Trojaner-Board - Aus sicherheitsgründe wurde ihr system blockiert! Was nun?

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Aus sicherheitsgründe wurde ihr system blockiert! Was nun? (https://www.trojaner-board.de/113287-sicherheitsgruende-wurde-system-blockiert.html)

Aus sicherheitsgründe wurde ihr system blockiert! Was nun?

Guten Abend,

mich hat es nun auch erwischt und bin verzweifelt. Ich schalte meinen pc an und es erscheint nach wenigen sekunden die meldung: "Aus Sicherheitsgründen wurde Ihr System blockiert".... 50 euro....
Jetzt weiß ich nicht weiter. Habe schon mit pc tools spyware doctor einen vollscan durchgeführt und hab alles entfernen lassen aber nichts hat geholfen.

Ich bitte um schnelle Rückmeldung

Danke im voraus,

Amina

Hallo nochmal,

so nach eweiger recherche haha hab ich endlich mal die logs herraus bekommen hihi. So schicke diese jetzt und hoffe auf eine Analyse eurerseits....
hier der log von malwarebytes:

Code:

 Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.07.08
 

Windows Vista Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 8.0.6001.19088

Amina :: AMINA-PC [Administrator]
 

Schutz: Deaktiviert
 

07.04.2012 22:22:55

mbam-log-2012-04-07 (23-36-19).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 328969

Laufzeit: 57 Minute(n), 25 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 4

C:\Users\Amina\SoftonicDownloader_fuer_malwarebytes-anti-malware.exe (PUP.BundleOffer.Downloader.S) -> Keine Aktion durchgeführt.

C:\Users\Amina\AppData\Local\Temp\ms0cfg32.exe (Trojan.Zbot.Gen) -> Keine Aktion durchgeführt.

C:\Users\Amina\AppData\Local\Temp\~!#E28.tmp (Trojan.FakeAlert) -> Keine Aktion durchgeführt.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\295e1581-79c0cbcd (Trojan.Zbot.Gen) -> Keine Aktion durchgeführt.
 

(Ende)

den eset log schick ich später

Zitat:

C:\Users\Amina\SoftonicDownloader_fuer_malwarebytes-anti-malware.ex

Finger weg von Softonic!!

Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller und nicht von solchen Toolbarklitschen wie Softonic! Im Notfall würde natürlich chip.de gehen

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

ich hab ganz viele logdateien. Kann mich garnicht errinern, dass ich das programm sooft genutzt habe.

Code:

 Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 8286
 

Windows 6.0.6001 Service Pack 1 (Safe Mode)

Internet Explorer 7.0.6001.18000
 

01.12.2011 21:05:11

mbam-log-2011-12-01 (21-05-11).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 164537

Laufzeit: 3 Minute(n), 12 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 4

Infizierte Verzeichnisse: 0

Infizierte Dateien: 1
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (hxxp://startsear.ch/?aff=1&cf=398d9d53-1542-11e1-96d2-001e33801692) Good: (hxxp://www.google.com) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (hxxp://startsear.ch/?aff=1&cf=398d9d53-1542-11e1-96d2-001e33801692) Good: (hxxp://www.google.com) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\Users\Amina\AppData\Local\Temp\wteelvepglzm32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Code:

 Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 8286
 

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000
 

01.12.2011 21:24:29

mbam-log-2011-12-01 (21-24-29).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|F:\|)

Durchsuchte Objekte: 57659

Laufzeit: 12 Minute(n), 44 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Code:

 Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 8286
 

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000
 

01.12.2011 21:39:13

mbam-log-2011-12-01 (21-39-13).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 167665

Laufzeit: 7 Minute(n), 16 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 2

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Code:

 Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 8364
 

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000
 

13.12.2011 22:20:56

mbam-log-2011-12-13 (22-20-56).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 170617

Laufzeit: 14 Minute(n), 53 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 1

Infizierte Registrierungsschlüssel: 13

Infizierte Registrierungswerte: 4

Infizierte Dateiobjekte der Registrierung: 1

Infizierte Verzeichnisse: 0

Infizierte Dateien: 1
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

c:\program files\vshare.tv plugin\BarLcher.dll (PUP.VShareRedir) -> Delete on reboot.
 

Infizierte Registrierungsschlüssel:

HKEY_CLASSES_ROOT\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Value: {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Value: {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Value: {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Value: {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\program files\vshare.tv plugin\BarLcher.dll (PUP.VShareRedir) -> Delete on reboot.

Zitat:

Keine Aktion durchgeführt.
-> No action taken.

Im letzen Lauf von Malwarebytes am 07.04.12 hast du die Funde offensichtlich nicht oder doch?
Die Funde müssen mit Malwarebytes entfernt waren! Bitte nachholen falls noch nicht getan!

hmm habe die dateien, welche unter qarantäne waren nun gelöscht???
oder was sollte ich tun???

aminaaa

Die Frage war ob du die gestern entfernt hast!
Da du das offensichtlich nicht mehr weißt, würde ich dich jetzt bitten einen neuen Vollscan mit Malwarebytes zu machen. Denk vorher daran auf den Updatebutton bei Malwarebytes zu klicken, denn das muss immer so aktuell wie nur möglich sein.

Lass beim Vollscan alles überprüfen! Alle Laufwerke nur CD/DVD kannst du rausnehmen

achso doch hatte ich getan :)

Führ bitte auch ESET aus, danach sehen wir weiter:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

sooo bitteee

Code:

 ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=3d6dc36115e1df41805cece27b35578c

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-04-08 09:22:11

# local_time=2012-04-08 11:22:11 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6001 NT Service Pack 1

# compatibility_mode=1024 16777215 100 0 63187692 63187692 0 0

# compatibility_mode=1792 16777215 100 0 11969428 11969428 0 0

# compatibility_mode=2560 16777215 100 0 0 0 0 0

# compatibility_mode=5892 16776574 100 100 63412322 171446278 0 0

# compatibility_mode=8192 67108863 100 0 77897 77897 0 0

# scanned=147134

# found=9

# cleaned=0

# scan_time=6581

C:\Program Files\GridinSoft Trojan Killer\trojankiller.exe        a variant of Win32/1AntiVirus application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Amina\SoftonicDownloader_fuer_malwarebytes-anti-malware.exe        Win32/SoftonicDownloader application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Amina\AppData\Local\Skype\SkypePM.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Amina\AppData\Local\Temp\ms0cfg32.exe        a variant of Win32/Kryptik.ADUY trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Amina\AppData\Local\Temp\Update_7276.exe        a variant of Win32/MessengerPlus.A application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Amina\AppData\Local\Temp\~!#1CE8.tmp        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Amina\AppData\Local\Temp\~!#E28.tmp        a variant of Win32/Kryptik.ADUC trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\295e1581-79c0cbcd        a variant of Win32/Kryptik.ADUY trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Amina\Downloads\MsgPlusLive-483.exe        a variant of Win32/Adware.CiDHelp application (unable to clean)        00000000000000000000000000000000        I

Ahja, soviel zum Thema du hast alles mit Malwarebytes entfernt :balla:
ESET hat das gleiche nochmal gefunden, kann kaum sein, dass du das mit Malwarebytes entfernt hast!

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":Files" muss mitkopiert werden!!!)

Code:

:Files

C:\Program Files\GridinSoft Trojan Killer\trojankiller.exe

C:\Users\Amina\SoftonicDownloader_fuer_malwarebytes-anti-malware.exe

C:\Users\Amina\AppData\Local\Skype\SkypePM.exe

C:\Users\Amina\AppData\Local\Temp\*.exe

C:\Users\Amina\AppData\Local\Temp\~*

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\

C:\Users\Amina\Downloads\MsgPlusLive-483.exe

:Commands

[purity]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

upps sorry :)

Code:

========== FILES ==========

C:\Program Files\GridinSoft Trojan Killer\trojankiller.exe moved successfully.

C:\Users\Amina\SoftonicDownloader_fuer_malwarebytes-anti-malware.exe moved successfully.

C:\Users\Amina\AppData\Local\Skype\SkypePM.exe moved successfully.

C:\Users\Amina\AppData\Local\Temp\GC_PCTOOLS.exe moved successfully.

C:\Users\Amina\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe moved successfully.

C:\Users\Amina\AppData\Local\Temp\ms0cfg32.exe moved successfully.

C:\Users\Amina\AppData\Local\Temp\Shortcut_sweetimsetup[1].exe moved successfully.

C:\Users\Amina\AppData\Local\Temp\SHSetup.exe moved successfully.

C:\Users\Amina\AppData\Local\Temp\SIMEEIInstaller.exe moved successfully.

C:\Users\Amina\AppData\Local\Temp\Update_7276.exe moved successfully.

C:\Users\Amina\AppData\Local\Temp\~!#1CE8.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~!#E28.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~DF2D37.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~DF5B00.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~DF5B0E.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~DF5B54.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~DF5B5A.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~DF5B85.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~DF5B8A.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~DF66D4.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~DF96C9.tmp moved successfully.

C:\Users\Amina\AppData\Local\Temp\~DFEF1B.tmp moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\4b13650b-5bb6b22e-n folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.

C:\Users\Amina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.

C:\Users\Amina\Downloads\MsgPlusLive-483.exe moved successfully.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.39.2 log created on 04092012_000229

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus wieder uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

1. also am anfang hat er etwas gesponnen und was von fehlermeldung 2 geschrieben (malwarebytes) und es erscheint unten: einige autostartprogramme wurden blockiert..
2. jo alle programme noch da

klasse!

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 12.04.2012 23:12:20 - Run 1

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Amina\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19088)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,75 Gb Total Physical Memory | 1,81 Gb Available Physical Memory | 65,82% Memory free

5,72 Gb Paging File | 4,34 Gb Available in Paging File | 75,85% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 116,29 Gb Total Space | 75,79 Gb Free Space | 65,18% Space Free | Partition Type: NTFS

Drive E: | 115,13 Gb Total Space | 109,00 Gb Free Space | 94,67% Space Free | Partition Type: NTFS

 

Computer Name: AMINA-PC | User Name: Amina | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htafile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

"DoNotAllowExceptions" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{90C26590-4008-4BD9-9809-286FCD4AD5C2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{CD520BB4-A46A-4977-8DA0-7D4E86D878F4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{D5BC8CFE-E698-44A5-B098-AE72BAE62956}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{E2168A3A-C789-4925-B814-AC4F1D05A223}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{F7A62527-45C0-4327-B342-DDAF7CF954BC}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{FBCE804C-35A1-4B18-BC80-EA3EABE306AC}" = lport=2869 | protocol=6 | dir=in | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{277F432B-1C7E-4AE4-A1D1-ED76CF991A61}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | 

"{4C30D51E-22D7-45B1-928A-C7FD5C0C526C}" = protocol=6 | dir=in | app=c:\users\amina\appdata\local\temp\update_79df.exe | 

"{527EB562-C7EA-4748-9502-2C8023D7B678}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{5FC3C2FD-613F-420B-8AA8-5D5168555AC0}" = dir=in | app=c:\program files\avg\avg9\avgnsx.exe | 

"{7F35675E-0D2F-402B-A7EA-5E93C61ADDB3}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{885E0C28-D9E3-4D6C-950E-5ECB9A959F5F}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 

"{886F3712-4944-4CFB-A603-127C649BAEA5}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{9299904B-1562-4A99-B173-23D2A275AC76}" = dir=in | app=c:\program files\avg\avg9\avgupd.exe | 

"{935482B0-C85F-4341-8CE2-34DEFF131B3C}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{9A5420DC-F2D5-4A9B-AC3D-5ABD2B102E02}" = dir=in | app=c:\program files\avg\avg9\avgemc.exe | 

"{A45FF9EB-E2CD-4A06-9ED9-77A0ED1073A6}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 

"{AC60A897-EC4C-44A2-B613-191075F604A4}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{B980BBE2-0A10-466A-94DA-EC3F61C143D7}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{BCEC328C-8B93-41A0-91EF-C2EEE0A1F627}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{DBEF0362-A2E1-48DB-9E6B-791E8A52E2D4}" = protocol=17 | dir=in | app=c:\users\amina\appdata\local\temp\update_79df.exe | 

"TCP Query User{5144ADA6-7304-4B5B-A7E1-D9BA59BAF081}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"UDP Query User{A983EBA7-3AEC-4D21-94D9-485E86E98D6A}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02CA24DD-C8B0-4280-BE53-7862869C2EB1}" = Realtek WiFi Protected Setup Library

"{03FAA727-E2B7-471C-AC41-2E1C7F29C7EA}" = Toshiba TEMPRO

"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour

"{07C9627A-CA0B-2AA2-062E-204359DF7BA1}" = Catalyst Control Center Core Implementation

"{0D5D0BEE-FBA9-4928-A50D-6CDFAB827755}" = TOSHIBA ConfigFree

"{0EFB2016-41D2-5F30-8F60-25250F6DABDD}" = CCC Help Thai

"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist

"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime

"{1C971EE3-B4C4-4367-9676-57549919C6CE}" = TOSHIBA Benutzerhandbücher

"{1E57A11B-AB65-C6D1-F999-B3B37AB2298E}" = Catalyst Control Center Localization Japanese

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 30

"{27265B80-303E-EFFF-6052-B11F91B634C3}" = Catalyst Control Center Localization Italian

"{2883F6F5-0509-43F3-868C-D50330DD9DD3}" = TOSHIBA Hardware Setup

"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1

"{2920435D-CE92-5024-1694-DFD43A5FF074}" = Catalyst Control Center Localization Greek

"{2CD6D3D2-1EFC-F0B4-1761-FD4FA7F8750F}" = CCC Help Finnish

"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform

"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7

"{358004B9-3A16-87FF-4487-4D6F0C70E52F}" = Catalyst Control Center Localization Russian

"{38A3E884-313A-7AE0-11BC-482DE0C8766A}" = CCC Help Czech

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{3BB12DBC-0A8E-ECE2-F179-D06B99B8CD02}" = Catalyst Control Center Localization Czech

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3E0E28DC-DA90-1BA2-FA36-AA3C2E4FB74A}" = Catalyst Control Center Graphics Previews Vista

"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4B1E87C3-00DE-4898-8E39-E390AAEF2391}" = TOSHIBA Supervisor Password

"{4C90501F-864B-5AC4-867D-6AC35BE50721}" = ccc-utility

"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent

"{55398A75-13E0-570F-BD16-2EE5D9E5523D}" = Catalyst Control Center Localization Norwegian

"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator

"{5F131988-3326-AD64-1817-D76A2FE3C2D3}" = CCC Help Chinese Traditional

"{5FBF37CD-B7F9-564C-BDFC-73D970CF7AF2}" = CCC Help Italian

"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center

"{61C63422-E5E2-8576-2B82-0E01F5AD2538}" = CCC Help English

"{61F90A4F-AD49-7FFB-F027-5B2CB64F0A70}" = Catalyst Control Center Graphics Light

"{629044C7-745A-64B8-467F-2F93ED50008B}" = CCC Help Chinese Standard

"{65BF23C0-4EF9-27CC-7B6F-190F4008A569}" = Catalyst Control Center Localization Polish

"{65D602E4-DCDE-0743-6A0A-F1A203449F47}" = CCC Help German

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{69E5255D-9D43-4CFF-8984-843ABD7753B7}" = Catalyst Control Center - Branding

"{6B4874CA-13CF-2477-B697-B448201B56B6}" = CCC Help Norwegian

"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER

"{6EB0B23B-AA51-6F4E-C94C-C1015ED61EEC}" = CCC Help Japanese

"{70495081-1DC8-AD4B-C197-12138B8FBC9E}" = CCC Help Danish

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{71B929E2-3556-93DB-DEC0-FD56D3EFB473}" = Catalyst Control Center Localization Chinese Traditional

"{71C47830-182D-79FA-0790-0366E6E2C2EB}" = Catalyst Control Center Localization Spanish

"{75438C0E-9925-412E-AD85-D0E71C6CE2ED}" = CamMaestro 5.7SP build PC Camera

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder

"{77CAD946-C573-6647-B222-B6870C072932}" = CCC Help Korean

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{7E83516C-931B-870F-5CDF-01FDF9A4AEF0}" = Catalyst Control Center Localization Turkish

"{86728841-C151-B8E4-43C6-DD289DE570B6}" = Catalyst Control Center Localization Swedish

"{86DBA852-5D5E-1856-D828-620E792EDC0D}" = Catalyst Control Center Localization Chinese Standard

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver

"{88BA2601-8A62-7AB7-DB8A-7AA2840B7C87}" = Catalyst Control Center Localization Thai

"{895722FE-25FE-4854-95AC-B0C42F9DBEDA}" = REALTEK RTL8187B Wireless LAN Driver

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)

"{8B587895-7716-1B99-5D85-3CA4AAF8A0F4}" = Catalyst Control Center Localization Dutch

"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update

"{9244F321-0BBD-9D4A-C1FB-6437E3D0550D}" = Catalyst Control Center Localization German

"{93F3EBDD-4007-C233-7320-977AC0941054}" = CCC Help Turkish

"{94AB6CE0-DB26-7048-2A5B-4647EA1FC693}" = ccc-core-static

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer

"{A103C127-2168-4493-8D01-4BF180BED12C}" = CCC Help Portuguese

"{A7F27ADB-3C56-0F2B-6B4B-0B8E02A49186}" = ATI Catalyst Install Manager

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support

"{AC2EE52D-05CD-8140-5D29-5AA29590971E}" = CCC Help French

"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.4 - Deutsch

"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger

"{B02A78AE-EA3B-8261-AEBC-8221E22DCC1E}" = CCC Help Polish

"{B1D67B62-35A8-A9A1-AA74-F6A495C8271A}" = Catalyst Control Center Localization Danish

"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar

"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser

"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator

"{BC2EA92A-A5A9-A137-5204-F150EDB05DB3}" = CCC Help Hungarian

"{BC713970-8C3C-852B-4139-636F21114B7F}" = CCC Help Dutch

"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)

"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail

"{C5F1A9C4-C041-2E95-5D7E-EF56CED2B522}" = Skins

"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CF2D9590-457B-4842-912D-8D16A69ECC43}" = PowerTeacher GL

"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call

"{D7CC05AF-067D-0D1A-1E4D-9DCBCDCC2D41}" = Catalyst Control Center Graphics Full New

"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader

"{E0FC3A5D-CF52-ABA7-92EF-D9794F372121}" = Catalyst Control Center Graphics Full Existing

"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe

"{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher

"{EA7D1919-A6BF-979A-E3A2-F753E23D45FA}" = Catalyst Control Center Localization Hungarian

"{ec4b6105-e039-42fb-8e18-c8aa393f0018}_is1" = VshareComplete

"{ED2BC5D9-20EE-FBB6-8483-240F19EFCAA5}" = CCC Help Swedish

"{F0345A2F-1D78-0AEA-7CBB-CEF48622EB44}" = Catalyst Control Center Localization Portuguese

"{F0646787-1A2F-34E9-A61D-9DAD69F606F8}" = CCC Help Spanish

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA

"{F3C1DE9E-5E16-4BA9-B854-7B53A45E3579}" = Cisco Systems VPN Client 5.0.05.0290

"{F439D7AF-03F3-4F8E-AEC4-571BFE977C61}" = iTunes

"{F50E4D66-5280-FDF8-7F55-2E47FCF23E7D}" = Catalyst Control Center Localization Korean

"{F67E6AE5-F87B-025F-2D6B-26491304393F}" = CCC Help Russian

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{F9DAAC4B-5E3F-1D39-9D4B-6998664EF402}" = Catalyst Control Center Localization Finnish

"{F9F66B99-C1B3-ACEA-1F80-404CC4DD96BF}" = Catalyst Control Center Localization French

"{FA493449-3E34-4E05-8CA7-26A42E9F180E}" = CCC Help Greek

"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone-Konfigurationsprogramm

"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner

"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"AVG9Uninstall" = AVG Free 9.0

"Avira AntiVir Desktop" = Avira Free Antivirus

"Browser Defender_is1" = Browser Defender 4.0

"ESET Online Scanner" = ESET Online Scanner v3

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2

"FreePDF_XP" = FreePDF (Remove only)

"Google Desktop" = Google Desktop

"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center

"InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder

"InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher

"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000

"Messenger Plus!" = Messenger Plus! 5

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Mozilla Firefox (3.6.23)" = Mozilla Firefox (3.6.23)

"myphotobook" = myphotobook 3.6

"Picasa 3" = Picasa 3

"PriceGong" = PriceGong 2.6.3

"RealPlayer 12.0" = RealPlayer

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"Spyware Doctor" = PC Tools Spyware Doctor 9.0

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"TOSHIBA Software Modem" = TOSHIBA Software Modem

"Uninstall_is1" = Uninstall 1.0.0.1

"VLC media player" = VLC media player 1.0.5

"vShare.tv plugin" = vShare.tv plugin 1.3

"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner

"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe

"WinLiveSuite_Wave3" = Windows Live Essentials

"WordToPDF_is1" = WordToPDF 2.5

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-448799688-2289312494-2834332062-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 02.04.2012 12:24:45 | Computer Name = Amina-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 03.04.2012 07:57:38 | Computer Name = Amina-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 03.04.2012 18:00:20 | Computer Name = Amina-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 04.04.2012 07:14:09 | Computer Name = Amina-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 04.04.2012 08:54:29 | Computer Name = Amina-PC | Source = EventSystem | ID = 4621

Description = 

 

Error - 04.04.2012 10:02:54 | Computer Name = Amina-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 04.04.2012 14:39:58 | Computer Name = Amina-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 05.04.2012 05:36:41 | Computer Name = Amina-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 05.04.2012 07:41:30 | Computer Name = Amina-PC | Source = EventSystem | ID = 4621

Description = 

 

Error - 05.04.2012 15:08:17 | Computer Name = Amina-PC | Source = WinMgmt | ID = 10

Description = 

 

[ System Events ]

Error - 10.04.2012 17:35:04 | Computer Name = Amina-PC | Source = netbt | ID = 4321

Description = Der Name "AMINA-PC       :20" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.21  registriert werden. Der Computer mit IP-Adresse 192.168.178.20

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 10.04.2012 17:35:04 | Computer Name = Amina-PC | Source = netbt | ID = 4321

Description = Der Name "AMINA-PC       :0" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.21  registriert werden. Der Computer mit IP-Adresse 192.168.178.20

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 11.04.2012 07:10:01 | Computer Name = Amina-PC | Source = HTTP | ID = 15016

Description = 

 

Error - 11.04.2012 07:15:49 | Computer Name = Amina-PC | Source = Service Control Manager | ID = 7022

Description = 

 

Error - 11.04.2012 07:27:18 | Computer Name = Amina-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 11.04.2012 13:02:26 | Computer Name = Amina-PC | Source = HTTP | ID = 15016

Description = 

 

Error - 12.04.2012 07:04:13 | Computer Name = Amina-PC | Source = HTTP | ID = 15016

Description = 

 

Error - 12.04.2012 10:38:48 | Computer Name = Amina-PC | Source = HTTP | ID = 15016

Description = 

 

Error - 12.04.2012 14:29:53 | Computer Name = Amina-PC | Source = HTTP | ID = 15016

Description = 

 

Error - 12.04.2012 14:31:35 | Computer Name = Amina-PC | Source = Print | ID = 54

Description = Das Dokument hxxp://www.forcabarca.com/bas/ar konnte nicht gedruckt

 werden und wurde aufgrund einer Beschädigung an der gespoolten Datei gelöscht. 

Der zugewiesene Treiber ist "Brother HL-2030". Versuchen Sie erneut, das Dokument

 zu drucken.

 

 

< End of report >

--- --- ---