:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:30 on 11/07/2012 (LaHzz)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


2. defogger enable:

defogger_enable by jpshortstuff (23.02.10.1)
Log created at 23:30 on 11/07/2012 (LaHzz)

Parsing file...


-=E.O.F=-


3. OTL quickscan (nur die letzten 30 tage...):

OTL logfile created on: 12.07.2012 00:33:40 - Run 8
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\LaHzz\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

5,90 Gb Total Physical Memory | 3,75 Gb Available Physical Memory | 63,54% Memory free
11,79 Gb Paging File | 9,38 Gb Available in Paging File | 79,57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 679,00 Gb Total Space | 370,67 Gb Free Space | 54,59% Space Free | Partition Type: NTFS
Drive D: | 2,11 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 931,51 Gb Total Space | 115,36 Gb Free Space | 12,38% Space Free | Partition Type: NTFS

Computer Name: LAHZZ-PC | User Name: LaHzz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\LaHzz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE ()
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE (SoftThinks - Dell)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
PRC - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
PRC - C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
PRC - C:\PROGRA~2\WinTV\TVServer\HAUPPA~1.EXE (Hauppauge Computer Works)


========== Modules (No Company Name) ==========

MOD - C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll ()
MOD - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (MySQL55) -- C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe ()
SRV:64bit: - (AMPPALR3) -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel Corporation)
SRV:64bit: - (EvtEng) Intel(R) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) Intel(R) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV:64bit: - (BTHSSecurityMgr) Intel(R) Centrino(R) Wireless Bluetooth(R) -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel(R) Corporation)
SRV:64bit: - (TurboBoost) Intel(R) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (AERTFilters) -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (Sony PC Companion) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe (Avanquest Software)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
SRV - (DragonSvc) -- C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe (Nuance Communications, Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (HauppaugeTVServer) -- C:\PROGRA~2\WinTV\TVServer\HAUPPA~1.EXE (Hauppauge Computer Works)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (nvkflt) -- C:\Windows\SysNative\drivers\nvkflt.sys (NVIDIA Corporation)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (RRNetCapMP) -- C:\Windows\SysNative\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV:64bit: - (RRNetCap) -- C:\Windows\SysNative\drivers\rrnetcap.sys (RapidSolution Software AG)
DRV:64bit: - (tbhsd) -- C:\Windows\SysNative\drivers\tbhsd.sys (RapidSolution Software AG)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (AMPPALP) -- C:\Windows\SysNative\drivers\AmpPal.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (AMPPAL) -- C:\Windows\SysNative\drivers\AmpPal.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (NETwNs64) ___ Intel(R) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (iwdbus) -- C:\Windows\SysNative\drivers\iwdbus.sys (Intel Corporation)
DRV:64bit: - (intaud_WaveExtensible) -- C:\Windows\SysNative\drivers\intelaud.sys (Intel Corporation)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics)
DRV:64bit: - (NvStUSB) -- C:\Windows\SysNative\drivers\nvstusb.sys ()
DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys (Intel(R) Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel(R) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (s1039mdm) -- C:\Windows\SysNative\drivers\s1039mdm.sys (MCCI Corporation)
DRV:64bit: - (s1039unic) Sony Ericsson Device 1039 USB Ethernet Emulation (WDM) -- C:\Windows\SysNative\drivers\s1039unic.sys (MCCI Corporation)
DRV:64bit: - (s1039mgmt) Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM) -- C:\Windows\SysNative\drivers\s1039mgmt.sys (MCCI Corporation)
DRV:64bit: - (s1039obex) -- C:\Windows\SysNative\drivers\s1039obex.sys (MCCI Corporation)
DRV:64bit: - (s1039nd5) Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS) -- C:\Windows\SysNative\drivers\s1039nd5.sys (MCCI Corporation)
DRV:64bit: - (s1039mdfl) -- C:\Windows\SysNative\drivers\s1039mdfl.sys (MCCI Corporation)
DRV:64bit: - (s1039bus) Sony Ericsson Device 1039 driver (WDM) -- C:\Windows\SysNative\drivers\s1039bus.sys (MCCI Corporation)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (hcw17bda) -- C:\Windows\SysNative\drivers\hcw17bda.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE:64bit: - HKLM\..\SearchScopes\{D256AAB8-C681-4219-9470-DCF803B76A89}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE - HKLM\..\SearchScopes\{D256AAB8-C681-4219-9470-DCF803B76A89}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {D256AAB8-C681-4219-9470-DCF803B76A89}
IE - HKCU\..\SearchScopes\{3805E92B-14DB-44DC-BF7F-3F8DA19128C9}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{4C1513CC-1598-4BF1-BB36-6D53C9C69775}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{94EF8E66-42E2-4911-9798-CEDDCAEF17BB}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{A3E4DF99-0B9F-45ED-9C30-241B964AA304}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\LaHzz\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\LaHzz\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\LaHzz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\LaHzz\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.07.08 02:07:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.22 16:02:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

[2012.03.07 14:46:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Extensions
[2012.03.07 14:46:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2012.03.07 14:46:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaHzz\AppData\Roaming\mozilla\Sunbird\Profiles\4i6rirx8.default\extensions
[2011.10.03 06:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.26 20:49:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.
O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] c:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DNS7reminder] C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\LaHzz\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - Startup: C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\LaHzz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.191.92.87 62.109.123.6
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B0A42A4D-BDF2-4925-AE5B-33FFEDE5887F}: DhcpNameServer = 213.191.92.87 62.109.123.6
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.06.14 01:36:09 | 000,000,037 | RH-- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2009.09.29 19:37:31 | 000,000,067 | ---- | M] () - F:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\Shell - "" = AutoRun
O33 - MountPoints2\{bffdd4b3-0bb9-11e1-865c-848f69b1cca8}\Shell\AutoRun\command - "" = F:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.12 00:32:27 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\LaHzz\Desktop\OTL.exe
[2012.07.11 19:25:01 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\Desktop\Trojaner
[2012.07.06 14:33:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.07.06 13:41:14 | 000,000,000 | ---D | C] -- C:\Breaking Bad
[2012.07.06 12:51:34 | 000,000,000 | ---D | C] -- C:\The King's Speech
[2012.07.04 17:49:08 | 000,000,000 | ---D | C] -- C:\cdex_151
[2012.07.04 14:15:50 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MP3Gain
[2012.07.04 14:15:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MP3Gain
[2012.07.04 14:15:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MP3Gain
[2012.06.29 21:59:21 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\Documents\Sony
[2012.06.29 21:58:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2012.06.29 21:57:49 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Local\Sony
[2012.06.29 21:57:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony
[2012.06.29 21:57:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony
[2012.06.17 13:34:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.17 13:34:25 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.17 13:34:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.06.17 11:04:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Sophos
[2012.06.17 11:03:31 | 000,000,000 | ---D | C] -- C:\Users\LaHzz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
[2012.06.17 11:03:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos
[2012.06.17 09:32:00 | 000,000,000 | ---D | C] -- C:\Sherlock1
[2012.06.16 23:17:54 | 000,000,000 | ---D | C] -- C:\Sherlock
[2012.06.16 18:00:49 | 000,000,000 | ---D | C] -- C:\Cheyenne
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.07.12 00:32:29 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\LaHzz\Desktop\OTL.exe
[2012.07.12 00:16:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-76685547-4292423041-290503021-1001UA.job
[2012.07.12 00:01:20 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.12 00:01:20 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.11 23:52:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.11 23:52:32 | 453,640,191 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.11 23:42:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.11 13:41:23 | 000,015,399 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-11.hrf
[2012.07.11 13:09:05 | 000,001,730 | ---- | M] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2012.07.11 13:09:05 | 000,001,203 | ---- | M] () -- C:\Users\LaHzz\Desktop\Downloads.lnk
[2012.07.11 13:09:05 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.07.11 13:03:17 | 000,000,850 | ---- | M] () -- C:\Users\LaHzz\.recently-used.xbel
[2012.07.11 11:01:31 | 000,000,422 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job
[2012.07.11 10:16:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-76685547-4292423041-290503021-1001Core.job
[2012.07.11 09:41:51 | 005,041,504 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.10 21:10:00 | 000,015,399 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-10.hrf
[2012.07.09 20:30:27 | 000,015,209 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-09.hrf
[2012.07.08 15:34:59 | 000,015,206 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-08.hrf
[2012.07.08 02:07:33 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.07.06 10:33:35 | 000,015,751 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-06.hrf
[2012.07.06 10:27:16 | 000,000,564 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2012.07.05 18:16:43 | 000,015,809 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-05.hrf
[2012.07.04 17:43:00 | 001,645,230 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.04 17:43:00 | 000,708,406 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.04 17:43:00 | 000,661,962 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.04 17:43:00 | 000,153,602 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.04 17:43:00 | 000,125,790 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.04 14:45:27 | 000,015,807 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-04.hrf
[2012.07.04 14:43:44 | 000,000,797 | ---- | M] () -- C:\Users\LaHzz\Desktop\aktuelle Bewerbungen.lnk
[2012.07.03 18:21:52 | 000,958,400 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2012.07.03 18:21:52 | 000,355,856 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2012.07.03 18:21:52 | 000,071,064 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012.07.03 18:21:52 | 000,059,728 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2012.07.03 18:21:52 | 000,054,072 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2012.07.03 18:21:51 | 000,025,232 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012.07.03 18:21:32 | 000,041,224 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.07.03 18:21:28 | 000,227,648 | ---- | M] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2012.07.03 18:21:18 | 000,285,328 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2012.07.03 15:59:19 | 000,015,620 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-07-03.hrf
[2012.06.30 23:10:30 | 000,015,614 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-30.hrf
[2012.06.29 14:44:58 | 000,015,233 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-29.hrf
[2012.06.27 17:33:43 | 000,015,044 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-27.hrf
[2012.06.23 20:42:47 | 000,015,229 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-23.hrf
[2012.06.22 10:09:14 | 000,015,410 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-22.hrf
[2012.06.20 15:42:01 | 000,015,376 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-20.hrf
[2012.06.19 16:37:29 | 000,050,477 | ---- | M] () -- C:\Users\LaHzz\Desktop\Defogger.exe
[2012.06.19 10:48:55 | 000,015,188 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-19.hrf
[2012.06.18 16:55:20 | 000,015,188 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-18.hrf
[2012.06.18 16:15:37 | 000,001,595 | ---- | M] () -- C:\Users\LaHzz\AppData\Roaming\SAS7_000.DAT
[2012.06.17 16:39:40 | 000,015,181 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-17.hrf
[2012.06.17 13:34:27 | 000,001,107 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.17 11:03:31 | 000,003,205 | ---- | M] () -- C:\Users\LaHzz\Desktop\Sophos Virus Removal Tool.lnk
[2012.06.16 21:01:52 | 000,014,997 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-16.hrf
[2012.06.15 11:15:47 | 000,015,375 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-15.hrf
[2012.06.14 11:53:22 | 000,015,406 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-14.hrf
[2012.06.13 01:12:58 | 000,015,406 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-13.hrf
[2012.06.12 20:12:37 | 000,015,405 | ---- | M] () -- C:\Users\LaHzz\Documents\2012-06-12.hrf
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.07.11 23:26:29 | 000,050,477 | ---- | C] () -- C:\Users\LaHzz\Desktop\Defogger.exe
[2012.07.11 13:41:23 | 000,015,399 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-11.hrf
[2012.07.11 13:03:17 | 000,000,850 | ---- | C] () -- C:\Users\LaHzz\.recently-used.xbel
[2012.07.11 09:40:40 | 005,041,504 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.10 00:10:18 | 000,015,399 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-10.hrf
[2012.07.09 20:30:27 | 000,015,209 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-09.hrf
[2012.07.08 02:26:32 | 000,015,206 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-08.hrf
[2012.07.06 10:33:35 | 000,015,751 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-06.hrf
[2012.07.05 18:16:43 | 000,015,809 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-05.hrf
[2012.07.04 14:45:27 | 000,015,807 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-04.hrf
[2012.07.04 14:43:44 | 000,000,797 | ---- | C] () -- C:\Users\LaHzz\Desktop\aktuelle Bewerbungen.lnk
[2012.07.03 15:59:19 | 000,015,620 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-07-03.hrf
[2012.06.30 20:32:27 | 000,015,614 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-30.hrf
[2012.06.29 01:55:23 | 000,015,233 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-29.hrf
[2012.06.27 17:33:43 | 000,015,044 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-27.hrf
[2012.06.23 20:42:47 | 000,015,229 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-23.hrf
[2012.06.22 01:15:44 | 000,015,410 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-22.hrf
[2012.06.20 15:42:01 | 000,015,376 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-20.hrf
[2012.06.19 10:48:55 | 000,015,188 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-19.hrf
[2012.06.18 16:55:20 | 000,015,188 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-18.hrf
[2012.06.17 16:39:40 | 000,015,181 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-17.hrf
[2012.06.17 13:34:27 | 000,001,107 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.17 11:03:31 | 000,003,205 | ---- | C] () -- C:\Users\LaHzz\Desktop\Sophos Virus Removal Tool.lnk
[2012.06.16 21:01:52 | 000,014,997 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-16.hrf
[2012.06.15 09:30:01 | 000,015,375 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-15.hrf
[2012.06.14 11:53:22 | 000,015,406 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-14.hrf
[2012.06.13 01:12:58 | 000,015,406 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-13.hrf
[2012.06.12 15:42:20 | 000,685,859 | ---- | C] () -- C:\Users\LaHzz\Desktop\VOC0004 (2).WMA
[2012.06.12 11:57:58 | 000,015,405 | ---- | C] () -- C:\Users\LaHzz\Documents\2012-06-12.hrf
[2012.06.06 18:42:36 | 000,007,597 | ---- | C] () -- C:\Users\LaHzz\AppData\Local\Resmon.ResmonCfg
[2012.03.07 17:54:02 | 000,000,132 | ---- | C] () -- C:\Users\LaHzz\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2012.01.21 19:44:07 | 000,000,132 | ---- | C] () -- C:\Users\LaHzz\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012.01.01 14:25:27 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2011.12.18 12:40:55 | 000,917,325 | ---- | C] () -- C:\Users\LaHzz\.fonts.cache-1
[2011.12.03 18:25:41 | 000,000,093 | ---- | C] () -- C:\Users\LaHzz\AppData\Local\fusioncache.dat
[2011.12.02 18:50:49 | 000,033,169 | ---- | C] () -- C:\Windows\Irremote.ini
[2011.12.02 18:50:28 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.12.02 18:50:27 | 000,000,418 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2011.12.02 18:50:09 | 000,142,337 | ---- | C] () -- C:\Windows\SysWow64\Wait.exe
[2011.12.02 18:45:20 | 000,006,082 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2011.11.04 11:24:42 | 000,001,595 | ---- | C] () -- C:\Users\LaHzz\AppData\Roaming\SAS7_000.DAT
[2011.10.27 18:36:06 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011.10.27 18:35:22 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.10.27 18:35:20 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.10.27 18:35:19 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2011.10.27 18:35:18 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.10.27 18:35:16 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.02.11 12:22:50 | 001,623,124 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

========== LOP Check ==========

[2012.04.18 20:52:22 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\1&1 Mail & Media GmbH
[2011.11.09 00:46:46 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Ableton
[2012.03.28 13:50:44 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\com.Rhapsody.Napster5
[2011.12.29 16:15:32 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\DeepBurner
[2012.07.11 23:54:16 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Dropbox
[2012.04.02 20:21:34 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\FileZilla
[2011.11.04 10:44:01 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Fingertapps
[2011.12.04 13:11:02 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\FOG Downloader
[2012.03.08 13:56:07 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\FreePDF
[2012.05.31 22:59:06 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\gtk-2.0
[2012.03.31 16:50:59 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\hdbADS
[2012.01.15 22:46:55 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\inkscape
[2012.01.15 00:00:03 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\IrfanView
[2012.04.28 16:11:38 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\KompoZer
[2011.11.08 19:59:59 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\LibreOffice
[2012.03.31 18:31:01 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\MySQL
[2011.11.04 11:06:23 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Nuance
[2011.11.12 15:45:12 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\OpenOffice.org
[2012.07.11 12:11:09 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Opera
[2011.11.09 00:17:30 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Propellerhead Software
[2011.11.11 19:33:47 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\SecondLife
[2012.07.11 23:51:49 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\SoftGrid Client
[2012.07.11 23:05:32 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Spotify
[2011.11.08 03:06:42 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\Thunderbird
[2011.11.04 11:26:31 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\TP
[2011.11.12 11:05:29 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\ZinioReader4
[2011.12.20 00:16:26 | 000,000,000 | ---D | M] -- C:\Users\LaHzz\AppData\Roaming\{90140011-0066-0407-0000-0000000FF1CE}
[2012.07.06 10:27:16 | 000,000,564 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2012.06.18 09:29:53 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.07.11 11:01:31 | 000,000,422 | ---- | M] () -- C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 235 bytes -> C:\ProgramData\Temp:0FF263E8
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:B606BA34

< End of report >


ich hoffe, das hat trotz der OTL-probleme schon ein wenig aussagekraft. vielen dank schon jetzt für jede art von hilfe jedenfalls!

viele grüße!
lars