| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Onlinbankingsperre wg Zeus2Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.08.2010, 17:36
| #1 |
 |  Onlinbankingsperre wg Zeus2 Hallo, meine Bank hat meinen Onlinebankingzugang gesperrt, da sie einen Zeus2 Trojaner feststellten, der von meinem Computer kam und den sie als gefährlich einstufen, da er PINs und Passwörter ausspioniert. Beim Virenscan mit Antivir freeware Edition kamen zu Tage : TR/SPY.Zbot.alzl HEUR/HTML. malware TR/Agent2.cttr TR/BlockRapport.B JAVA/Agent.M.3 JAVA/Agent.AE die in Quarantäne geschoben wurden. JAVA/Agent.AC JAVA/Agent.AD sind nur im Report angezeigt. Habe Windows VIsta Home premium service pack 2 , 32 Bit Version und frage, ob ich das System komplett Neuaufsetzen muß und es ok ist, wenn ich die aktuellen worddateien, Bilder, T-Onlinemails und Videos Musikdateien sichere und dann wieder neuaufspiele? Hilfe tut ja so gut. Dankehttp://www.trojaner-board.de/images/icons/icon26.gif MarkusB |
|
09.08.2010, 18:13
| #2 |
| /// Malware-holic   |  Onlinbankingsperre wg Zeus2 hi,
__________________1. ja genau so machst du dass dann. 2. gebe ich dir, falls gewünscht, tipps um das system in zukunft sicherer zu machen. 3. nutzt du warscheinlich pin/tan verfahren, ist auch nicht mehr so sicher, geb dir tipps was du nutzen solltest. 4. möchte ich dein system kurz näher ansehen, um evtl. unbekannte dateien zu finden, damit diese eingesendet werden können, damit andere geschützt sind, falls du nichts dagegen hast. ootl: Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt poste beide logs |
|
09.08.2010, 18:38
| #3 |
| | Onlinbankingsperre wg Zeus2 Hallo MarkusG,
__________________1. also mit den Recoverydisks, die ich am Anfang erstellt habe vist neu installieren? Sind nach der Inefktion gesicherte Worddateien, PDFs, T-onlinemails, Bilder, Outlookadressbuch und Videos ins neue Vista einspielbar ohne Neuinfektion? 2. Danke für Tips 3. ja Pin und Tan bei der Bank vielen Dank und Respekt von MarkusB für das superschnelle Feedback. zu 4.Versuche den Scan zu machen und zu posten, bin aber ein selfmade Computernutzer(nicht Freak!); freu mich wenn Du mir erklärst, was einsenden heisst und an wen und wie damit andere egschützt werden (soind das auch persönliche Daten von mir?) Schöne Markusgrüsse MarkusB |
|
09.08.2010, 18:55
| #4 |
| /// Malware-holic | Onlinbankingsperre wg Zeus2 hi namensfetter. du kannst alles an daten zurückspielen, nachdem das system zurückgesetzt wurde. wir nutzen otl um die malware zu identivizieren, zu löschen, dann erstellst du ein archiv wo die malware enthalten ist, lädst die zu unserem upload channel hoch und ich sende die dann an über 40 antivirus hersteller ein. geb dir dann auch die tipps zum absichern. hier schon mal für online banking. du solltest deine bank fragen, ob folgendes möglich ist, da dies mit chipcard ist, werden ein paar zusatzkosten auf dich zukommen, sind aber nicht so hoch, und im zweifelsfall schützt dich das vllt vor dem nächsten trojaner der irgendwie deine daten abgreifen will. was bei pin/tan eingabe einfacher ist als beim rest. 1. kombination aus FINTS/HBCI verfahren 2. FINTS als einzellösung 3. HBCI als einzellösung. verfahren sind nach sicherheit geordnet. |
|
09.08.2010, 19:55
| #5 |
| | Onlinbankingsperre wg Zeus2 Hi, 1. hier mein Scanergebnis:OTL Logfile: Code:
ATTFilter OTL logfile created on: 09.08.2010 20:21:12 - Run 1 OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\MARKUS\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18928) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 31,00% Memory free 6,00 Gb Paging File | 4,00 Gb Available in Paging File | 58,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 150,66 Gb Total Space | 76,82 Gb Free Space | 50,99% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 145,97 Gb Total Space | 140,80 Gb Free Space | 96,46% Space Free | Partition Type: NTFS Drive F: | 4,20 Gb Total Space | 3,36 Gb Free Space | 79,93% Space Free | Partition Type: UDF G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: MARKUS-PC Current User Name: MARKUS Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\MARKUS\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\profilemgr.exe (Deutsche Telekom AG) PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\sc_watch.exe (Deutsche Telekom AG) PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\kernel.exe (Deutsche Telekom AG) PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia) PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) PRC - C:\Programme\Netzmanager\netzmanager.exe (Deutsche Telekom AG) PRC - C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Deutsche Telekom AG) PRC - C:\Windows\starter4g.exe (4G Systems GmbH & Co. KG) PRC - C:\Windows\service4g.exe (4G Systems GmbH & Co. KG) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia) PRC - C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia) PRC - C:\Programme\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.) PRC - C:\Programme\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia) PRC - C:\GTS\GTS.exe () PRC - C:\Programme\Common Files\Nokia\NoA\nokiaaserver.exe () PRC - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe (Google) PRC - C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia) PRC - C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\XSManager\WTGService.exe () PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH) PRC - C:\Programme\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\T-Home\Internationaler Zugang\International.exe (iPass, Inc.) PRC - C:\Programme\T-Home\Internationaler Zugang\iPassConnectEngine.exe (iPass, Inc.) PRC - C:\Programme\T-Home\Internationaler Zugang\iPassPeriodicUpdateService.exe (iPass, Inc.) PRC - C:\Programme\T-Home\Internationaler Zugang\iPassPeriodicUpdateApp.exe (iPass, Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Free Download Manager\fdm.exe (FreeDownloadManager.ORG) PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) PRC - C:\Programme\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group) PRC - C:\Programme\TrueSuite Access Manager\usbnotify.exe () PRC - C:\Windows\System32\TAMSvr.exe (AuthenTec Inc.) PRC - C:\Programme\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc) PRC - C:\Windows\System32\CNAB4RPK.EXE (CANON INC.) PRC - C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation) PRC - C:\Programme\Search Settings\SearchSettings.exe (Vendio Services, Inc.) PRC - C:\Programme\Camera Assistant Software for Toshiba\CEC_MAIN.exe () PRC - C:\Programme\Camera Assistant Software for Toshiba\traybar.exe (Chicony) PRC - C:\Programme\Toshiba\HDMICtrlMan\HDMICtrlMan.exe (TOSHIBA Corporation.) PRC - C:\Programme\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba) PRC - C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA) PRC - C:\Programme\Toshiba\HDMICtrlMan\HCMSoundChanger.exe (TOSHIBA Corporation.) PRC - C:\Programme\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION) PRC - C:\Programme\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION) PRC - C:\Programme\Toshiba\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION) PRC - C:\Programme\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation) PRC - C:\Programme\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Programme\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation) PRC - C:\Programme\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation) PRC - C:\Programme\Toshiba\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation) PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) PRC - C:\Programme\Common Files\Marmiko Shared\MInfraIS\MInfraIS.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) PRC - C:\Programme\T-Online\T-Online_Software_6\eMail\Mail.exe (Deutsche Telekom AG, Nachrichten - Service - Shopping bei t-online.de) PRC - C:\Programme\O2Micro Flash Memory Card Driver\o2flash.exe (O2Micro International) PRC - C:\Windows\Samsung\PanelMgr\SSMMgr.exe () PRC - C:\Programme\T-Online\T-Online_Software_6\Notifier\Notifier.exe (fun communications GmbH, fun communications) PRC - C:\Programme\Apoint2K\hidfind.exe (Alps Electric Co., Ltd.) PRC - C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.) ========== Modules (SafeList) ========== MOD - C:\Users\MARKUS\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (TOSHIBA Bluetooth Service) -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe File not found SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (Netzmanager Service) -- C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Deutsche Telekom AG) SRV - (XS Stick Service) -- C:\Windows\service4g.exe (4G Systems GmbH & Co. KG) SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (GoogleDesktopManager-110309-193829) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (WTGService) -- C:\Programme\XSManager\WTGService.exe () SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (TemproMonitoringService) Notebook Performance Tuning Service (TEMPRO) -- C:\Program Files\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH) SRV - (iPassConnectEngine) -- C:\Programme\T-Home\Internationaler Zugang\iPassConnectEngine.exe (iPass, Inc.) SRV - (iPassPeriodicUpdateService) -- C:\Program Files\T-Home\Internationaler Zugang\iPassPeriodicUpdateService.exe (iPass, Inc.) SRV - (iPassPeriodicUpdateApp) -- C:\Program Files\T-Home\Internationaler Zugang\iPassPeriodicUpdateApp.exe (iPass, Inc.) SRV - (Authentec memory manager) -- C:\Windows\System32\TAMSvr.exe (AuthenTec Inc.) SRV - (TNaviSrv) -- C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation) SRV - (SmartFaceVWatchSrv) -- C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba) SRV - (ConfigFree Service) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (TosCoSrv) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation) SRV - (TOSHIBA SMART Log Service) -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation) SRV - (TODDSrv) -- C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation) SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation) SRV - (o2flash) -- C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe (O2Micro International) SRV - (UleadBurningHelper) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.) SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®) ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found DRV - (IntcHdmiAddService) Intel(R) -- C:\Windows\System32\drivers\IntcHdmi.sys File not found DRV - (igfx) -- C:\Windows\System32\DRIVERS\igdkmd32.sys File not found DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia) DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia) DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia) DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia) DRV - (nmwcdnsu) -- C:\Windows\System32\drivers\nmwcdnsu.sys (Nokia) DRV - (nmwcdnsuc) -- C:\Windows\System32\drivers\nmwcdnsuc.sys (Nokia) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (WINUSB) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (cmnsusbser) -- C:\Windows\System32\drivers\cmnsusbser.sys (Mobile Connector) DRV - (CnxtHdAudService) -- C:\Windows\System32\drivers\CHDRT32.sys (Conexant Systems Inc.) DRV - (AlfaFF) -- C:\Windows\system32\drivers\AlfaFF.sys (Alfa Corporation) DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia) DRV - (tos_sps32) -- C:\Windows\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation) DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation) DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION) DRV - (O2MDRDR) -- C:\Windows\System32\drivers\o2media.sys (O2Micro ) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell) DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.) DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.) DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.) DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.) DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (UVCFTR) -- C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.) DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation) DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.) DRV - (QIOMem) -- C:\Windows\System32\drivers\QIOMem.sys (TOSHIBA) DRV - (SSPORT) -- C:\Windows\System32\drivers\SSPORT.SYS (Samsung Electronics) DRV - (DgiVecp) -- C:\Windows\System32\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (tosrfec) -- C:\Windows\System32\drivers\tosrfec.sys (TOSHIBA Corporation) DRV - (tdcmdpst) -- C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.) DRV - (MTOnlPktAlyX) -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Ask.com Search Engine - Better Web Search IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\kb127\SearchSettings.dll (Vendio Services, Inc.) IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Ask.com" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.ask.com/?o=101723&l=dis" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1 FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10 FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:4.1.5 FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.2.26 FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.29 FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0 FF - prefs.js..extensions.enabledItems: {1ced4832-f06e-413f-aa14-9eb63ad40ace}:1.0.2 FF - prefs.js..extensions.enabledItems: {1dbc4a33-ea62-4330-966c-7bdad3455322}:1.0.6.7 FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3 FF - prefs.js..extensions.enabledItems: {51e18ac0-6522-11da-8cd6-0800200c9a66}:0.41 FF - prefs.js..extensions.enabledItems: optout@dubfire.net:3.02 FF - prefs.js..extensions.enabledItems: {9815d32d-08c2-42ca-a8c6-43e501a4512f}:0.3.3 FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2 FF - prefs.js..extensions.enabledItems: 4 FF - prefs.js..extensions.enabledItems: 9 FF - prefs.js..extensions.enabledItems: 1 FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2010.02.25 01:25:24 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.03.26 20:23:01 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.12 15:14:39 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.07.01 10:12:23 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.03.26 20:23:02 | 000,000,000 | ---D | M] [2010.01.01 17:57:31 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Extensions [2010.01.01 17:57:31 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Extensions\songbird@songbirdnest.com [2010.08.09 19:02:31 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions [2010.03.28 16:14:59 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2010.08.03 19:46:15 | 000,000,000 | ---D | M] (FlashGot) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34} [2009.09.15 22:14:05 | 000,000,000 | ---D | M] (Nuke Anything Enhanced) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{1ced4832-f06e-413f-aa14-9eb63ad40ace} [2010.02.03 09:34:55 | 000,000,000 | ---D | M] (Remove It Permanently) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{1dbc4a33-ea62-4330-966c-7bdad3455322} [2009.07.09 10:50:03 | 000,000,000 | ---D | M] (SimpleTranslate) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{51e18ac0-6522-11da-8cd6-0800200c9a66} [2010.07.28 21:01:35 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} [2010.04.13 22:06:25 | 000,000,000 | ---D | M] (Tor-Proxy.NET Toolbar) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{9815d32d-08c2-42ca-a8c6-43e501a4512f} [2010.05.13 09:30:51 | 000,000,000 | ---D | M] (WOT) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2010.07.10 17:57:53 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.05.30 11:00:36 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} [2009.11.10 15:04:42 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\firefox@tvunetworks.com [2010.05.13 09:30:55 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\firefox-extension@shareaholic.com [2010.06.20 20:26:16 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\optout@dubfire.net [2010.06.11 20:03:54 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\smarterwiki@wikiatic.com [2010.05.13 09:30:54 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\firefox-extension@shareaholic.com\chrome [2010.05.13 09:30:53 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\firefox-extension@shareaholic.com\defaults [2009.07.18 10:20:59 | 000,002,239 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Mozilla\FireFox\Profiles\g91g2yyx.default\searchplugins\askcom.xml [2010.08.03 21:42:57 | 000,001,482 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Mozilla\FireFox\Profiles\g91g2yyx.default\searchplugins\bsb-opac.xml [2010.08.03 21:42:57 | 000,001,493 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Mozilla\FireFox\Profiles\g91g2yyx.default\searchplugins\bsb-opacplus.xml [2010.05.06 10:57:34 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.03.29 12:48:52 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010.05.06 10:57:35 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2007.03.02 15:17:24 | 000,095,200 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\NPAPIX.dll [2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2007.01.17 13:18:04 | 000,095,200 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\NPFluxBrowserHelper.dll [2007.09.07 16:25:50 | 000,103,064 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\NPMPDRM.dll [2007.09.07 15:46:48 | 000,098,968 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\NPWMDRMWrapper.dll [2009.03.24 11:10:44 | 000,114,688 | ---- | M] (Zylom) -- C:\Programme\Mozilla Firefox\plugins\npzylomgamesplayer.dll [2010.03.12 20:10:42 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.03.12 20:10:42 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.03.12 20:10:42 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.03.12 20:10:43 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.03.12 20:10:43 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programme\Free Download Manager\iefdm2.dll () O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\kb127\SearchSettings.dll (Vendio Services, Inc.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O4 - HKLM..\Run: [00TCrdMain] C:\Programme\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony) O4 - HKLM..\Run: [cfFncEnabler.exe] File not found O4 - HKLM..\Run: [FingerPrintNotifer] C:\Programme\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc) O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( ) O4 - HKLM..\Run: [HDMICtrlMan] C:\Programme\Toshiba\HDMICtrlMan\HDMICtrlMan.exe (TOSHIBA Corporation.) O4 - HKLM..\Run: [HSON] C:\Programme\Toshiba\TBS\HSON.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [iPassConnect] C:\Program Files\T-Home\Internationaler Zugang\International.exe (iPass, Inc.) O4 - HKLM..\Run: [NDSTray.exe] File not found O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia) O4 - HKLM..\Run: [PwdBank] C:\Programme\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group) O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe () O4 - HKLM..\Run: [SearchSettings] C:\Programme\Search Settings\SearchSettings.exe (Vendio Services, Inc.) O4 - HKLM..\Run: [SmoothView] C:\Programme\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [starter4g] C:\Windows\starter4g.exe (4G Systems GmbH & Co. KG) O4 - HKLM..\Run: [ToADiMon.exe] C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) O4 - HKLM..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA) O4 - HKLM..\Run: [Toshiba Registration] C:\Programme\Toshiba\Registration\ToshibaRegistration.exe (Toshiba) O4 - HKLM..\Run: [Toshiba TEMPRO] C:\Programme\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH) O4 - HKLM..\Run: [TPwrMain] C:\Programme\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [UsbMonitor] C:\Programme\TrueSuite Access Manager\usbnotify.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\.DEFAULT..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com) O4 - HKU\S-1-5-18..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com) O4 - HKU\S-1-5-19..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000..\Run: [] File not found O4 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe (FreeDownloadManager.ORG) O4 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O4 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000..\Run: [TOSCDSPD] C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA) O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Programme\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Programme\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) O4 - Startup: C:\Users\MARKUS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk = C:\Programme\Netzmanager\netzmanager.exe (Deutsche Telekom AG) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Alles mit FDM herunterladen - C:\Program Files\Free Download Manager\dlall.htm () O8 - Extra context menu item: Auswahl mit FDM herunterladen - C:\Program Files\Free Download Manager\dlselected.htm () O8 - Extra context menu item: Datei mit FDM herunterladen - C:\Program Files\Free Download Manager\dllink.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Videos mit FDM herunterladen - C:\Program Files\Free Download Manager\dlfvideo.htm () O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - File not found O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - File not found O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\..Trusted Domains: localhost ([]http in Local intranet) O15 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\fluxhttp {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax () O18 - Protocol\Handler\fluxhttp\0x00000007 {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax () O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - File not found O24 - Desktop WallPaper: C:\Toshiba\WALLPAPERS\Wallpaper1.jpg O24 - Desktop BackupWallPaper: C:\Toshiba\WALLPAPERS\Wallpaper1.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{2693ab39-7d55-11df-ad27-00238b727b03}\Shell - "" = AutoRun O33 - MountPoints2\{2693ab39-7d55-11df-ad27-00238b727b03}\Shell\AutoRun\command - "" = G:\autorun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfPf - Driver SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.dvacm - C:\Programme\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.) Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.) Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2010.08.09 17:08:38 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2010.08.09 10:44:05 | 000,000,000 | ---D | C] -- C:\Programme\Netzmanager [2010.08.09 10:44:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Netzmanager [2010.08.09 10:43:58 | 000,000,000 | -H-D | C] -- C:\ProgramData\{290883D4-FF33-4C80-B8FB-E5D5A89C103B} [2010.08.09 10:43:16 | 000,000,000 | ---D | C] -- C:\Users\MARKUS\AppData\Local\PackageAware [2010.07.24 10:04:14 | 000,000,000 | ---D | C] -- C:\Programme\XMedia Recode [2010.07.21 12:32:57 | 000,000,000 | ---D | C] -- C:\Programme\SDP Multimedia [2010.07.19 14:25:49 | 000,000,000 | ---D | C] -- C:\Users\MARKUS\AppData\Roaming\vlc [2010.07.12 15:14:23 | 000,000,000 | ---D | C] -- C:\Programme\iPod [2010.07.12 15:14:15 | 000,000,000 | ---D | C] -- C:\Programme\iTunes [2010.07.12 15:08:02 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.08.09 20:25:17 | 002,883,584 | -HS- | M] () -- C:\Users\MARKUS\NTUSER.DAT [2010.08.09 20:23:14 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.08.09 20:23:14 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.08.09 17:43:25 | 000,430,204 | ---- | M] () -- C:\Users\MARKUS\Desktop\bookmarks-2010-08-09B [2010.08.09 17:43:01 | 000,430,204 | ---- | M] () -- C:\Users\MARKUS\Desktop\bookmarks-2010-08-09.json [2010.08.09 17:26:11 | 000,075,818 | ---- | M] () -- C:\Users\MARKUS\Documents\cc_20100809_172532.reg [2010.08.09 17:08:40 | 000,000,809 | ---- | M] () -- C:\Users\MARKUS\Desktop\CCleaner.lnk [2010.08.09 14:08:51 | 000,152,064 | ---- | M] () -- C:\Users\MARKUS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.08.09 11:41:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.08.09 10:44:28 | 000,000,903 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk [2010.08.09 10:44:06 | 000,000,919 | ---- | M] () -- C:\Users\Public\Desktop\Netzmanager.lnk [2010.08.09 10:26:45 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{4DBE145B-E9DA-42F0-9ED6-20B5CB287943}.job [2010.08.09 10:23:16 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.08.09 10:23:10 | 3215,831,040 | -HS- | M] () -- C:\hiberfil.sys [2010.08.08 21:53:19 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2010.08.08 21:53:17 | 000,524,288 | -HS- | M] () -- C:\Users\MARKUS\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms [2010.08.08 21:53:17 | 000,065,536 | -HS- | M] () -- C:\Users\MARKUS\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.08.08 21:53:11 | 004,008,736 | -H-- | M] () -- C:\Users\MARKUS\AppData\Local\IconCache.db [2010.08.06 19:15:22 | 001,568,228 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.08.06 19:15:22 | 000,674,582 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.08.06 19:15:22 | 000,634,400 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.08.06 19:15:22 | 000,146,234 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.08.06 19:15:22 | 000,119,964 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.07.24 10:04:15 | 000,000,869 | ---- | M] () -- C:\Users\Public\Desktop\XMedia Recode.lnk [2010.07.21 12:32:58 | 000,000,991 | ---- | M] () -- C:\Users\Public\Desktop\SDP Downloader.lnk [2010.07.19 17:55:14 | 000,010,037 | ---- | M] () -- C:\Users\MARKUS\Documents\Dok2.docx [2010.07.19 17:27:17 | 000,007,052 | ---- | M] () -- C:\Users\MARKUS\AppData\Local\d3d9caps.dat [2010.07.19 14:25:34 | 000,000,864 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk [2010.07.18 15:45:15 | 000,019,456 | ---- | M] () -- C:\Users\MARKUS\AppData\Local\WebpageIcons.db [2010.07.14 22:41:18 | 000,000,240 | ---- | M] () -- C:\Windows\win.ini [2010.07.12 15:15:15 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.08.09 17:43:25 | 000,430,204 | ---- | C] () -- C:\Users\MARKUS\Desktop\bookmarks-2010-08-09B [2010.08.09 17:43:00 | 000,430,204 | ---- | C] () -- C:\Users\MARKUS\Desktop\bookmarks-2010-08-09.json [2010.08.09 17:25:47 | 000,075,818 | ---- | C] () -- C:\Users\MARKUS\Documents\cc_20100809_172532.reg [2010.08.09 17:08:40 | 000,000,809 | ---- | C] () -- C:\Users\MARKUS\Desktop\CCleaner.lnk [2010.08.09 10:44:28 | 000,000,903 | ---- | C] () -- C:\Users\MARKUS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk [2010.08.09 10:44:06 | 000,000,919 | ---- | C] () -- C:\Users\Public\Desktop\Netzmanager.lnk [2010.07.24 10:04:15 | 000,000,869 | ---- | C] () -- C:\Users\Public\Desktop\XMedia Recode.lnk [2010.07.21 12:32:58 | 000,000,991 | ---- | C] () -- C:\Users\Public\Desktop\SDP Downloader.lnk [2010.07.19 17:55:14 | 000,010,037 | ---- | C] () -- C:\Users\MARKUS\Documents\Dok2.docx [2010.07.19 14:25:34 | 000,000,864 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk [2010.07.12 15:15:15 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2009.09.24 08:31:15 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.03.31 12:23:17 | 000,022,723 | ---- | C] () -- C:\Windows\System32\sugo3l3.dll [2009.03.29 14:54:26 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2008.08.07 13:21:21 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1502.dll [2008.07.10 10:18:16 | 000,006,642 | ---- | C] () -- C:\Windows\mgxoschk.ini [2008.07.10 10:05:32 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll [2008.07.10 10:05:32 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll [2008.07.10 10:05:32 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll [2008.07.10 10:05:32 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll [2008.07.10 10:05:32 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll [2008.07.10 10:05:32 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll [2008.07.10 09:58:27 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI [2008.07.10 09:40:25 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini [2008.07.10 09:40:25 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll [2008.07.10 09:40:25 | 000,009,480 | ---- | C] () -- C:\Windows\System32\tosmreg.ini [2008.07.10 09:40:25 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini [2008.07.10 09:30:59 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2008.04.24 19:43:50 | 000,057,344 | ---- | C] () -- C:\Windows\System32\SmartFaceVCapt.dll [2008.04.24 19:42:44 | 000,479,232 | ---- | C] () -- C:\Windows\System32\SmartFaceVCP.dll [2008.04.24 19:25:46 | 006,701,056 | ---- | C] () -- C:\Windows\System32\FaceHI.dll [2008.04.24 19:25:46 | 000,995,328 | ---- | C] () -- C:\Windows\System32\FaceRec.dll [2008.04.24 19:25:46 | 000,126,976 | ---- | C] () -- C:\Windows\System32\SmartFaceVCtrl.dll [2008.04.24 19:23:58 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IppLib.dll [2007.12.21 16:46:32 | 000,118,784 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2005.07.22 21:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll [2003.08.07 21:01:50 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll ========== LOP Check ========== [2010.08.09 20:10:05 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Abine [2009.07.20 09:52:53 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Ashampoo [2010.08.04 19:44:48 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Ceun [2009.05.02 22:29:29 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\DVDFab [2009.08.09 12:46:26 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Feedreader [2010.08.09 20:25:11 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Free Download Manager [2009.12.31 20:42:47 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\FreeFLVConverter [2010.08.04 20:56:34 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Laibel [2009.04.19 10:52:15 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\myphotobook [2010.08.09 17:47:57 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Nokia [2010.03.26 20:04:44 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Nokia Ovi Suite [2009.08.01 18:50:07 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\NSeries [2010.04.12 22:20:17 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\OpenCandy [2009.12.20 13:30:23 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\PC Suite [2010.01.01 18:03:50 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\PersBackup5 [2010.01.01 17:57:27 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Songbird2 [2009.03.29 12:18:55 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\T-Online [2009.09.10 21:03:41 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Template [2009.11.12 18:26:29 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\TOSHIBA [2009.05.26 22:15:34 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Vso [2009.10.06 13:54:51 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\WinBatch [2009.04.04 11:15:22 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\XnView [2010.06.22 10:00:23 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\XSManager [2010.05.30 21:06:52 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\xVideoServiceThief [2010.08.03 22:27:27 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Yqam [2010.08.03 22:27:16 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Yqim [2010.08.08 21:53:20 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2010.08.09 10:26:45 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{4DBE145B-E9DA-42F0-9ED6-20B5CB287943}.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.08.09 20:10:05 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Abine [2009.03.29 04:35:37 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Adobe [2010.07.12 15:19:53 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Apple Computer [2009.07.20 09:52:53 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Ashampoo [2009.03.28 23:34:09 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\ATI [2010.08.04 19:44:48 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Ceun [2010.03.08 09:05:45 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\DivX [2010.06.25 21:03:06 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\dvdcss [2009.05.02 22:29:29 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\DVDFab [2009.08.09 12:46:26 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Feedreader [2010.08.09 20:25:11 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Free Download Manager [2009.12.31 20:42:47 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\FreeFLVConverter [2009.03.28 23:41:18 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Google [2009.03.28 23:33:36 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Identities [2009.03.28 23:29:41 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\InstallShield [2010.08.04 20:56:34 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Laibel [2009.03.29 04:32:36 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Macromedia [2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Media Center Programs [2010.06.04 21:14:30 | 000,000,000 | --SD | M] -- C:\Users\MARKUS\AppData\Roaming\Microsoft [2009.03.28 23:48:22 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Mozilla [2009.04.19 10:52:15 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\myphotobook [2010.04.24 14:01:32 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Nero [2010.08.09 17:47:57 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Nokia [2010.03.26 20:04:44 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Nokia Ovi Suite [2009.08.01 18:50:07 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\NSeries [2010.04.12 22:20:17 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\OpenCandy [2009.12.20 13:30:23 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\PC Suite [2010.01.01 18:03:50 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\PersBackup5 [2010.08.09 17:58:13 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Skype [2010.08.09 17:44:54 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\skypePM [2010.01.01 17:57:27 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Songbird2 [2009.03.29 12:18:55 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\T-Online [2009.09.10 21:03:41 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Template [2009.11.12 18:26:29 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\TOSHIBA [2010.03.16 22:18:29 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\TVU networks [2010.07.19 14:29:12 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\vlc [2009.05.26 22:15:34 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Vso [2009.10.06 13:54:51 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\WinBatch [2009.04.04 11:15:22 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\XnView [2010.06.22 10:00:23 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\XSManager [2010.05.30 21:06:52 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\xVideoServiceThief [2010.08.03 22:27:27 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Yqam [2010.08.03 22:27:16 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Yqim < %APPDATA%\*.exe /s > [2009.05.26 22:15:32 | 000,087,608 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\inst.exe [2010.08.03 19:46:22 | 000,188,152 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Mozilla\Firefox\Profiles\g91g2yyx.default\FlashGot.exe [2007.01.01 18:01:24 | 000,009,728 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\myphotobook\xtras\localVista.exe [2007.01.08 10:34:46 | 000,006,656 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\myphotobook\xtras\localXP.exe [2006.12.21 13:16:20 | 000,021,504 | ---- | M] (Optimum X) -- C:\Users\MARKUS\AppData\Roaming\myphotobook\xtras\shellExecute.exe [2006.12.21 13:16:14 | 000,009,216 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\myphotobook\xtras\sleep.exe [2010.07.09 10:42:45 | 069,222,840 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe [2010.03.05 23:42:26 | 004,004,928 | ---- | M] (Uniblue Systems Ltd ) -- C:\Users\MARKUS\AppData\Roaming\OpenCandy\registrybooster(9).exe [2010.03.16 22:18:41 | 005,514,304 | ---- | M] (TVU networks) -- C:\Users\MARKUS\AppData\Roaming\TVU networks\TVU AutoUpgrade\TVUPlayer2.5.2.2.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2008.03.25 05:22:22 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=2D77788D0B7FE269044F58C86AE099CE -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_3e1ecd89\AGP440.sys [2008.03.25 05:22:22 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=2D77788D0B7FE269044F58C86AE099CE -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.22142_none_ba734aead7ed1bb6\AGP440.sys [2008.03.26 05:38:23 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=ED91751834103DB2A74470CD763A49FE -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_e4087235\AGP440.sys [2008.03.26 05:38:23 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=ED91751834103DB2A74470CD763A49FE -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20800_none_b8b64d46daa7e57a\AGP440.sys [2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2008.03.12 08:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys [2008.03.12 08:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2008.03.12 08:24:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: IASTOR.SYS > [2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys [2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver\IaStor.sys [2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\drivers\iaStor.sys [2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_0813ee45\iaStor.sys [2008.04.15 18:53:44 | 000,312,344 | ---- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_77c04a30\iaStor.sys < MD5 for: IASTORV.SYS > [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll [2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2008.04.07 21:59:42 | 000,372,736 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\System32\ATIDEMGX.dll [2006.11.02 11:46:04 | 000,380,957 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\expsrv.dll [2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll < End of report > 2. Ist es nicht besser die Neuinstallation incl Partition anlegen von einem Fachmann machen zu lassen auch wenns kostet? Eure Beschreibung ist sehr gut, doch bei Partition anlegen etc. kenn ich mich gar nicht aus? Schöne Grüsse Markus |
|
09.08.2010, 20:11
| #6 |
| | Onlinbankingsperre wg Zeus2 Hi, hier ist der andere Report: OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 09.08.2010 20:21:12 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\MARKUS\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 31,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 58,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 150,66 Gb Total Space | 76,82 Gb Free Space | 50,99% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 145,97 Gb Total Space | 140,80 Gb Free Space | 96,46% Space Free | Partition Type: NTFS
Drive F: | 4,20 Gb Total Space | 3,36 Gb Free Space | 79,93% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: MARKUS-PC
Current User Name: MARKUS
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe (Deutsche Telekom AG)
[HKEY_USERS\S-1-5-21-2688840325-2365804445-392268656-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe" "%1" (Deutsche Telekom AG)
htmlfile [opennew] -- "C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe" "%1" (Deutsche Telekom AG)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2CB1B668-E08C-4679-AE9B-C059053D7D5B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{52158ED0-7FE4-44E9-9D6E-D74A2C70D0F7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{64579DF7-687E-4B47-9152-8878A29EC5AB}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{98CEB072-3AC9-4A6F-8C82-EF1246BF567C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{99ED39F7-40A9-4340-B928-CE96706517FB}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{B4BFE370-ED8C-4A02-A3C2-B22523458244}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{C3932497-4F4D-4A15-B22B-8D059E552AB6}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{E4DDF0C1-B845-47C6-9D25-A7B90FAEFA93}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02E6B23E-B75A-40FA-8D68-645206EFEF46}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{09BD1F1C-75CE-42F7-9E27-95786C2B96F9}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{114DC8FD-5B76-41B5-A936-6003BA126818}" = protocol=17 | dir=in | app=c:\windows\system32\cnab4rpk.exe |
"{11A91E33-EA09-44E7-A0A9-DEE9389A1DAC}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{192B2952-71C3-404E-90D6-371E4C87B02E}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{1C8E7182-3E05-4B23-B8E7-8F7A73EB2A99}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{1EDC7D93-B579-4D2F-9DCC-900F414786A8}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{23FA297F-BCA4-4660-A945-517D5F4F2B21}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{29473F39-A159-468A-B6E2-D2842EB25E5F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{2B9633A3-71E4-4A9C-8568-758F23560190}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{34358CD8-CB95-4C37-9EDA-AB52C0DAB897}" = protocol=6 | dir=in | app=c:\windows\system32\cnab4rpk.exe |
"{3F34B8E2-2805-43A8-B642-7459F69A7DAE}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{3FAFB024-9CDA-461F-AD2F-EE24FD777171}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{41A2F8CE-8122-4116-B056-C2DD41E737B2}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4599B02F-D939-4D00-9DCD-99A5F0A912AA}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{4B1CF3B0-4308-42D4-8FB4-EEDBC672E1BF}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{4BBB60C4-491A-402C-A81E-BD0B2B16EFA2}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{527ED8F5-FAA9-4CD2-8221-41B56F282FB6}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{52CCB772-040F-4245-BCDC-387466C4EF20}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{542F0414-D5D4-4014-855A-8BE2A323E61D}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{5A671101-6A52-4BDB-B270-6C2F7EFB895B}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{5AD7D88D-7D87-4D44-80A6-161A64F6259C}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{601A4687-6D3C-4B22-A8BB-BA2204630936}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{61B8A90A-767B-45B8-8417-8698041B047E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{7A7366D4-5E84-4530-8AA3-F1B0B20E6889}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{82239369-C1CB-4546-B917-5D5236077B43}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{845C4846-B37D-4AA8-9B13-12876D69B9FD}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{8F9A0747-03C4-4987-86CB-F36F4E80EE63}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{907B8620-F7E3-47F7-BFED-D0928240C2E4}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{9E0C97E2-5022-4103-AAAC-E068F3F1A611}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{A26F5D92-BFCD-4B47-8DB1-C366BE238913}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{A4F87951-A7FA-4F68-931C-6935B9E9D032}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{A696C0A0-7A25-4749-B6E4-B48985D675DD}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{AE4719EA-3252-42B6-AFC1-297611BD6C03}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{B4FA11C4-C915-4855-B406-98056CF0B1EA}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{B57FF825-3376-48AF-85B1-4E5D540BD91D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BCAD20FF-FC0A-49C7-9CBC-B189738C99CD}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C8161EAC-E540-4C76-8AED-BFE42ED50D5C}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{F90AC71E-33E3-4A51-BF81-5424FA5DB4DB}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{FC79BCA5-9EEC-43BF-8907-678E081411B3}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"TCP Query User{035F3151-7EB9-4600-B26C-6787A4FFF26E}C:\gts\gts.exe" = protocol=6 | dir=in | app=c:\gts\gts.exe |
"TCP Query User{10150D6B-B2ED-4472-AF28-E3397F819365}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"TCP Query User{15F9D7AF-120C-4A87-A406-734747DB6DD3}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{1F9A79A7-1309-4F6B-A332-37D8F9833B8E}C:\gts\gts.exe" = protocol=6 | dir=in | app=c:\gts\gts.exe |
"TCP Query User{3C02E468-127A-47BE-8EBD-A5B6D5D7F03A}C:\program files\zattoo\zattood.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattood.exe |
"TCP Query User{44651961-CC11-40C6-8178-C1B7DDD8AC52}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"TCP Query User{49EE1AFF-39FE-463E-93B5-51D022C27F9D}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{5BE47E59-6061-452C-A2F3-DF43E577FD3C}C:\program files\free download manager\fdm.exe" = protocol=6 | dir=in | app=c:\program files\free download manager\fdm.exe |
"TCP Query User{61E80C6B-4230-449C-9852-859AB80A3E68}C:\gts\update.exe" = protocol=6 | dir=in | app=c:\gts\update.exe |
"TCP Query User{628A8831-42D2-442A-887A-3416A5DC164D}C:\program files\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files\tvants\tvants.exe |
"TCP Query User{63AF4528-CD34-4EAE-927B-72F432964675}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{8BCB7B72-9B85-4BC6-B5D1-35F5EF6CDE22}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"TCP Query User{C024AAA8-39AE-49A2-AD47-414013B1DF04}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{C18D30E0-9EDB-489E-B592-AE8E9A2E427F}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{C49EB9A1-B818-47AE-8ACA-CB315F5B35D5}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"TCP Query User{D635B823-0895-4A8A-8950-2D1C45B929F1}C:\program files\zattoo\zattoo.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattoo.exe |
"TCP Query User{EFE04263-54C9-4EFA-8F11-61692A178B23}C:\gts\update.exe" = protocol=6 | dir=in | app=c:\gts\update.exe |
"TCP Query User{FB0C9EE6-9B60-47B3-8658-9A9A66864773}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe |
"UDP Query User{00866BFE-9DEE-4D8A-B4A8-6854727093F5}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{208757E2-345E-49DB-AC0B-FC977BD49C43}C:\program files\zattoo\zattood.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattood.exe |
"UDP Query User{23650263-A31F-4C92-9164-E29C0282CDA1}C:\gts\gts.exe" = protocol=17 | dir=in | app=c:\gts\gts.exe |
"UDP Query User{259C7BAD-B81B-465A-83EE-BFFC772D7136}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{7FECDE9B-1E9A-49DA-ABEB-A1D1EEA28C6E}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{80F909C3-A146-44E4-9EDF-6736373599CA}C:\program files\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files\tvants\tvants.exe |
"UDP Query User{970C3ED8-21AD-4F83-BC43-DE361B032A11}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{99771BD1-F739-44EB-92FB-B3AAC47A1EA0}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"UDP Query User{B9FB4560-FA55-423A-B732-BC7E77DEAC5E}C:\program files\free download manager\fdm.exe" = protocol=17 | dir=in | app=c:\program files\free download manager\fdm.exe |
"UDP Query User{BB267437-B34F-45BD-85C5-0359DD252B5C}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{BF3346F4-434D-4768-9F28-3FFF6FD612AD}C:\gts\update.exe" = protocol=17 | dir=in | app=c:\gts\update.exe |
"UDP Query User{CC6B4B3E-3548-4951-803C-E0D39169AE6A}C:\gts\gts.exe" = protocol=17 | dir=in | app=c:\gts\gts.exe |
"UDP Query User{D2456704-CECE-403B-9F2F-007CC9AC5ACD}C:\program files\zattoo\zattoo.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattoo.exe |
"UDP Query User{DA7B0229-DCF7-4BE3-933E-A1A59E6674B9}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"UDP Query User{DACF17EB-1285-405C-8F6E-8BFE37213A79}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{E053975E-D638-4EF2-A64E-561475B39EFC}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"UDP Query User{E9A42933-53EC-416A-95C6-77DD84559C25}C:\gts\update.exe" = protocol=17 | dir=in | app=c:\gts\update.exe |
"UDP Query User{F099B628-5A5A-414E-9D37-8AC331C6B29E}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{08233ADA-AA4C-A977-58FD-DB6C684BE010}" = Catalyst Control Center Localization Norwegian
"{0B4C7D42-323A-F3FD-5B18-0222082E6FDD}" = Catalyst Control Center Localization Dutch
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{0D348034-9CBE-19FC-19B0-B2CDC78E50F1}" = ccc-core-static
"{0D5D0BEE-FBA9-4928-A50D-6CDFAB827755}" = TOSHIBA ConfigFree
"{0EABFEF6-6D10-4C12-8667-3029C481D355}" = Nokia Photos
"{10B35323-BE1A-61FB-C4D1-E88F24147617}" = Catalyst Control Center Localization Thai
"{11FC2772-F7FD-21FD-614F-CE58BF52C398}" = Catalyst Control Center Localization Chinese Standard
"{12911298-DDB4-AD44-E530-AEB8127503C9}" = CCC Help Italian
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{156E98D0-1AEC-4013-A41A-94A1A01BFD68}" = O2Micro Flash Memory Card Reader Driver (x86)
"{1714616C-61CE-44D5-AF0B-53404D7FA83A}" = Catalyst Control Center Localization Korean
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18625A47-84A9-6F6C-3780-79221B6095C3}" = CCC Help Norwegian
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{19DC9559-9C20-4A46-A67D-7ECBA52A2788}" = Nokia PC Suite
"{19F62E2F-ABDB-4BE7-A7BB-38DF264D8F72}" = xVideoServiceThief
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1C3F57C7-8474-DF38-8F9F-0EBFB554FD56}" = Catalyst Control Center Localization Hungarian
"{1C971EE3-B4C4-4367-9676-57549919C6CE}" = TOSHIBA Benutzerhandbücher
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{264324EA-35F7-AD77-CC96-F9F47A9A6284}" = Catalyst Control Center Localization Czech
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 20
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2A6F930B-12DA-AD4F-C4A4-E008F73A8016}" = CCC Help English
"{2AEC1EC0-0C01-8831-B04F-41FB4A92B677}" = Catalyst Control Center Localization Spanish
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{31326B80-1D01-4DBA-1DCA-A0731182A2E6}" = CCC Help Korean
"{31DD9FF4-23CD-7898-0305-70D806E2F7DB}" = CCC Help Japanese
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6
"{33AC44A1-81C2-0A61-0EC0-59EFC503A1EA}" = Catalyst Control Center Localization Danish
"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DFE65B6-3AC9-C44A-1160-A449E0DFFE94}" = CCC Help Greek
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{405AE172-0CE0-E2A1-1693-1B120B71AF32}" = Catalyst Control Center Localization Japanese
"{43B74FAB-FB58-447D-8D3A-5F638AF36FD1}" = Netzmanager
"{45D4F727-43B5-49CD-B474-B9866A8F4FB8}" = Nokia Map Loader
"{47D3E4CE-B7D1-4EA7-87E4-ED06F1BB5FA3}" = Internationaler Zugang
"{491DD193-1B57-4D1C-8B14-18B96992A89F}" = TOSHIBA Supervisor Password
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DC3B285-BE6C-E873-42A1-AE221B3BE4F2}" = CCC Help Hungarian
"{4E1CD3D5-D4EE-4246-AE24-F0FD5A60390D}" = OviMPlatform
"{4F77F6EE-2C99-49F7-940A-2E9C208C3BE1}" = Paint.NET v3.5.2
"{52573F8D-F099-4CB5-9EDE-5C27ECB4A02B}" = TOSHIBA Hardware Setup
"{54CAB637-25EA-33FE-2FF4-6F6182BCCF12}" = CCC Help Chinese Standard
"{567AE922-FB8D-943D-921E-B390A2FBD625}" = CCC Help Russian
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5788504C-08BC-E414-C019-60D8E2A2A1EB}" = CCC Help Portuguese
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F65ECEE-EB1D-4C85-8D8C-9C7CE2DBB1D6}" = Marco Polo Mobile Navigator 2
"{60DED9C2-22BF-47A3-B6C8-6B141BA31DFD}" = Ovi Desktop Sync Engine
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69E5255D-9D43-4CFF-8984-843ABD7753B7}" = Catalyst Control Center - Branding
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6BCE01B8-333E-667E-0FC9-5070EA9B8108}" = Catalyst Control Center Localization Swedish
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D3A2A6C-59CD-4A6D-9516-0A34C393ED95}" = Nokia MTP driver
"{6EA4F33E-8F12-AB92-D497-2D454E3C4BB7}" = CCC Help Polish
"{6FB6D968-6E8D-3FCB-1F2D-7ED24FC1BA07}" = CCC Help Swedish
"{7206AFB8-99ED-B788-3DE8-0AE3DBD97B24}" = Catalyst Control Center Localization French
"{72CBC468-82F9-48F8-B5B0-3300387E41AA}" = Nokia Ovi Suite Software Updater
"{732662AE-82C0-9184-CE57-4257695EE1CE}" = CCC Help German
"{73C0DA51-DB32-4F66-970B-7298F3CAF37F}" = Nokia Software Updater
"{754F90E7-DE41-0ADE-2E3F-2C269ED9C2EE}" = CCC Help Finnish
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder
"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
"{7B12F319-43E1-D2DD-ABFE-50E34F76A740}" = Catalyst Control Center Graphics Full New
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C30283C-8DC7-4FBB-805E-52BEA5F580E8}" = Toshiba TEMPRO
"{7CD8E2EF-AD40-7BD3-13E5-2B2847E568DD}" = ATI Catalyst Install Manager
"{7E340EDB-9BF0-5CF2-C12D-7C31992070E3}" = CCC Help Turkish
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{909D42D6-8FCE-4A07-9181-2D9571B122E8}" = GTS
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{911A0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Outlook 2002
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{971F3D40-5145-45D3-A5A2-FAAB5DDF07CA}" = Final Draft 6 Viewer
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AF16DB8-2845-88FE-BDC2-EEF067F9B1EC}" = Catalyst Control Center Graphics Full Existing
"{9E166691-B3ED-0F76-1FE9-AB3DBAAD75DD}" = CCC Help French
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A508C1F7-08EA-4CD4-91F4-A4FC91309FA9}" = GTS der Onvista Bank
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB6FFA58-F491-11D3-8951-000000015799}" = Internationaler Zugang
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch
"{AED994C5-E6CE-0377-09ED-C4000E4189BF}" = Catalyst Control Center Core Implementation
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF899B9E-5842-8839-3EDB-AF9EADF52F45}" = ccc-utility
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B245D989-F88A-C2C3-1958-A91254DEC387}" = Catalyst Control Center Graphics Light
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B3D15F34-F377-26A0-4CCF-2CB47E5810CD}" = CCC Help Dutch
"{B5359AD5-4950-174E-4070-CDB1881B161F}" = CCC Help Czech
"{B547CB8D-549A-436E-97B5-E79F911B11E2}" = SDP Downloader
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{C07CA803-141E-A7C3-13E0-AB99FC5DC7B4}" = Catalyst Control Center Localization Polish
"{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C7838AAD-8B29-86D3-6E04-417C7B7EE628}" = Catalyst Control Center Localization Greek
"{C8585E46-A5C9-8E20-77CA-378D5C291B09}" = Catalyst Control Center Localization Finnish
"{C92C2F87-1E84-A9E5-81F3-3B93DC991A4E}" = Catalyst Control Center Localization Chinese Traditional
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CB01DA5C-48B7-D9A6-22DE-D678D6007C56}" = Catalyst Control Center Localization German
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D05EB4EF-29BE-8031-9AF5-2DC9485D5870}" = Catalyst Control Center Localization Russian
"{D0C73318-7B4A-4D16-A0C4-3B83F075EA88}" = Search Settings 1.2
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D7F069BF-7A9F-6A09-D5AE-E77F8B2E892F}" = CCC Help Danish
"{DA18FD01-4830-45D6-8408-8F20A9D89D95}" = PC Connectivity Solution
"{DA29D017-6E24-481D-BC7C-2B69335A0B3A}" = TrueSuite Access Manager
"{DDC519DE-AC45-634C-C009-6FCE1EF313F3}" = Catalyst Control Center Localization Portuguese
"{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}" = Nokia Ovi Suite
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile-Gerätecenter: Treiberupdate
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E94603CA-2996-4154-8EE2-A5FCD4BFB500}" = Nokia Lifeblog 2.5
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{ED3C1C9D-0496-6884-8B32-8A2B73219C20}" = Catalyst Control Center Localization Italian
"{F0A85260-5B90-4C0E-07FF-72A89AA18F77}" = Skins
"{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA
"{F24E1A94-76DD-85BD-5B6C-6701CC4E8A0F}" = CCC Help Chinese Traditional
"{F4614173-1F8B-A19A-C2CC-57834FBCCE6C}" = CCC Help Spanish
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F81AB80B-5BB7-4E36-8BA5-E07541CE1BFC}" = HDMI Control Manager
"{F89CF986-3AA7-8B20-390A-D5C09F27F85D}" = Catalyst Control Center Localization Turkish
"{F8F37F88-4CB6-9162-AE65-7BBA7E476547}" = Catalyst Control Center Graphics Previews Vista
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"{FFF7CB0F-FA65-7115-2CEC-16C21037C88E}" = CCC Help Thai
"05B59228C7E1C21DFBE89260F879BD95880548D8" = Windows-Treiberpaket - Nokia Modem (10/05/2009 4.2)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"7-Zip" = 7-Zip 4.65
"8CDCFB95BB84DD9C0F88F22266A0CA86035E55BA" = Windows-Treiberpaket - Nokia Modem (06/01/2009 7.01.0.4)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon LBP2900" = Canon LBP2900
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_5051&SUBSYS_1179" = HDAUDIO Soft Data Fax Modem with SmartCP
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDFab 6_is1" = DVDFab 6.0.1.0 (May 15, 2009)
"FeedReader_is1" = FeedReader
"Firebird SQL Server D" = Firebird SQL Server - MAGIX Edition 2.0.0.1 (D)
"FormatFactory" = FormatFactory 2.20
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free FLV Converter_is1" = Free FLV Converter V 6.7.4
"Free YouTube Download_is1" = Free YouTube Download 2.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.3
"Google Desktop" = Google Desktop
"GXTranscoder v2" = GXTranscoder v2
"GXTranscoder_is1" = GX::Transcoder v5.0 Beta 10.8
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{491DD193-1B57-4D1C-8B14-18B96992A89F}" = TOSHIBA Supervisor Password
"InstallShield_{52573F8D-F099-4CB5-9EDE-5C27ECB4A02B}" = TOSHIBA Hardware Setup
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder
"InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition
"InstallShield_{DA29D017-6E24-481D-BC7C-2B69335A0B3A}" = TrueSuite Access Manager
"InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"MAGIX Digital Foto Maker SE D" = MAGIX Digital Foto Maker SE 4.1.0.835 (D)
"MAGIX Foto Suite D" = MAGIX Foto Suite 1.12.0.89 (D)
"MAGIX Online Druck Service D" = MAGIX Online Druck Service 2.3.2.0 (D)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"myphotobook" = myphotobook 3.6
"Netzmanager" = Netzmanager
"Nokia Ovi Suite" = Nokia Ovi Suite
"Nokia PC Suite" = Nokia PC Suite
"oyomo" = Favorit
"Personal Backup_is1" = Personal Backup 5.0
"Picasa 3" = Picasa 3
"Samsung ML-2510 Series" = Samsung ML-2510 Series
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SMPlayer" = SMPlayer 0.6.9
"Songbird-release-1438" = Songbird 1.4.3 (Build 1438)
"SopCast" = SopCast 3.0.3
"SUPER ©" = SUPER © Version 2009.bld.35 (Jan 5, 2009)
"TVAnts 1.0" = TVAnts 1.0
"TVUPlayer" = TVUPlayer 2.4.5.1
"Uninstall_is1" = Uninstall 1.0.0.1
"Videoload Manager" = Videoload Manager 1.0.1545
"VLC media player" = VLC media player 1.1.0
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"XMedia Recode" = XMedia Recode 2.2.4.7
"XnView_is1" = XnView 1.96
"XSManager" = XSManager
"Zattoo4" = Zattoo4 4.0.5
"Zylom Games Player Plugin" = Zylom Games Player Plugin
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 18.04.2010 04:50:45 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description =
Error - 18.04.2010 07:51:01 | Computer Name = MARKUS-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung mcupdate.EXE, Version 6.0.6002.18005, Zeitstempel
0x49e02324, fehlerhaftes Modul KERNEL32.dll, Version 6.0.6002.18005, Zeitstempel
0x49e037dd, Ausnahmecode 0xe0434f4d, Fehleroffset 0x0003fbae, Prozess-ID 0x484,
Anwendungsstartzeit 01cadeed58fa6220.
Error - 18.04.2010 11:32:14 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description =
Error - 18.04.2010 17:26:01 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description =
Error - 18.04.2010 17:28:58 | Computer Name = MARKUS-PC | Source = Application Hang | ID = 1002
Description = Programm cfmain.exe, Version 7.2.0.20 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: dcc Anfangszeit: 01cadf3e07f925ac Zeitpunkt der Beendigung:
0
Error - 19.04.2010 03:00:15 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description =
Error - 19.04.2010 07:50:52 | Computer Name = MARKUS-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung mcupdate.EXE, Version 6.0.6002.18005, Zeitstempel
0x49e02324, fehlerhaftes Modul KERNEL32.dll, Version 6.0.6002.18005, Zeitstempel
0x49e037dd, Ausnahmecode 0xe0434f4d, Fehleroffset 0x0003fbae, Prozess-ID 0xe28,
Anwendungsstartzeit 01cadfb6836a892b.
Error - 19.04.2010 13:54:33 | Computer Name = MARKUS-PC | Source = EventSystem | ID = 4621
Description =
Error - 19.04.2010 16:26:03 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description =
Error - 20.04.2010 02:58:03 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description =
[ OSession Events ]
Error - 12.12.2009 08:27:09 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1234
seconds with 1200 seconds of active time. This session ended with a crash.
Error - 12.12.2009 12:08:17 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 739
seconds with 0 seconds of active time. This session ended with a crash.
Error - 15.12.2009 19:08:51 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 23994
seconds with 180 seconds of active time. This session ended with a crash.
Error - 16.02.2010 16:49:23 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7446
seconds with 300 seconds of active time. This session ended with a crash.
Error - 06.03.2010 11:13:39 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 19209
seconds with 480 seconds of active time. This session ended with a crash.
Error - 02.04.2010 07:30:42 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 194
seconds with 0 seconds of active time. This session ended with a crash.
Error - 24.04.2010 14:31:30 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 198
seconds with 180 seconds of active time. This session ended with a crash.
Error - 17.05.2010 09:28:00 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 15011
seconds with 1380 seconds of active time. This session ended with a crash.
Error - 31.05.2010 16:34:19 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 383
seconds with 60 seconds of active time. This session ended with a crash.
Error - 28.06.2010 14:57:55 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 489
seconds with 300 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 07.08.2010 04:25:42 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 07.08.2010 05:03:04 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 07.08.2010 05:03:04 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 08.08.2010 02:08:07 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 08.08.2010 02:08:07 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 08.08.2010 10:18:08 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 08.08.2010 10:18:08 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 09.08.2010 04:24:55 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 09.08.2010 04:24:55 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 09.08.2010 06:41:28 | Computer Name = MARKUS-PC | Source = cdrom | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.
< End of report >
Ja ich weiß, es sollten 2 sein. Habs erst jetzt geschnallt. Falls sensible Daten in dem report sind-bitte die Postings nach Durchcheck einfach wieder löschen. Schöne Grüsse Markus |
|
09.08.2010, 20:27
| #7 |
| /// Malware-holic | Onlinbankingsperre wg Zeus2 das ist eig quatsch dafür nen fachmann aufzusuchen. windows cd rein, anweisungen folgen, irgendwann kannst du die c partition wählen, dann gibts die punkte schnelles formatieren oder normal, das letztere wählst du. dann wird formatiert und windows wird instaliert. wenn du ne recovery cd hast, geht das automatisch ab. bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix danach schalte den avira guard ab, öffne "mein computer"(arbeitsplatz) dort c: dann rechtsklick auf qoobox, zu qoobox.zip oder rar hinzufügen, und das archiv hochladen. http://www.trojaner-board.de/54791-a...ner-board.html ich geb dir morgen tipps, wie du den pc absichern solltest. |
|
09.08.2010, 21:21
| #8 |
| |  Onlinbankingsperre wg Zeus2 bei combofix ausführen wrant ne Seite mit lautem pieps wg neg Downloadsieten und bezahlung. Zitter? Habe es vom Bleeping computerseite über euer link downgeloaded und geöffnet, aber dann abgebrochen. Braucht es diese logfile wirklich? Verstehe auch das Hochladen nicht ganz, da bei rechtsclick auf C bei mir keine qoobox auftaucht? |
|
09.08.2010, 22:47
| #9 |
| | Onlinbankingsperre wg Zeus2 Hilfe, combofix logfile hochgeladen und seitdem Probelme mit dem T-Online Startcenter, das nicht aufgeht sondern meldet: sie haben das center mit adminsitratorrechten gestartet, es braucht aber nur benutzerrechte, und verlangt für die administartorrechte eine einwilligung? Was heisst das? Krieg meine emailsoftware nicht auf: Schock. |
|
10.08.2010, 08:39
| #10 |
| | Onlinbankingsperre wg Zeus2 Hab die T-online software wieder zum Laufen gekriegt via Systemwiederherstellungspunkt = createrstorepoint otl. Hab Dateien gesafed auf DVD. Will jetzt neuinstallieren: Muß ich das aktuelle infizierte Betriebsystem löschen oder formatieren oder defragmentieren bevor ich die Rediscoverydisk einlege? Was muß ich noch beachten vor Neuinstallation? Dank für Info vom Könner. |
|
10.08.2010, 10:17
| #11 |
| /// Malware-holic | Onlinbankingsperre wg Zeus2 hmm vllt liegts daran das du combofix abgebrochen hast...? du sollst c: öffnen und dann nen rechtsklick auf qoobox machen, aber ohne das log gesehen zu haben kann ich dir nicht sagen was da passiert ist |
|
10.08.2010, 10:41
| #12 |
| | Onlinbankingsperre wg Zeus2 habe gestern nacht 2 Logs aus combofix hochgeladen, allerdings nicht aus qoobox sondern einfach die beiden Kopiert und eingefügt und uploaded ? Falsch? Will jetzt neuausfsetzen kann aber dateien nicht mehr über das DVDlaufwerk sichern, da die dvds als schreibegschützt angegben werden und windows installer settings versucht und dann stoppt mit error 1706. Kann nichts mehr auf dvds speichern, da laufwerk und dvd als schreibgeschützt gemeldet werden. Absichern über usb stick geht. DVD Laufwerk ignorieren und Neuaufsetzen beginnen? |
|
10.08.2010, 22:16
| #13 |
| | Onlinbankingsperre wg Zeus2 Habe Vista neuinstalliert. Hab von einemUSB Stick worddateien, Bilder und Videos geladen - lag alles vor der Zues2 Infektion. Kann ich von einer DVD+USB Stick Back Ups, die nach der Zeus2 Infektion lagen, laden? Geht um Worddateien, JPEG und MMS vom handy, Emails aus der T-onlinesoftware incl Adressbuch. Hab Angst, daß der /Die Torjaner dann wieder kommen. ?? Sehr dankbar für Hilfe MB |
|
11.08.2010, 10:36
| #14 |
| /// Malware-holic | Onlinbankingsperre wg Zeus2 hi, du kannst die dvd ja scannen. aber erst mal n paar tipps, um den pc abzusichern. Standard nutzer einrichten. standard und admin konto sollten natürlich beide passwort geschützt sein. klicke start, tippe unter suchen (ausführen) systemsteuerung. wähle dort Benutzerkonten hinzufügen/entfernen. wähle "neues konto erstellen" Wähle standard benutzer. wenn du jetzt auf das neue konto klickst, kannst du ein kennwort vergeben, das solltest du natürlich auch für das admin konto machen. windows vista kann bei instalationen kurzfristig höhere rechte vergeben von daher sollten instalationen im standard konto möglich sein. 2. dep für alle prozesse: Datenausführungsverhinderung (DEP) • "Datenausführungsverhinderung für alle Programme und Dienste mit Ausnahme der ausgewählten einschalten:". wenn es zu problemen kommen sollte, kann man die betroffenen prozesse aus der Überwachung entfernen. 3. SEHOP aktivieren: Aktivieren von SEHOP (Structured Exception Handling Overwrite Protection) in Windows-Betriebssystemen klicke auf "Feature automatisch aktivieren" und folge den anweisungen 4. firefox, http://filepony.de/download-noscript// hiermit werden java und sonstige scripts blokiert, wenn du für irgend eine seite freigaben benötigst, rechtsklick auf der seite, noscript, alle beschrenkungen aufheben, hebt sie dauerhaft auf, temporär nur für den jeweiligen besuch, du kannst die enderungen natürlich auch rückgängig machen. adblock zum werbung blocken: Adblock Plus: Bekannte Filterlisten für Adblock Plus nimm dir 2 deutsche filter + malware filter liste. 5. um das surfen sicherer zu machen, würde ich Sandboxie empfehlen. Download: drop.io (als pdf) wenn du mit dem programm gut auskommst, ist ne lizenz zu empfehlen. 1. es gibt dann noch ein paar mehr funktionen. 2. kommt nach nem monat die anzeige, dass das programm freeware ist, die verschwindet erst nach ner zeit, find ich n bissel nerfig. 3. ist die lizenz lebenslang gültig, kostenpunkt rund 25 €, und du kannst sie auf allen pcs in deinem haushalt einsetzen. 6. update checker: würde da secunia http://www.trojaner-board.de/83959-s...ector-psi.html und file hippo laufen lassen: FileHippo.com - Download Free Software windows updates und servicepacks hast du ja hoffendlich schon alle instaliert. |
|
11.08.2010, 12:18
| #15 |
| | Onlinbankingsperre wg Zeus2 Danke MarkusG. Hab die Combo LOgs vorgestern wirklich hochgeladen. Jetzt Alles gemacht ausser Sehop - wichtig? Beim Scan mit AV der USB sticks und DVDs hab ich nur 1 Warnung im Protokoll ohne nähere angaben wovor genau. Ignorieren? |
|
| Themen zu Onlinbankingsperre wg Zeus2 |
| 32 bit, aktuelle, antivir, bilder, computer, edition, emails, frage, freeware, gefährlich, gesperrt, home, home premium, komplett, passwörter, quarantäne, scan, service, service pack 2, system, trojaner, version, virenscan, vista, vista home premium, windows, windows vista, windows vista home, worddateien |
Linear-Darstellung
