| |
| |||||||
Log-Analyse und Auswertung: Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
05.10.2011, 05:58
| #1 | |
| |  Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Hallo, also ich habe folgendes Problem; Mir schmiert seit einer ewigkeit öfters mal meine Inet Verbindung ab, gerade wenn ich mich im Teamspeak aufhalte. Und das ist natürlich ärgerlich. Das nahm ich zum Grund um den Spyware Terminator vom PC zu schmeißen, mir den Avira wieder zu loaden + den SpywareBot . Weder der Avira noch der Spyware Terminator haben mir vorher jemals folgende meldung bzw folgende Objekte(Funde) nach einem Scan angezeigt Zitat:
Ich habe mir die OTL.exe gezogen und alles wie angefordert gemacht,Inetverbinung gekappt,Scanner aus und das Programm laufen lassen wobei dieser Log entstand. ( Da ich es iwie nicht hinbekomme diesen als anhang zu packen muss ich den leider so Posten -.- Ich hoffe es kann mir trotzdem jemand helfen, ich bin halt mehr ein Laie in sowas und bin absolut verzweifelt grad  OTL Logfile: Code:
ATTFilter OTL logfile created on: 04.10.2011 20:10:37 - Run 2 OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\XXX\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,75 Gb Total Physical Memory | 1,10 Gb Available Physical Memory | 62,70% Memory free 3,74 Gb Paging File | 2,85 Gb Available in Paging File | 76,24% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 74,37 Gb Total Space | 21,12 Gb Free Space | 28,40% Space Free | Partition Type: NTFS Drive E: | 73,21 Gb Total Space | 67,95 Gb Free Space | 92,81% Space Free | Partition Type: NTFS Computer Name: XXX-PC | User Name: XXX | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\XXX\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\ProgramData\DatacardService\DCService.exe () PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.) PRC - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.) PRC - C:\Programme\Toshiba TEMPRO\TempoSVC.exe (Toshiba Europe GmbH) PRC - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION) PRC - C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation) PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - c:\Programme\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation) PRC - c:\Programme\TOSHIBA\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation) PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) PRC - C:\Windows\tsnp2std.exe () PRC - C:\Windows\vsnp2std.exe (Sonix) PRC - C:\Windows\FixCamera.exe () PRC - C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.) ========== Modules (No Company Name) ========== MOD - C:\Windows\System32\atitmmxx.dll () MOD - C:\Windows\tsnp2std.exe () MOD - C:\Windows\FixCamera.exe () ========== Win32 Services (SafeList) ========== SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (DCService.exe) -- C:\ProgramData\DatacardService\DCService.exe () SRV - (SBSDWSCService) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.) SRV - (TempoMonitoringService) -- C:\Program Files\Toshiba TEMPRO\TempoSVC.exe (Toshiba Europe GmbH) SRV - (ConfigFree Service) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION) SRV - (TNaviSrv) -- C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (TosCoSrv) -- c:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation) SRV - (TOSHIBA SMART Log Service) -- c:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation) SRV - (TODDSrv) -- C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) SRV - (UleadBurningHelper) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.) ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (huawei_enumerator) -- C:\Windows\System32\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (ew_hwusbdev) -- C:\Windows\System32\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.) DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (SPC530) -- C:\Windows\System32\drivers\SPC530.sys ( ) DRV - (SPC530m) -- C:\Windows\System32\drivers\SPC530m.sys ( ) DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation ) DRV - (tos_sps32) -- C:\Windows\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation) DRV - (RTHDMIAzAudService) -- C:\Windows\System32\drivers\RtHDMIV.sys (Realtek Semiconductor Corp.) DRV - (RTL8187B) -- C:\Windows\System32\drivers\rtl8187B.sys (Realtek Semiconductor Corporation ) DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.) DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab) DRV - (SNP2STD) USB2.0 PC Camera (SNP2STD) -- C:\Windows\System32\drivers\snp2sxp.sys () DRV - (RtlProt) -- C:\Windows\System32\drivers\RtlProt.sys (Windows (R) Codename Longhorn DDK provider) DRV - (MRV6X32U) -- C:\Windows\System32\drivers\MRVW23B.sys (Bluemedia) DRV - (FwLnk) -- C:\Windows\System32\drivers\FwLnk.sys (TOSHIBA Corporation) DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.) DRV - (tdcmdpst) -- C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.) DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI) DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI) DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Search IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "Search" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.jappy.de/" FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.6.0 FF - prefs.js..extensions.enabledItems: {9d1f059c-cada-4111-9696-41a62d64e3ba}:0.7.1 FF - prefs.js..extensions.enabledItems: {7E77F5DF-8022-40e3-9122-F03DEBEFC43B}:1.0.24 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: quickstores@quickstores.de:1.2.0 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2 FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\XXX\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\XXX\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\XXX\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.08 02:34:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.21 02:11:34 | 000,000,000 | ---D | M] [2009.01.15 17:30:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions [2011.09.25 20:05:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions [2010.04.27 09:46:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.09.06 20:53:08 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8} [2010.04.04 19:37:56 | 000,000,000 | ---D | M] ("PsicoTSI") -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\{7E77F5DF-8022-40e3-9122-F03DEBEFC43B} [2011.06.09 04:46:26 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2011.06.09 04:46:28 | 000,000,000 | ---D | M] (FoxTrick) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba} [2010.09.22 14:19:39 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.02.01 00:22:29 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} [2011.06.09 04:46:29 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\engine@conduit.com [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-10.xml [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-11.xml [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-12.xml [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-2.xml [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-3.xml [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-4.xml [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-5.xml [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-6.xml [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-7.xml [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-8.xml [2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-9.xml [2011.09.29 20:22:39 | 000,000,822 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin.xml [2011.09.25 20:05:28 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2009.01.15 18:58:16 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.05.05 11:19:57 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.08.06 15:21:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2011.03.16 19:30:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.01.12 11:19:40 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Programme\Mozilla Firefox\extensions\quickstores@quickstores.de [2009.01.26 10:29:57 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [2009.03.25 13:59:49 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009.09.10 17:51:39 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [2009.11.23 09:15:19 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2010.04.01 12:11:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} [2010.05.05 11:19:57 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.08.06 15:21:27 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2011.03.16 19:30:05 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.01.12 11:19:40 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\QUICKSTORES@QUICKSTORES.DE [2008.09.04 02:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\mozilla firefox\plugins\npbittorrent.dll [2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011.09.29 20:22:39 | 000,001,400 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.09.29 20:22:39 | 000,002,352 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.09.29 20:22:39 | 000,006,818 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.06.20 01:46:01 | 000,001,272 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.09.29 20:22:39 | 000,000,903 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Shockwave Flash (Enabled) = C:\Users\TimoF1\AppData\Local\Google\Chrome\Application\14.0.835.187\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\XXX\AppData\Local\Google\Chrome\Application\14.0.835.187\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\TimoF1\AppData\Local\Google\Chrome\Application\14.0.835.187\pdf.dll CHR - plugin: BitTorrent (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll CHR - plugin: DNA Plug-in (Enabled) = C:\Program Files\DNA\plugins\npbtdna.dll CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa2.dll CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa2\npPicasa3.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: QUAKE LIVE (Enabled) = C:\ProgramData\id Software\QuakeLive\npquakezero.dll CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\XXX\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll CHR - plugin: Google Update (Enabled) = C:\Users\XXX\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Star Gazer = C:\Users\XXX\AppData\Local\Google\Chrome\User Data\Default\Extensions\mblmlcbknbnfebdfjnolmcapmdofhmme\1.1_0\ O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found. O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [FixCamera] C:\Windows\FixCamera.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [snp2std] C:\Windows\vsnp2std.exe (Sonix) O4 - HKLM..\Run: [tsnp2std] C:\Windows\tsnp2std.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [Facebook Update] C:\Users\TimoF1\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.6\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Free YouTube Download - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - eBay - eine der größten deutschen Shopping-Websites File not found O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - Amazon.de: Günstige Preise bei Elektronik & Foto, DVD, Musik, Bücher, Games, Spielzeug & mehr File not found O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet) O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Reg Error: Key error.) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: CabBuilder hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DACC1AB2-63AB-4A89-9607-B17496CE76C4}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F1A14B54-FDEA-4D36-B4BF-5CCBA037D3B7}: DhcpNameServer = 193.189.244.225 193.189.244.206 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) -C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: O24 - Desktop BackupWallPaper: O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{1478f9f4-aa73-11e0-b8cb-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{1478f9f4-aa73-11e0-b8cb-806e6f6e6963}\Shell\AutoRun\command - "" = D:\AutoRun.exe O33 - MountPoints2\{6de362c8-f728-11de-a230-cf40e21dd416}\Shell - "" = AutoRun O33 - MountPoints2\{6de362c8-f728-11de-a230-cf40e21dd416}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{6de362ca-f728-11de-a230-97ebfdbb4c5c}\Shell - "" = AutoRun O33 - MountPoints2\{6de362ca-f728-11de-a230-97ebfdbb4c5c}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{6de362cb-f728-11de-a230-c21f936b4dc8}\Shell - "" = AutoRun O33 - MountPoints2\{6de362cb-f728-11de-a230-c21f936b4dc8}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{7c434e32-7ad9-11e0-9612-d12759e963c7}\Shell - "" = AutoRun O33 - MountPoints2\{7c434e32-7ad9-11e0-9612-d12759e963c7}\Shell\AutoRun\command - "" = D:\AutoRun.exe O33 - MountPoints2\{7c434e63-7ad9-11e0-9612-f6306ce76e31}\Shell - "" = AutoRun O33 - MountPoints2\{7c434e63-7ad9-11e0-9612-f6306ce76e31}\Shell\AutoRun\command - "" = D:\AutoRun.exe O33 - MountPoints2\{c5bfab1c-62b0-11de-97ef-8c5b947565c5}\Shell - "" = AutoRun O33 - MountPoints2\{c5bfab1c-62b0-11de-97ef-8c5b947565c5}\Shell\AutoRun\command - "" = G:\LaunchU3.exe O33 - MountPoints2\D\Shell - "" = AutoRun O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - StartUpFolder: C:^Users^XXX^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^TRDCReminder.lnk - C:\Programme\TOSHIBA\TRDCReminder\TRDCReminder.exe - (TOSHIBA Europe) MsConfig - StartUpReg: 00TCrdMain - hkey= - key= - File not found MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: avgnt - hkey= - key= - File not found MsConfig - StartUpReg: AVP - hkey= - key= - File not found MsConfig - StartUpReg: cfFncEnabler.exe - hkey= - key= - File not found MsConfig - StartUpReg: ehTray.exe - hkey= - key= - C:\Windows\ehome\ehtray.exe (Microsoft Corporation) MsConfig - StartUpReg: Google Desktop Search - hkey= - key= - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) MsConfig - StartUpReg: mcagent_exe - hkey= - key= - File not found MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) MsConfig - StartUpReg: NDSTray.exe - hkey= - key= - File not found MsConfig - StartUpReg: Ocs_SM - hkey= - key= - C:\Users\XXX\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS) MsConfig - StartUpReg: SmoothView - hkey= - key= - File not found MsConfig - StartUpReg: StartCCC - hkey= - key= - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) MsConfig - StartUpReg: swg - hkey= - key= - File not found MsConfig - StartUpReg: SynTPEnh - hkey= - key= - C:\Programme\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) MsConfig - StartUpReg: TkBellExe - hkey= - key= - File not found MsConfig - StartUpReg: topi - hkey= - key= - C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA) MsConfig - StartUpReg: Toshiba Registration - hkey= - key= - C:\Programme\TOSHIBA\Registration\ToshibaRegistration.exe (Toshiba) MsConfig - StartUpReg: Toshiba TEMPO - hkey= - key= - C:\Programme\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe (Toshiba Europe GmbH) MsConfig - StartUpReg: TPwrMain - hkey= - key= - File not found MsConfig - State: "startup" - 2 CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.10.04 15:14:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy [2011.10.04 15:14:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2011.10.04 15:14:43 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy [2011.10.04 03:01:09 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Avira [2011.10.03 02:25:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.6 [2011.10.03 02:24:06 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.6 [2011.09.29 21:00:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.09.29 20:59:34 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2011.09.29 20:59:20 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.09.29 20:59:20 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011.09.29 20:59:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.09.29 20:59:12 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2011.09.29 20:22:39 | 000,000,000 | ---D | C] -- C:\Windows\System32\IO [2011.09.10 11:26:38 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoft [2011.09.10 11:03:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\simfy [2011.09.10 11:03:16 | 000,000,000 | ---D | C] -- C:\Program Files\simfy [2011.09.05 06:57:55 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\Facebook [2009.12.25 02:39:10 | 000,151,552 | ---- | C] ( ) -- C:\Windows\System32\rsnp2std.dll [2009.12.25 02:39:10 | 000,077,824 | ---- | C] ( ) -- C:\Windows\System32\csnp2std.dll [2009.11.07 11:54:23 | 000,007,680 | ---- | C] ( ) -- C:\Windows\System32\drivers\SPC530m.sys [2009.11.07 11:54:22 | 000,486,912 | ---- | C] ( ) -- C:\Windows\System32\drivers\SPC530.sys [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.10.04 20:15:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-279534257-4243095250-1252865368-1000UA.job [2011.10.04 20:10:00 | 000,001,194 | ---- | M] () -- C:\Users\XXX\Desktop\OTL - Verknüpfung.lnk [2011.10.04 20:02:22 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.10.04 20:02:22 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.10.04 20:01:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.10.04 20:01:18 | 1876,783,104 | -HS- | M] () -- C:\hiberfil.sys [2011.10.04 19:51:08 | 000,000,000 | ---- | M] () -- C:\Users\XXX\defogger_reenable [2011.10.04 19:50:27 | 000,000,548 | ---- | M] () -- C:\Users\XXX\Desktop\Defogger.exe - Verknüpfung.lnk [2011.10.04 19:03:14 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-279534257-4243095250-1252865368-1000UA.job [2011.10.04 15:14:53 | 000,001,060 | ---- | M] () -- C:\Users\XXX\Desktop\Spybot - Search & Destroy.lnk [2011.10.04 00:15:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-279534257-4243095250-1252865368-1000Core.job [2011.10.03 07:03:00 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-279534257-4243095250-1252865368-1000Core.job [2011.10.03 02:25:05 | 000,001,614 | ---- | M] () -- C:\Users\Public\Desktop\ICQ7.6.lnk [2011.10.02 04:12:13 | 000,002,052 | ---- | M] () -- C:\Users\XXX\Desktop\Google Chrome.lnk [2011.09.30 04:17:06 | 000,000,736 | ---- | M] () -- C:\Users\XXX\Documents\cc_20110930_041654.reg [2011.09.30 04:16:14 | 000,000,082 | ---- | M] () -- C:\Users\XXX\Documents\cc_20110930_041611.reg [2011.09.29 21:00:07 | 000,001,852 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk [2011.09.21 02:11:39 | 000,001,892 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk [2011.09.13 10:33:31 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.09.13 10:33:31 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.09.13 10:33:31 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.09.13 10:33:31 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.09.10 11:27:58 | 000,001,037 | ---- | M] () -- C:\Users\XXX\Desktop\DVDVideoSoft Free Studio.lnk [2011.09.10 11:03:17 | 000,000,719 | ---- | M] () -- C:\Users\Public\Desktop\simfy.lnk [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.10.04 20:09:57 | 000,001,194 | ---- | C] () -- C:\Users\XXX\Desktop\OTL - Verknüpfung.lnk [2011.10.04 19:51:08 | 000,000,000 | ---- | C] () -- C:\Users\XXX\defogger_reenable [2011.10.04 19:50:05 | 000,000,548 | ---- | C] () -- C:\Users\XXX\Desktop\Defogger.exe - Verknüpfung.lnk [2011.10.04 15:14:53 | 000,001,060 | ---- | C] () -- C:\Users\XXX\Desktop\Spybot - Search & Destroy.lnk [2011.10.03 02:25:05 | 000,001,614 | ---- | C] () -- C:\Users\Public\Desktop\ICQ7.6.lnk [2011.09.30 04:17:01 | 000,000,736 | ---- | C] () -- C:\Users\XXX\Documents\cc_20110930_041654.reg [2011.09.30 04:16:14 | 000,000,082 | ---- | C] () -- C:\Users\XXX\Documents\cc_20110930_041611.reg [2011.09.29 21:00:07 | 000,001,852 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk [2011.09.05 06:58:20 | 000,000,932 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-279534257-4243095250-1252865368-1000UA.job [2011.09.05 06:58:13 | 000,000,910 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-279534257-4243095250-1252865368-1000Core.job [2010.08.26 23:28:22 | 000,000,208 | ---- | C] () -- C:\Windows\ACROREAD.INI [2010.08.26 23:26:50 | 000,088,576 | ---- | C] () -- C:\Windows\RAUNINST.EXE [2010.07.27 20:27:36 | 000,000,000 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\wklnhst.dat [2010.06.29 05:08:23 | 000,214,720 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe [2009.12.28 08:54:37 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE [2009.12.25 02:39:19 | 000,020,480 | ---- | C] () -- C:\Windows\FixCamera.exe [2009.12.25 02:39:16 | 000,270,336 | ---- | C] () -- C:\Windows\tsnp2std.exe [2009.12.25 02:39:16 | 000,015,497 | ---- | C] () -- C:\Windows\snp2std.ini [2009.12.25 02:39:15 | 000,025,472 | ---- | C] () -- C:\Windows\System32\drivers\sncamd.sys [2009.12.25 02:39:12 | 012,179,584 | ---- | C] () -- C:\Windows\System32\drivers\snp2sxp.sys [2009.12.10 04:26:13 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009.10.21 08:31:51 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.10.21 08:31:50 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.07.17 02:30:51 | 000,339,968 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll [2009.07.17 02:30:51 | 000,114,688 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll [2009.07.12 19:27:13 | 000,367,957 | ---- | C] () -- C:\Users\XXX\AppData\Local\ciqkg_nav.dat [2009.07.12 19:26:42 | 000,001,460 | ---- | C] () -- C:\Users\XXX\AppData\Local\ciqkg_navps.dat [2009.07.12 19:26:42 | 000,000,089 | ---- | C] () -- C:\Users\XXX\AppData\Local\ciqkg.bat [2009.07.12 19:26:41 | 000,003,589 | ---- | C] () -- C:\Users\XXX\AppData\Local\ciqkg.dat [2009.05.25 05:49:29 | 000,000,680 | ---- | C] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat [2009.03.27 17:42:15 | 000,024,206 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\UserTile.png [2009.01.19 00:56:09 | 000,055,808 | ---- | C] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.01.15 17:30:27 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2009.01.15 16:38:55 | 000,131,072 | ---- | C] () -- C:\Windows\System32\EnumDevLib.dll [2009.01.15 16:36:43 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini [2009.01.15 16:36:43 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll [2009.01.15 16:36:43 | 000,009,480 | ---- | C] () -- C:\Windows\System32\tosmreg.ini [2009.01.15 16:36:43 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini [2008.10.07 17:02:35 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll [2008.10.07 17:02:35 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll [2008.10.07 17:02:35 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll [2008.10.07 17:02:35 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll [2008.10.07 17:02:35 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll [2008.10.07 17:02:35 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll [2008.10.07 16:54:03 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI [2008.10.07 16:43:07 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2008.10.07 15:54:49 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008.10.07 15:40:10 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2008.10.07 15:38:21 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat [2008.10.07 15:38:21 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2008.10.07 15:38:20 | 000,168,883 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2008.10.07 15:38:20 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe [2008.01.21 09:15:58 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008.01.21 09:15:58 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 000,321,376 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat ========== LOP Check ========== [2010.07.11 14:28:55 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\BitTorrent [2011.09.10 11:46:59 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoft [2011.09.10 11:29:03 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers [2009.07.12 19:27:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\FunkyEmoticons [2011.03.13 00:00:12 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Hansenet [2011.02.24 03:15:57 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\icPlus [2011.10.04 01:13:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ICQ [2010.05.03 23:58:46 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\inkscape [2009.10.29 03:36:44 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\LimeWire [2010.12.18 05:54:52 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\myphotobook [2011.01.09 20:00:58 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\OCS [2011.01.09 20:01:24 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Opera [2009.03.27 17:42:14 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\PeerNetworking [2011.05.11 23:21:43 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\PhotoScape [2011.08.17 21:01:14 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Simfy [2010.11.27 02:58:29 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\temp [2010.07.27 20:27:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Template [2009.01.19 02:56:34 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Toshiba [2011.05.22 03:21:03 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\TS3Client [2009.05.24 22:35:04 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\TuneUp Software [2011.10.03 07:03:00 | 000,000,910 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-279534257-4243095250-1252865368-1000Core.job [2011.10.04 19:03:14 | 000,000,932 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-279534257-4243095250-1252865368-1000UA.job [2011.10.04 20:00:10 | 000,032,558 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2009.01.15 16:39:36 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2010.08.26 23:28:17 | 000,000,000 | ---D | M] -- C:\Acrobat3 [2011.01.19 08:52:08 | 000,000,000 | -HSD | M] -- C:\Boot [2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2009.01.15 16:26:36 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.03.22 14:37:26 | 000,000,000 | ---D | M] -- C:\DVDVideoSoft [2008.10.08 10:01:03 | 000,000,000 | RH-D | M] -- C:\MSOCache [2009.06.14 22:08:26 | 000,000,000 | ---D | M] -- C:\My Downloads [2008.01.21 04:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.10.04 15:14:43 | 000,000,000 | R--D | M] -- C:\Program Files [2011.10.04 15:14:43 | 000,000,000 | -H-D | M] -- C:\ProgramData [2009.01.15 16:26:36 | 000,000,000 | -HSD | M] -- C:\Programme [2011.10.04 20:15:18 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2009.01.15 16:40:03 | 000,000,000 | ---D | M] -- C:\Toshiba [2009.01.15 16:30:36 | 000,000,000 | R--D | M] -- C:\Users [2010.08.26 23:27:43 | 000,000,000 | ---D | M] -- C:\WESTWOOD [2011.09.30 04:12:40 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > [1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < MD5 for: EXPLORER.EXE > [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2008.01.21 04:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: REGEDIT.EXE > [2008.01.21 04:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe [2008.01.21 04:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe < MD5 for: USERINIT.EXE > [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WININIT.EXE > [2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-10-04 09:33:03 < > < End of report > Nach diesem Log habe ich auch den defogger laufen lassen, alles neugestartet. Der SpyBot zeigte es nach einem erneuten Scan(ohne bestehende Inet verbindung) weiterhin wie vorher an. Ich wäre um eine antowort/hilfe echt mehr als froh,sonst bleibt mir nichts anderes ausser alles platt zu machen Liebe grüße Geändert von Pukki (05.10.2011 um 06:08 Uhr) Grund: *Zitat nachbearbeitet |
|
05.10.2011, 16:57
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
__________________Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
__________________ |
|
06.10.2011, 22:19
| #3 | |||
| | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. So ich habe es dann mal geschafft beide Scans wie gewünscht auszuführen...
__________________Eset Scan Zitat:
Malwarebytesscan alt Zitat:
Zitat:
 Habe alles erledigt wie es sein sollte, Firewall, Avira, alles deaktiviert während der Scans . Ich danke schonmal für die Mühen  Beste Grüße Geändert von Pukki (06.10.2011 um 22:28 Uhr) |
|
07.10.2011, 15:52
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar.Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
09.10.2011, 20:24
| #5 |
| | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Ich weiß nun gar nicht ob ich das absichtlich 2 mal hab laufen lassen ^^ Ich bin aber fast der meinung das ich beim ersten mal den Avira noch aktiv hatte und deshalb einen 2ten Scan gemacht habe . Hier ist der erste Log, den habe ich eben gefunden OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 04.10.2011 19:17:50 - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\TimoF1\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,75 Gb Total Physical Memory | 0,92 Gb Available Physical Memory | 52,77% Memory free
3,74 Gb Paging File | 2,59 Gb Available in Paging File | 69,22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,37 Gb Total Space | 21,10 Gb Free Space | 28,37% Space Free | Partition Type: NTFS
Drive E: | 73,21 Gb Total Space | 67,95 Gb Free Space | 92,81% Space Free | Partition Type: NTFS
Computer Name: XXX-PC | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2024D4CE-00C9-4AD0-BB1A-C1E61A0A66EB}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{301E1D61-4B0B-4036-9561-78BCD5A26BE7}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{3E892467-15A8-4320-99AB-0B231DB95FF2}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{46222659-095F-4955-AAAA-5677E4871DEF}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{48807EB4-8A81-40FC-B206-555017302378}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{4F4C6F1F-855E-4E76-A211-E60789DD12DD}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{5905049F-EC80-42BB-8C91-66A1AEEEF332}" = lport=2869 | protocol=6 | dir=in | app=system |
"{594B4E35-6128-4F2F-8DEF-C102576E58B7}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{5A2E1346-6680-4926-8687-9FFB9121E652}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{6BA59138-36BE-4FFD-B8BA-FFF22B169723}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6DAD20C2-2EAB-458D-AEFF-A53127B2ABE0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{76F0A2FC-AB4D-449D-A16A-1DE73F599A37}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{85E99414-4B92-4778-A2FD-1493878EA91F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8CFFAABC-A8C5-4985-98DF-593CBCDA11F9}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{90A5E64C-99CF-4DFB-A846-A7C4EC79D473}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{B85B0D53-46C5-45E4-8134-9DC71B34E25F}" = rport=2869 | protocol=6 | dir=out | app=system |
"{C48A151B-0CF1-45C4-BA1D-9FB203C9C0BD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{ED2B0828-2147-48BD-8625-1C5F48F30C74}" = lport=2869 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0598FC24-4BEA-4A46-90CE-AC983052A420}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{095CE881-52ED-45D1-ABB1-7D22AED1EEEC}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{0A44C334-547D-4C4C-8871-92F0F098F3AB}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{157FB36F-8F9F-40A6-A101-DBB5A6A069F3}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{15F376E8-165A-40E0-9389-BFA68DAFB2B8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1633FD37-47E2-476F-BC30-5E7544CA8EFE}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{165BE4DE-D24D-422C-B3AF-30290C454FE7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{193C126D-9BD5-48AB-BA97-AAA580D8E52B}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{1BE9CC11-AB36-4DDA-98FE-25C9FB9CA22D}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{211DD0B4-9B62-4905-90F5-16F90E29EF4D}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{2937E82E-86B5-43C4-8B09-100010955C4E}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{2A65E37A-02CB-4D4C-AD96-FB982843DB21}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{2B811D88-0318-4FF1-86B8-E0C63C71E8C1}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{3C64FBCA-C389-4D6B-8C4A-408B92B2CEB5}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{4BFB7EFA-E1DE-4373-B79C-70028E8330F8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{53DBF5C1-1C7C-40D2-B311-A83E966EF560}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{58F018E8-E8CF-41BB-9FC8-C6C5DA5A060B}" = protocol=17 | dir=in | app=c:\program files\icq away reader\icq away reader.exe |
"{60E09560-D31A-4C16-9FFA-BDDF8C108118}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{721C1A71-B6B8-4FBF-97AD-5708CE3985D2}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{7686B66D-AFA3-43C9-9CA8-3497D8E50BD6}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{7975E1D6-5AF7-4C9B-A95F-3EBB9F93807D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{7B2F3597-0F6B-4911-837E-13BF7AB048E6}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{8B296912-D6F9-4965-8808-E33A37FC280D}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{8D985CDE-18ED-4FCD-8624-3BF6F20680D0}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{99D5D4EC-4C5B-4056-BD58-3B635DD49D79}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{AB6D3AF2-76CA-443F-A76E-03747D43D3F9}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{B7B54087-F95F-4023-9503-B6DCA3FC1626}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{B8F885DD-CB41-420E-9175-0D56A1AAF9B9}" = protocol=6 | dir=in | app=c:\program files\icq away reader\icq away reader.exe |
"{B97511E8-A7BB-4242-A7C0-4D12D3102038}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{C335F124-C3AB-4379-AC54-85DB4890495C}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{CCD06996-0D96-4686-B0B0-1620055BB991}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{CE58A90D-9356-41D7-9DD3-7BBE0D1F3ADA}" = dir=in | app=c:\users\timof1\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{D44118AF-0B4D-4FFF-B5A3-82E71E728595}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{D50F7DDD-055E-4432-BAA3-C1AF7BFCA217}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{E98E89AB-4B70-46B5-B043-E3010CCB7B8C}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{EF1E46AD-8420-4ED1-8AB2-FFC0DCA3BFED}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{F34566CE-834E-4E0F-8D2C-8E633426FD46}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{FD524CF4-69F1-45AB-B745-64F5A8F26976}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"TCP Query User{0B93E498-5620-4243-B216-B9D9D2EB1EC9}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{20AE7BA8-E758-4290-85CD-3DC939481740}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{286EFB5A-A6C1-4EF3-8676-1A662BBBB768}C:\program files\bearshare\bearshare.exe" = protocol=6 | dir=in | app=c:\program files\bearshare\bearshare.exe |
"TCP Query User{3B12F41B-389D-4C69-97FC-984371A8D724}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{6274AD98-F4BE-4FCD-A5E4-6C39AEE1FC6D}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{772D889A-3829-44BF-87EF-6D7AC95BE631}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{8E65C468-9BBC-41BD-89BC-6BBE63E3EE5C}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"TCP Query User{90B30534-3BB7-476F-91E6-C36E49F9FFFA}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=6 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"TCP Query User{D08535BC-9348-485E-BDFA-B36C0F2B8796}C:\program files\bearshare\bearshare.exe" = protocol=6 | dir=in | app=c:\program files\bearshare\bearshare.exe |
"TCP Query User{D828563E-DF90-4CDB-83F6-37461AC59208}C:\users\timof1\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\XXX\program files\dna\btdna.exe |
"TCP Query User{DAF4050A-EF06-41D0-B43A-24ADAF6506E4}C:\users\timof1\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\XXX\program files\dna\btdna.exe |
"TCP Query User{DF12BD7B-91BB-425C-AD00-5B77B9DFE51C}C:\program files\anstoss 3\anstoss3.exe" = protocol=6 | dir=in | app=c:\program files\anstoss 3\anstoss3.exe |
"TCP Query User{E831983F-044F-4FE3-A49F-7DF3698D9828}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=6 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"TCP Query User{F96C86F4-37BE-46F1-9A28-34CC3E413FD3}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{1E3432F8-6320-419A-95F0-33F3A6CE745D}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{25BF37CB-1DA7-407B-AFDC-850F5ABE21C5}C:\users\XXX\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\timof1\program files\dna\btdna.exe |
"UDP Query User{4E3627FA-721A-4ECA-A5E5-C3311C77FE3C}C:\users\XXX\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\timof1\program files\dna\btdna.exe |
"UDP Query User{564AB866-692C-4B70-97FF-A5F6B65668E9}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=17 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"UDP Query User{581D7F7C-848C-436A-A8AD-3C9DBF7EF7A6}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{6B105358-2740-416D-9471-67EFC0BE910C}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{7D9CBA04-2D43-4B98-A9C2-68F6AFF3DFF7}C:\program files\bearshare\bearshare.exe" = protocol=17 | dir=in | app=c:\program files\bearshare\bearshare.exe |
"UDP Query User{9294738E-26CB-49C6-9448-0F5A649C0FCC}C:\program files\anstoss 3\anstoss3.exe" = protocol=17 | dir=in | app=c:\program files\anstoss 3\anstoss3.exe |
"UDP Query User{969BD404-55E2-473A-93BE-233C2EF30FDC}C:\program files\bearshare\bearshare.exe" = protocol=17 | dir=in | app=c:\program files\bearshare\bearshare.exe |
"UDP Query User{B2635770-B52D-4774-85B9-F19CD2D6FAEC}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{B6172AD8-2308-42D8-B513-417901BDEB2C}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{C455AD41-DC4B-426C-9C34-2D1480F25549}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=17 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"UDP Query User{DA6C17F2-2AB7-4BA0-B959-55DDFB863CD9}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{EFFCFE69-F734-4916-A5EF-E0289A2D3136}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{02CA24DD-C8B0-4280-BE53-7862869C2EB1}" = Realtek WiFi Protected Setup Library
"{03FAA727-E2B7-471C-AC41-2E1C7F29C7EA}" = Toshiba TEMPRO
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07C9627A-CA0B-2AA2-062E-204359DF7BA1}" = Catalyst Control Center Core Implementation
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent
"{0D3CECCA-A589-ECCA-EC0B-2F98F2789F60}" = simfy
"{0D5D0BEE-FBA9-4928-A50D-6CDFAB827755}" = TOSHIBA ConfigFree
"{0EFB2016-41D2-5F30-8F60-25250F6DABDD}" = CCC Help Thai
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{1C971EE3-B4C4-4367-9676-57549919C6CE}" = TOSHIBA Benutzerhandbücher
"{1E2FDD18-E514-4631-AF4A-0CC58FD93DCB}" = Quake Live Mozilla Plugin
"{1E57A11B-AB65-C6D1-F999-B3B37AB2298E}" = Catalyst Control Center Localization Japanese
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 24
"{27265B80-303E-EFFF-6052-B11F91B634C3}" = Catalyst Control Center Localization Italian
"{2883F6F5-0509-43F3-868C-D50330DD9DD3}" = TOSHIBA Hardware Setup
"{2920435D-CE92-5024-1694-DFD43A5FF074}" = Catalyst Control Center Localization Greek
"{2CD6D3D2-1EFC-F0B4-1761-FD4FA7F8750F}" = CCC Help Finnish
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{358004B9-3A16-87FF-4487-4D6F0C70E52F}" = Catalyst Control Center Localization Russian
"{38A3E884-313A-7AE0-11BC-482DE0C8766A}" = CCC Help Czech
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3BB12DBC-0A8E-ECE2-F179-D06B99B8CD02}" = Catalyst Control Center Localization Czech
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E0E28DC-DA90-1BA2-FA36-AA3C2E4FB74A}" = Catalyst Control Center Graphics Previews Vista
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B1E87C3-00DE-4898-8E39-E390AAEF2391}" = TOSHIBA Supervisor Password
"{4C90501F-864B-5AC4-867D-6AC35BE50721}" = ccc-utility
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{55398A75-13E0-570F-BD16-2EE5D9E5523D}" = Catalyst Control Center Localization Norwegian
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F131988-3326-AD64-1817-D76A2FE3C2D3}" = CCC Help Chinese Traditional
"{5FBF37CD-B7F9-564C-BDFC-73D970CF7AF2}" = CCC Help Italian
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{61C63422-E5E2-8576-2B82-0E01F5AD2538}" = CCC Help English
"{61F90A4F-AD49-7FFB-F027-5B2CB64F0A70}" = Catalyst Control Center Graphics Light
"{629044C7-745A-64B8-467F-2F93ED50008B}" = CCC Help Chinese Standard
"{65BF23C0-4EF9-27CC-7B6F-190F4008A569}" = Catalyst Control Center Localization Polish
"{65D602E4-DCDE-0743-6A0A-F1A203449F47}" = CCC Help German
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{69E5255D-9D43-4CFF-8984-843ABD7753B7}" = Catalyst Control Center - Branding
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B4874CA-13CF-2477-B697-B448201B56B6}" = CCC Help Norwegian
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6EB0B23B-AA51-6F4E-C94C-C1015ED61EEC}" = CCC Help Japanese
"{70495081-1DC8-AD4B-C197-12138B8FBC9E}" = CCC Help Danish
"{70AA9B4F-64F7-4B0D-ADD8-05802D61AF72}" = Windows Live Toolbar
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71B929E2-3556-93DB-DEC0-FD56D3EFB473}" = Catalyst Control Center Localization Chinese Traditional
"{71C47830-182D-79FA-0790-0366E6E2C2EB}" = Catalyst Control Center Localization Spanish
"{75438C0E-9925-412E-AD85-D0E71C6CE2ED}" = hama PC-Webcam RW-250
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder
"{77CAD946-C573-6647-B222-B6870C072932}" = CCC Help Korean
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7E83516C-931B-870F-5CDF-01FDF9A4AEF0}" = Catalyst Control Center Localization Turkish
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{86728841-C151-B8E4-43C6-DD289DE570B6}" = Catalyst Control Center Localization Swedish
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86DBA852-5D5E-1856-D828-620E792EDC0D}" = Catalyst Control Center Localization Chinese Standard
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{88BA2601-8A62-7AB7-DB8A-7AA2840B7C87}" = Catalyst Control Center Localization Thai
"{895722FE-25FE-4854-95AC-B0C42F9DBEDA}" = REALTEK RTL8187B Wireless LAN Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B587895-7716-1B99-5D85-3CA4AAF8A0F4}" = Catalyst Control Center Localization Dutch
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9244F321-0BBD-9D4A-C1FB-6437E3D0550D}" = Catalyst Control Center Localization German
"{93F3EBDD-4007-C233-7320-977AC0941054}" = CCC Help Turkish
"{94AB6CE0-DB26-7048-2A5B-4647EA1FC693}" = ccc-core-static
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E012857-0B5E-40A0-A36A-36751966A79B}_is1" = ICQ Status Checker 1.8
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A103C127-2168-4493-8D01-4BF180BED12C}" = CCC Help Portuguese
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A7F27ADB-3C56-0F2B-6B4B-0B8E02A49186}" = ATI Catalyst Install Manager
"{AC2EE52D-05CD-8140-5D29-5AA29590971E}" = CCC Help French
"{AC76BA86-7AD7-1031-7B44-A83000000003}" = Adobe Reader 8.3.1 - Deutsch
"{AD0DEE39-3B26-4AFB-9B26-0A4D21497390}" = Facebook Video Calling 1.0.0.8526
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B02A78AE-EA3B-8261-AEBC-8221E22DCC1E}" = CCC Help Polish
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B1D67B62-35A8-A9A1-AA74-F6A495C8271A}" = Catalyst Control Center Localization Danish
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BC2EA92A-A5A9-A137-5204-F150EDB05DB3}" = CCC Help Hungarian
"{BC713970-8C3C-852B-4139-636F21114B7F}" = CCC Help Dutch
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C4BE99A4-D1C7-46CC-9E06-B901A4BC7854}_is1" = ICQ Password Hasher 1.2
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C5F1A9C4-C041-2E95-5D7E-EF56CED2B522}" = Skins
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D7CC05AF-067D-0D1A-1E4D-9DCBCDCC2D41}" = Catalyst Control Center Graphics Full New
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E0FC3A5D-CF52-ABA7-92EF-D9794F372121}" = Catalyst Control Center Graphics Full Existing
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher
"{EA7D1919-A6BF-979A-E3A2-F753E23D45FA}" = Catalyst Control Center Localization Hungarian
"{ED2BC5D9-20EE-FBB6-8483-240F19EFCAA5}" = CCC Help Swedish
"{F0345A2F-1D78-0AEA-7CBB-CEF48622EB44}" = Catalyst Control Center Localization Portuguese
"{F0646787-1A2F-34E9-A61D-9DAD69F606F8}" = CCC Help Spanish
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F50E4D66-5280-FDF8-7F55-2E47FCF23E7D}" = Catalyst Control Center Localization Korean
"{F67E6AE5-F87B-025F-2D6B-26491304393F}" = CCC Help Russian
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F9DAAC4B-5E3F-1D39-9D4B-6998664EF402}" = Catalyst Control Center Localization Finnish
"{F9F66B99-C1B3-ACEA-1F80-404CC4DD96BF}" = Catalyst Control Center Localization French
"{FA493449-3E34-4E05-8CA7-26A42E9F180E}" = CCC Help Greek
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"7-Zip" = 7-Zip 4.65
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Acrobat Reader 3.01" = Adobe Acrobat Reader 3.01
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Alarmstufe Rot" = Alarmstufe Rot Windows 95
"Alice Software" = Alice Software 4.10.0
"ANSTOSS 3_is1" = ANSTOSS 3
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"ciqkg" = Favorit
"CNXT_MODEM_PCI_VEN_14F1&DEV_2C06&SUBSYS_14F10000" = HDAUDIO Soft Data Fax Modem with SmartCP
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free Studio_is1" = Free Studio version 5.2.0
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"FUSSBALL MANAGER 08" = FUSSBALL MANAGER 08
"Google Desktop" = Google Desktop
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQSpamblocker" = ICQSpamblocker
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder
"InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.6.17)" = Mozilla Firefox (3.6.17)
"myphotobook" = myphotobook 3.6
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"Simfy" = simfy
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Uninstall_is1" = Uninstall 1.0.0.1
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"WinLiveSuite_Wave3" = Windows Live Essentials
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 16.06.2010 20:21:11 | Computer Name = XXX-PC | Source = EventSystem | ID = 4621
Description =
Error - 17.06.2010 09:57:16 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
Error - 17.06.2010 11:59:25 | Computer Name = XXX-PC | Source = EventSystem | ID = 4621
Description =
Error - 17.06.2010 14:21:45 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
Error - 17.06.2010 16:41:35 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
Error - 19.06.2010 08:45:37 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
Error - 19.06.2010 10:44:31 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
Error - 19.06.2010 17:26:44 | Computer Name = XXX-PC | Source = EventSystem | ID = 4621
Description =
Error - 19.06.2010 17:30:06 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
Error - 20.06.2010 07:51:04 | Computer Name = XXX-PC | Source = WinMgmt | ID = 10
Description =
[ Media Center Events ]
Error - 27.11.2009 18:17:04 | Computer Name = XXX-PC | Source = MCUpdate | ID = 0
Description = Es konnte nicht auf den MCUpdate-Mutex gewartet werden. Ausnahme:
'Der Wartezustand wurde aufgrund eines abgebrochenen Mutex beendet.'.
[ OSession Events ]
Error - 27.07.2010 14:32:34 | Computer Name = XXX-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6535.5002, Microsoft Office Version: 12.0.6425.1000. This session lasted 26
seconds with 0 seconds of active time. This session ended with a crash.
Error - 27.07.2010 14:33:40 | Computer Name = XXX-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 15
seconds with 0 seconds of active time. This session ended with a crash.
Error - 28.07.2010 07:46:08 | Computer Name = XXX-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 15
seconds with 0 seconds of active time. This session ended with a crash.
Error - 28.07.2010 08:37:58 | Computer Name = XXX-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 11
seconds with 0 seconds of active time. This session ended with a crash.
Error - 12.05.2011 00:07:21 | Computer Name = XXX-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 16
seconds with 0 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 03.10.2011 16:45:22 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7026
Description =
Error - 03.10.2011 16:46:35 | Computer Name = XXX-PC | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
Error - 03.10.2011 16:46:38 | Computer Name = XXX-PC | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
Error - 03.10.2011 16:46:52 | Computer Name = XXX-PC | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
Error - 03.10.2011 19:17:01 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7026
Description =
Error - 03.10.2011 22:05:56 | Computer Name = XXX-PC | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
Error - 03.10.2011 22:06:22 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7026
Description =
Error - 04.10.2011 11:13:38 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7026
Description =
Error - 04.10.2011 11:13:49 | Computer Name = XXX-PC | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
Error - 04.10.2011 11:13:59 | Computer Name = XXXPC | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner
Fehler ist im Speicher-Manager aufgetreten.
< End of report >
Geändert von Pukki (09.10.2011 um 20:33 Uhr) Grund: Log angefügt |
|
10.10.2011, 12:20
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Hast du noch das OTL.txt Log vom ersten Durchlauf? Die Extras sind weniger wichtig.
__________________ --> Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. |
|
10.10.2011, 16:46
| #7 |
| | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Also ich hab jetzt mal nachgeschaut, das ist so ziemlich alles was ich noch habe =( Soll ich vllt noch einen Scan machen, weiß auch nicht mehr was ich da gemacht habe  |
|
10.10.2011, 17:20
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!! Code:
ATTFilter :OTL
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.jappy.de/"
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&q="
[2011.06.09 04:46:26 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.02.01 00:22:29 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2011.06.09 04:46:29 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\aggjj9u6.default\extensions\engine@conduit.com
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-10.xml
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-11.xml
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-12.xml
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-2.xml
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-3.xml
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-4.xml
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-5.xml
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-6.xml
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-7.xml
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-8.xml
[2011.09.29 20:22:39 | 000,000,828 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin-9.xml
[2011.09.29 20:22:39 | 000,000,822 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\aggjj9u6.default\searchplugins\icqplugin.xml
[2009.01.15 18:58:16 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.01.12 11:19:40 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Programme\Mozilla Firefox\extensions\quickstores@quickstores.de
[2011.01.12 11:19:40 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\QUICKSTORES@QUICKSTORES.DE
[2008.09.04 02:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\mozilla firefox\plugins\npbittorrent.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found.
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - eBay - eine der größten deutschen Shopping-Websites File not found
O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - Amazon.de: Günstige Preise bei Elektronik & Foto, DVD, Musik, Bücher, Games, Spielzeug & mehr File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{1478f9f4-aa73-11e0-b8cb-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{1478f9f4-aa73-11e0-b8cb-806e6f6e6963}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{6de362c8-f728-11de-a230-cf40e21dd416}\Shell - "" = AutoRun
O33 - MountPoints2\{6de362c8-f728-11de-a230-cf40e21dd416}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{6de362ca-f728-11de-a230-97ebfdbb4c5c}\Shell - "" = AutoRun
O33 - MountPoints2\{6de362ca-f728-11de-a230-97ebfdbb4c5c}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{6de362cb-f728-11de-a230-c21f936b4dc8}\Shell - "" = AutoRun
O33 - MountPoints2\{6de362cb-f728-11de-a230-c21f936b4dc8}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{7c434e32-7ad9-11e0-9612-d12759e963c7}\Shell - "" = AutoRun
O33 - MountPoints2\{7c434e32-7ad9-11e0-9612-d12759e963c7}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{7c434e63-7ad9-11e0-9612-f6306ce76e31}\Shell - "" = AutoRun
O33 - MountPoints2\{7c434e63-7ad9-11e0-9612-f6306ce76e31}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{c5bfab1c-62b0-11de-97ef-8c5b947565c5}\Shell - "" = AutoRun
O33 - MountPoints2\{c5bfab1c-62b0-11de-97ef-8c5b947565c5}\Shell\AutoRun\command - "" = G:\LaunchU3.exe
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AutoRun.exe
:Commands
[emptytemp]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
12.10.2011, 04:06
| #9 | |
| | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Guten Morgen, also ich habe es wie angewiesen getan : Alle Programme die offen waren geschlossen, Avira ausgeschaltet,Firewall deaktiviert und dann den Text dort eingefügt und Fixen geklickt  auch hat der Neustart wie angesagt stattgefunden ^^ Hier der gewünschte Log Zitat:
 Wie gesagt bin auf dem Gebiet wirklich nen kleinen dummkopf^^  |
|
12.10.2011, 16:50
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.  Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
16.10.2011, 19:09
| #11 | |
| | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Hallo und sorry das es etwas gedauert hat, habe viel um den Ohren... Habe es so ausgeführt aber iwie hab ich wohl einen Fehler begangen... Ich habe den "reboot computer" geklickt ohne den Report gespeichert zu haben -.- Habe den report button erst danach gesehen. Der Scan hat einen fund ergeben und dieser wurde entfernt :´( Ich habe einen 2ten Scan gemacht...ich hoffe der Fehler ist nun nicht allzu schlimm ?=( Zitat:
|
|
16.10.2011, 19:31
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Schau bitte dirkt auf C: nach, da speichert der TDSS-Killer alle Logs.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.10.2011, 21:19
| #13 | |
| | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Entschuldigung das es solang gedauert hat, aber inet war gekappt  Ich hatte aber nichtmals die möglichkeit iwie bescheid zu geben Ich habe den log gefunden  er ist auch von datum und uhrzeit der erste  Zitat:
|
|
27.10.2011, 08:06
| #14 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Win32.agent.fbx(trojaner anzeige),Tradedoubler, MediaPlex-Nicht löschbar. |
| antivir, avira, avp, bho, c:\windows\system32\rundll32.exe, converter, desktop, device driver, email, error, excel.exe, firefox, home, intranet, kaspersky, limited.com/facebook, logfile, mp3, object, plug-in, problem, programm, realtek, registry, safer networking, scan, sched.exe, senden, software, spyware, studio, teamspeak, trojaner, vista, win32.agent.fbx |
