Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Onlinbankingsperre wg Zeus2

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 09.08.2010, 18:36   #1
MarkusB
 
Onlinbankingsperre wg Zeus2 - Icon26

Onlinbankingsperre wg Zeus2



Hallo,

meine Bank hat meinen Onlinebankingzugang gesperrt, da sie einen Zeus2 Trojaner feststellten, der von meinem Computer kam und den sie als gefährlich einstufen, da er PINs und Passwörter ausspioniert.
Beim Virenscan mit Antivir freeware Edition kamen zu Tage :
TR/SPY.Zbot.alzl
HEUR/HTML. malware
TR/Agent2.cttr
TR/BlockRapport.B
JAVA/Agent.M.3
JAVA/Agent.AE
die in Quarantäne geschoben wurden.

JAVA/Agent.AC
JAVA/Agent.AD
sind nur im Report angezeigt.

Habe Windows VIsta Home premium service pack 2 , 32 Bit Version und frage, ob ich das System komplett Neuaufsetzen muß und es ok ist, wenn ich die aktuellen worddateien, Bilder, T-Onlinemails und Videos Musikdateien sichere und dann wieder neuaufspiele?

Hilfe tut ja so gut.

Dankehttp://www.trojaner-board.de/images/icons/icon26.gif
MarkusB

Alt 09.08.2010, 19:13   #2
markusg
/// Malware-holic
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



hi,
1. ja genau so machst du dass dann.
2. gebe ich dir, falls gewünscht, tipps um das system in zukunft sicherer zu machen.
3. nutzt du warscheinlich pin/tan verfahren, ist auch nicht mehr so sicher, geb dir tipps was du nutzen solltest.
4. möchte ich dein system kurz näher ansehen, um evtl. unbekannte dateien zu finden, damit diese eingesendet werden können, damit andere geschützt sind, falls du nichts dagegen hast.
ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
poste beide logs
__________________


Alt 09.08.2010, 19:38   #3
MarkusB
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



Hallo MarkusG,

1. also mit den Recoverydisks, die ich am Anfang erstellt habe vist neu installieren?
Sind nach der Inefktion gesicherte Worddateien, PDFs, T-onlinemails, Bilder, Outlookadressbuch und Videos ins neue Vista einspielbar ohne Neuinfektion?
2. Danke für Tips
3. ja Pin und Tan bei der Bank
vielen Dank und Respekt von MarkusB für das superschnelle Feedback.

zu 4.Versuche den Scan zu machen und zu posten, bin aber ein selfmade Computernutzer(nicht Freak!); freu mich wenn Du mir erklärst, was einsenden heisst und an wen und wie damit andere egschützt werden (soind das auch persönliche Daten von mir?)
Schöne Markusgrüsse
MarkusB
__________________

Alt 09.08.2010, 19:55   #4
markusg
/// Malware-holic
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



hi namensfetter.
du kannst alles an daten zurückspielen, nachdem das system zurückgesetzt wurde.
wir nutzen otl um die malware zu identivizieren, zu löschen, dann erstellst du ein archiv wo die malware enthalten ist, lädst die zu unserem upload channel hoch und ich sende die dann an über 40 antivirus hersteller ein.
geb dir dann auch die tipps zum absichern.
hier schon mal für online banking.
du solltest deine bank fragen, ob folgendes möglich ist, da dies mit chipcard ist, werden ein paar zusatzkosten auf dich zukommen, sind aber nicht so hoch, und im zweifelsfall schützt dich das vllt vor dem nächsten trojaner der irgendwie deine daten abgreifen will. was bei pin/tan eingabe einfacher ist als beim rest.

1. kombination aus FINTS/HBCI verfahren
2. FINTS als einzellösung
3. HBCI als einzellösung.
verfahren sind nach sicherheit geordnet.

Alt 09.08.2010, 20:55   #5
MarkusB
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



Hi,
1. hier mein Scanergebnis:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 09.08.2010 20:21:12 - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\MARKUS\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 31,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 58,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 150,66 Gb Total Space | 76,82 Gb Free Space | 50,99% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 145,97 Gb Total Space | 140,80 Gb Free Space | 96,46% Space Free | Partition Type: NTFS
Drive F: | 4,20 Gb Total Space | 3,36 Gb Free Space | 79,93% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: MARKUS-PC
Current User Name: MARKUS
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\MARKUS\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\profilemgr.exe (Deutsche Telekom AG)
PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\sc_watch.exe (Deutsche Telekom AG)
PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\kernel.exe (Deutsche Telekom AG)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
PRC - C:\Programme\Netzmanager\netzmanager.exe (Deutsche Telekom AG)
PRC - C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Deutsche Telekom AG)
PRC - C:\Windows\starter4g.exe (4G Systems GmbH & Co. KG)
PRC - C:\Windows\service4g.exe (4G Systems GmbH & Co. KG)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
PRC - C:\Programme\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\GTS\GTS.exe ()
PRC - C:\Programme\Common Files\Nokia\NoA\nokiaaserver.exe ()
PRC - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\XSManager\WTGService.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)
PRC - C:\Programme\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\T-Home\Internationaler Zugang\International.exe (iPass, Inc.)
PRC - C:\Programme\T-Home\Internationaler Zugang\iPassConnectEngine.exe (iPass, Inc.)
PRC - C:\Programme\T-Home\Internationaler Zugang\iPassPeriodicUpdateService.exe (iPass, Inc.)
PRC - C:\Programme\T-Home\Internationaler Zugang\iPassPeriodicUpdateApp.exe (iPass, Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Free Download Manager\fdm.exe (FreeDownloadManager.ORG)
PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Programme\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group)
PRC - C:\Programme\TrueSuite Access Manager\usbnotify.exe ()
PRC - C:\Windows\System32\TAMSvr.exe (AuthenTec Inc.)
PRC - C:\Programme\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc)
PRC - C:\Windows\System32\CNAB4RPK.EXE (CANON INC.)
PRC - C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Search Settings\SearchSettings.exe (Vendio Services, Inc.)
PRC - C:\Programme\Camera Assistant Software for Toshiba\CEC_MAIN.exe ()
PRC - C:\Programme\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
PRC - C:\Programme\Toshiba\HDMICtrlMan\HDMICtrlMan.exe (TOSHIBA Corporation.)
PRC - C:\Programme\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba)
PRC - C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
PRC - C:\Programme\Toshiba\HDMICtrlMan\HCMSoundChanger.exe (TOSHIBA Corporation.)
PRC - C:\Programme\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Common Files\Marmiko Shared\MInfraIS\MInfraIS.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
PRC - C:\Programme\T-Online\T-Online_Software_6\eMail\Mail.exe (Deutsche Telekom AG, Nachrichten - Service - Shopping bei t-online.de)
PRC - C:\Programme\O2Micro Flash Memory Card Driver\o2flash.exe (O2Micro International)
PRC - C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
PRC - C:\Programme\T-Online\T-Online_Software_6\Notifier\Notifier.exe (fun communications GmbH, fun communications)
PRC - C:\Programme\Apoint2K\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\MARKUS\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (TOSHIBA Bluetooth Service) -- c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe File not found
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Netzmanager Service) -- C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Deutsche Telekom AG)
SRV - (XS Stick Service) -- C:\Windows\service4g.exe (4G Systems GmbH & Co. KG)
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (GoogleDesktopManager-110309-193829) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (WTGService) -- C:\Programme\XSManager\WTGService.exe ()
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (TemproMonitoringService) Notebook Performance Tuning Service (TEMPRO) -- C:\Program Files\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH)
SRV - (iPassConnectEngine) -- C:\Programme\T-Home\Internationaler Zugang\iPassConnectEngine.exe (iPass, Inc.)
SRV - (iPassPeriodicUpdateService) -- C:\Program Files\T-Home\Internationaler Zugang\iPassPeriodicUpdateService.exe (iPass, Inc.)
SRV - (iPassPeriodicUpdateApp) -- C:\Program Files\T-Home\Internationaler Zugang\iPassPeriodicUpdateApp.exe (iPass, Inc.)
SRV - (Authentec memory manager) -- C:\Windows\System32\TAMSvr.exe (AuthenTec Inc.)
SRV - (TNaviSrv) -- C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (SmartFaceVWatchSrv) -- C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba)
SRV - (ConfigFree Service) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (TosCoSrv) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (TOSHIBA SMART Log Service) -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) -- C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (o2flash) -- C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe (O2Micro International)
SRV - (UleadBurningHelper) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (IntcHdmiAddService) Intel(R) -- C:\Windows\System32\drivers\IntcHdmi.sys File not found
DRV - (igfx) -- C:\Windows\System32\DRIVERS\igdkmd32.sys File not found
DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) -- C:\Windows\System32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) -- C:\Windows\System32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (WINUSB) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (cmnsusbser) -- C:\Windows\System32\drivers\cmnsusbser.sys (Mobile Connector)
DRV - (CnxtHdAudService) -- C:\Windows\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)
DRV - (AlfaFF) -- C:\Windows\system32\drivers\AlfaFF.sys (Alfa Corporation)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (tos_sps32) -- C:\Windows\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (O2MDRDR) -- C:\Windows\System32\drivers\o2media.sys (O2Micro )
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (UVCFTR) -- C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (QIOMem) -- C:\Windows\System32\drivers\QIOMem.sys (TOSHIBA)
DRV - (SSPORT) -- C:\Windows\System32\drivers\SSPORT.SYS (Samsung Electronics)
DRV - (DgiVecp) -- C:\Windows\System32\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (tosrfec) -- C:\Windows\System32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) -- C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (MTOnlPktAlyX) -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle
IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Ask.com Search Engine - Better Web Search
IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\kb127\SearchSettings.dll (Vendio Services, Inc.)
IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.ask.com/?o=101723&l=dis"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10
FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:4.1.5
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.2.26
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.29
FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0
FF - prefs.js..extensions.enabledItems: {1ced4832-f06e-413f-aa14-9eb63ad40ace}:1.0.2
FF - prefs.js..extensions.enabledItems: {1dbc4a33-ea62-4330-966c-7bdad3455322}:1.0.6.7
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: {51e18ac0-6522-11da-8cd6-0800200c9a66}:0.41
FF - prefs.js..extensions.enabledItems: optout@dubfire.net:3.02
FF - prefs.js..extensions.enabledItems: {9815d32d-08c2-42ca-a8c6-43e501a4512f}:0.3.3
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2010.02.25 01:25:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.03.26 20:23:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.12 15:14:39 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.07.01 10:12:23 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.03.26 20:23:02 | 000,000,000 | ---D | M]
 
[2010.01.01 17:57:31 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Extensions
[2010.01.01 17:57:31 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Extensions\songbird@songbirdnest.com
[2010.08.09 19:02:31 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions
[2010.03.28 16:14:59 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010.08.03 19:46:15 | 000,000,000 | ---D | M] (FlashGot) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009.09.15 22:14:05 | 000,000,000 | ---D | M] (Nuke Anything Enhanced) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{1ced4832-f06e-413f-aa14-9eb63ad40ace}
[2010.02.03 09:34:55 | 000,000,000 | ---D | M] (Remove It Permanently) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{1dbc4a33-ea62-4330-966c-7bdad3455322}
[2009.07.09 10:50:03 | 000,000,000 | ---D | M] (SimpleTranslate) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{51e18ac0-6522-11da-8cd6-0800200c9a66}
[2010.07.28 21:01:35 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.04.13 22:06:25 | 000,000,000 | ---D | M] (Tor-Proxy.NET Toolbar) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{9815d32d-08c2-42ca-a8c6-43e501a4512f}
[2010.05.13 09:30:51 | 000,000,000 | ---D | M] (WOT) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.07.10 17:57:53 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.05.30 11:00:36 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2009.11.10 15:04:42 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\firefox@tvunetworks.com
[2010.05.13 09:30:55 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\firefox-extension@shareaholic.com
[2010.06.20 20:26:16 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\optout@dubfire.net
[2010.06.11 20:03:54 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\smarterwiki@wikiatic.com
[2010.05.13 09:30:54 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\firefox-extension@shareaholic.com\chrome
[2010.05.13 09:30:53 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\mozilla\Firefox\Profiles\g91g2yyx.default\extensions\firefox-extension@shareaholic.com\defaults
[2009.07.18 10:20:59 | 000,002,239 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Mozilla\FireFox\Profiles\g91g2yyx.default\searchplugins\askcom.xml
[2010.08.03 21:42:57 | 000,001,482 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Mozilla\FireFox\Profiles\g91g2yyx.default\searchplugins\bsb-opac.xml
[2010.08.03 21:42:57 | 000,001,493 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Mozilla\FireFox\Profiles\g91g2yyx.default\searchplugins\bsb-opacplus.xml
[2010.05.06 10:57:34 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.03.29 12:48:52 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.05.06 10:57:35 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2007.03.02 15:17:24 | 000,095,200 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\NPAPIX.dll
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2007.01.17 13:18:04 | 000,095,200 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\NPFluxBrowserHelper.dll
[2007.09.07 16:25:50 | 000,103,064 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\NPMPDRM.dll
[2007.09.07 15:46:48 | 000,098,968 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\NPWMDRMWrapper.dll
[2009.03.24 11:10:44 | 000,114,688 | ---- | M] (Zylom) -- C:\Programme\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2010.03.12 20:10:42 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.12 20:10:42 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.12 20:10:42 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.12 20:10:43 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.12 20:10:43 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programme\Free Download Manager\iefdm2.dll ()
O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\kb127\SearchSettings.dll (Vendio Services, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O4 - HKLM..\Run: [00TCrdMain] C:\Programme\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4 - HKLM..\Run: [cfFncEnabler.exe]  File not found
O4 - HKLM..\Run: [FingerPrintNotifer] C:\Programme\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( )
O4 - HKLM..\Run: [HDMICtrlMan] C:\Programme\Toshiba\HDMICtrlMan\HDMICtrlMan.exe (TOSHIBA Corporation.)
O4 - HKLM..\Run: [HSON] C:\Programme\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [iPassConnect] C:\Program Files\T-Home\Internationaler Zugang\International.exe (iPass, Inc.)
O4 - HKLM..\Run: [NDSTray.exe]  File not found
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [PwdBank] C:\Programme\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [SearchSettings] C:\Programme\Search Settings\SearchSettings.exe (Vendio Services, Inc.)
O4 - HKLM..\Run: [SmoothView] C:\Programme\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [starter4g] C:\Windows\starter4g.exe (4G Systems GmbH & Co. KG)
O4 - HKLM..\Run: [ToADiMon.exe] C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
O4 - HKLM..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA)
O4 - HKLM..\Run: [Toshiba Registration] C:\Programme\Toshiba\Registration\ToshibaRegistration.exe (Toshiba)
O4 - HKLM..\Run: [Toshiba TEMPRO] C:\Programme\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)
O4 - HKLM..\Run: [TPwrMain] C:\Programme\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [UsbMonitor] C:\Programme\TrueSuite Access Manager\usbnotify.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-18..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-19..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000..\Run: []  File not found
O4 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe (FreeDownloadManager.ORG)
O4 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000..\Run: [TOSCDSPD] C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Programme\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Programme\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
O4 - Startup: C:\Users\MARKUS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk = C:\Programme\Netzmanager\netzmanager.exe (Deutsche Telekom AG)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Alles mit FDM herunterladen - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Auswahl mit FDM herunterladen - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Datei mit FDM herunterladen - C:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Videos mit FDM herunterladen - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} -  File not found
O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} -  File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-2688840325-2365804445-392268656-1000\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\fluxhttp {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax ()
O18 - Protocol\Handler\fluxhttp\0x00000007 {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax ()
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll -  File not found
O24 - Desktop WallPaper: C:\Toshiba\WALLPAPERS\Wallpaper1.jpg
O24 - Desktop BackupWallPaper: C:\Toshiba\WALLPAPERS\Wallpaper1.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2693ab39-7d55-11df-ad27-00238b727b03}\Shell - "" = AutoRun
O33 - MountPoints2\{2693ab39-7d55-11df-ad27-00238b727b03}\Shell\AutoRun\command - "" = G:\autorun.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.dvacm - C:\Programme\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.09 17:08:38 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.08.09 10:44:05 | 000,000,000 | ---D | C] -- C:\Programme\Netzmanager
[2010.08.09 10:44:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Netzmanager
[2010.08.09 10:43:58 | 000,000,000 | -H-D | C] -- C:\ProgramData\{290883D4-FF33-4C80-B8FB-E5D5A89C103B}
[2010.08.09 10:43:16 | 000,000,000 | ---D | C] -- C:\Users\MARKUS\AppData\Local\PackageAware
[2010.07.24 10:04:14 | 000,000,000 | ---D | C] -- C:\Programme\XMedia Recode
[2010.07.21 12:32:57 | 000,000,000 | ---D | C] -- C:\Programme\SDP Multimedia
[2010.07.19 14:25:49 | 000,000,000 | ---D | C] -- C:\Users\MARKUS\AppData\Roaming\vlc
[2010.07.12 15:14:23 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2010.07.12 15:14:15 | 000,000,000 | ---D | C] -- C:\Programme\iTunes
[2010.07.12 15:08:02 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.09 20:25:17 | 002,883,584 | -HS- | M] () -- C:\Users\MARKUS\NTUSER.DAT
[2010.08.09 20:23:14 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.09 20:23:14 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.09 17:43:25 | 000,430,204 | ---- | M] () -- C:\Users\MARKUS\Desktop\bookmarks-2010-08-09B
[2010.08.09 17:43:01 | 000,430,204 | ---- | M] () -- C:\Users\MARKUS\Desktop\bookmarks-2010-08-09.json
[2010.08.09 17:26:11 | 000,075,818 | ---- | M] () -- C:\Users\MARKUS\Documents\cc_20100809_172532.reg
[2010.08.09 17:08:40 | 000,000,809 | ---- | M] () -- C:\Users\MARKUS\Desktop\CCleaner.lnk
[2010.08.09 14:08:51 | 000,152,064 | ---- | M] () -- C:\Users\MARKUS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.08.09 11:41:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.09 10:44:28 | 000,000,903 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk
[2010.08.09 10:44:06 | 000,000,919 | ---- | M] () -- C:\Users\Public\Desktop\Netzmanager.lnk
[2010.08.09 10:26:45 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{4DBE145B-E9DA-42F0-9ED6-20B5CB287943}.job
[2010.08.09 10:23:16 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.09 10:23:10 | 3215,831,040 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.08 21:53:19 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.08.08 21:53:17 | 000,524,288 | -HS- | M] () -- C:\Users\MARKUS\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2010.08.08 21:53:17 | 000,065,536 | -HS- | M] () -- C:\Users\MARKUS\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.08.08 21:53:11 | 004,008,736 | -H-- | M] () -- C:\Users\MARKUS\AppData\Local\IconCache.db
[2010.08.06 19:15:22 | 001,568,228 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.08.06 19:15:22 | 000,674,582 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.06 19:15:22 | 000,634,400 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.06 19:15:22 | 000,146,234 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.06 19:15:22 | 000,119,964 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.07.24 10:04:15 | 000,000,869 | ---- | M] () -- C:\Users\Public\Desktop\XMedia Recode.lnk
[2010.07.21 12:32:58 | 000,000,991 | ---- | M] () -- C:\Users\Public\Desktop\SDP Downloader.lnk
[2010.07.19 17:55:14 | 000,010,037 | ---- | M] () -- C:\Users\MARKUS\Documents\Dok2.docx
[2010.07.19 17:27:17 | 000,007,052 | ---- | M] () -- C:\Users\MARKUS\AppData\Local\d3d9caps.dat
[2010.07.19 14:25:34 | 000,000,864 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010.07.18 15:45:15 | 000,019,456 | ---- | M] () -- C:\Users\MARKUS\AppData\Local\WebpageIcons.db
[2010.07.14 22:41:18 | 000,000,240 | ---- | M] () -- C:\Windows\win.ini
[2010.07.12 15:15:15 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.08.09 17:43:25 | 000,430,204 | ---- | C] () -- C:\Users\MARKUS\Desktop\bookmarks-2010-08-09B
[2010.08.09 17:43:00 | 000,430,204 | ---- | C] () -- C:\Users\MARKUS\Desktop\bookmarks-2010-08-09.json
[2010.08.09 17:25:47 | 000,075,818 | ---- | C] () -- C:\Users\MARKUS\Documents\cc_20100809_172532.reg
[2010.08.09 17:08:40 | 000,000,809 | ---- | C] () -- C:\Users\MARKUS\Desktop\CCleaner.lnk
[2010.08.09 10:44:28 | 000,000,903 | ---- | C] () -- C:\Users\MARKUS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk
[2010.08.09 10:44:06 | 000,000,919 | ---- | C] () -- C:\Users\Public\Desktop\Netzmanager.lnk
[2010.07.24 10:04:15 | 000,000,869 | ---- | C] () -- C:\Users\Public\Desktop\XMedia Recode.lnk
[2010.07.21 12:32:58 | 000,000,991 | ---- | C] () -- C:\Users\Public\Desktop\SDP Downloader.lnk
[2010.07.19 17:55:14 | 000,010,037 | ---- | C] () -- C:\Users\MARKUS\Documents\Dok2.docx
[2010.07.19 14:25:34 | 000,000,864 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010.07.12 15:15:15 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2009.09.24 08:31:15 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.03.31 12:23:17 | 000,022,723 | ---- | C] () -- C:\Windows\System32\sugo3l3.dll
[2009.03.29 14:54:26 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.08.07 13:21:21 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1502.dll
[2008.07.10 10:18:16 | 000,006,642 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2008.07.10 10:05:32 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2008.07.10 10:05:32 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2008.07.10 10:05:32 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2008.07.10 10:05:32 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2008.07.10 10:05:32 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2008.07.10 10:05:32 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2008.07.10 09:58:27 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2008.07.10 09:40:25 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2008.07.10 09:40:25 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2008.07.10 09:40:25 | 000,009,480 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2008.07.10 09:40:25 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2008.07.10 09:30:59 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.04.24 19:43:50 | 000,057,344 | ---- | C] () -- C:\Windows\System32\SmartFaceVCapt.dll
[2008.04.24 19:42:44 | 000,479,232 | ---- | C] () -- C:\Windows\System32\SmartFaceVCP.dll
[2008.04.24 19:25:46 | 006,701,056 | ---- | C] () -- C:\Windows\System32\FaceHI.dll
[2008.04.24 19:25:46 | 000,995,328 | ---- | C] () -- C:\Windows\System32\FaceRec.dll
[2008.04.24 19:25:46 | 000,126,976 | ---- | C] () -- C:\Windows\System32\SmartFaceVCtrl.dll
[2008.04.24 19:23:58 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IppLib.dll
[2007.12.21 16:46:32 | 000,118,784 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005.07.22 21:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll
[2003.08.07 21:01:50 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
 
========== LOP Check ==========
 
[2010.08.09 20:10:05 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Abine
[2009.07.20 09:52:53 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Ashampoo
[2010.08.04 19:44:48 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Ceun
[2009.05.02 22:29:29 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\DVDFab
[2009.08.09 12:46:26 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Feedreader
[2010.08.09 20:25:11 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Free Download Manager
[2009.12.31 20:42:47 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\FreeFLVConverter
[2010.08.04 20:56:34 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Laibel
[2009.04.19 10:52:15 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\myphotobook
[2010.08.09 17:47:57 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Nokia
[2010.03.26 20:04:44 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Nokia Ovi Suite
[2009.08.01 18:50:07 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\NSeries
[2010.04.12 22:20:17 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\OpenCandy
[2009.12.20 13:30:23 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\PC Suite
[2010.01.01 18:03:50 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\PersBackup5
[2010.01.01 17:57:27 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Songbird2
[2009.03.29 12:18:55 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\T-Online
[2009.09.10 21:03:41 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Template
[2009.11.12 18:26:29 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\TOSHIBA
[2009.05.26 22:15:34 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Vso
[2009.10.06 13:54:51 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\WinBatch
[2009.04.04 11:15:22 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\XnView
[2010.06.22 10:00:23 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\XSManager
[2010.05.30 21:06:52 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\xVideoServiceThief
[2010.08.03 22:27:27 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Yqam
[2010.08.03 22:27:16 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Yqim
[2010.08.08 21:53:20 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.08.09 10:26:45 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{4DBE145B-E9DA-42F0-9ED6-20B5CB287943}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.08.09 20:10:05 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Abine
[2009.03.29 04:35:37 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Adobe
[2010.07.12 15:19:53 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Apple Computer
[2009.07.20 09:52:53 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Ashampoo
[2009.03.28 23:34:09 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\ATI
[2010.08.04 19:44:48 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Ceun
[2010.03.08 09:05:45 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\DivX
[2010.06.25 21:03:06 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\dvdcss
[2009.05.02 22:29:29 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\DVDFab
[2009.08.09 12:46:26 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Feedreader
[2010.08.09 20:25:11 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Free Download Manager
[2009.12.31 20:42:47 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\FreeFLVConverter
[2009.03.28 23:41:18 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Google
[2009.03.28 23:33:36 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Identities
[2009.03.28 23:29:41 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\InstallShield
[2010.08.04 20:56:34 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Laibel
[2009.03.29 04:32:36 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Macromedia
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Media Center Programs
[2010.06.04 21:14:30 | 000,000,000 | --SD | M] -- C:\Users\MARKUS\AppData\Roaming\Microsoft
[2009.03.28 23:48:22 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Mozilla
[2009.04.19 10:52:15 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\myphotobook
[2010.04.24 14:01:32 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Nero
[2010.08.09 17:47:57 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Nokia
[2010.03.26 20:04:44 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Nokia Ovi Suite
[2009.08.01 18:50:07 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\NSeries
[2010.04.12 22:20:17 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\OpenCandy
[2009.12.20 13:30:23 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\PC Suite
[2010.01.01 18:03:50 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\PersBackup5
[2010.08.09 17:58:13 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Skype
[2010.08.09 17:44:54 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\skypePM
[2010.01.01 17:57:27 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Songbird2
[2009.03.29 12:18:55 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\T-Online
[2009.09.10 21:03:41 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Template
[2009.11.12 18:26:29 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\TOSHIBA
[2010.03.16 22:18:29 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\TVU networks
[2010.07.19 14:29:12 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\vlc
[2009.05.26 22:15:34 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Vso
[2009.10.06 13:54:51 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\WinBatch
[2009.04.04 11:15:22 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\XnView
[2010.06.22 10:00:23 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\XSManager
[2010.05.30 21:06:52 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\xVideoServiceThief
[2010.08.03 22:27:27 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Yqam
[2010.08.03 22:27:16 | 000,000,000 | ---D | M] -- C:\Users\MARKUS\AppData\Roaming\Yqim
 
< %APPDATA%\*.exe /s >
[2009.05.26 22:15:32 | 000,087,608 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\inst.exe
[2010.08.03 19:46:22 | 000,188,152 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Mozilla\Firefox\Profiles\g91g2yyx.default\FlashGot.exe
[2007.01.01 18:01:24 | 000,009,728 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\myphotobook\xtras\localVista.exe
[2007.01.08 10:34:46 | 000,006,656 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\myphotobook\xtras\localXP.exe
[2006.12.21 13:16:20 | 000,021,504 | ---- | M] (Optimum X) -- C:\Users\MARKUS\AppData\Roaming\myphotobook\xtras\shellExecute.exe
[2006.12.21 13:16:14 | 000,009,216 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\myphotobook\xtras\sleep.exe
[2010.07.09 10:42:45 | 069,222,840 | ---- | M] () -- C:\Users\MARKUS\AppData\Roaming\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe
[2010.03.05 23:42:26 | 004,004,928 | ---- | M] (Uniblue Systems Ltd                                         ) -- C:\Users\MARKUS\AppData\Roaming\OpenCandy\registrybooster(9).exe
[2010.03.16 22:18:41 | 005,514,304 | ---- | M] (TVU networks) -- C:\Users\MARKUS\AppData\Roaming\TVU networks\TVU AutoUpgrade\TVUPlayer2.5.2.2.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2008.03.25 05:22:22 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=2D77788D0B7FE269044F58C86AE099CE -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_3e1ecd89\AGP440.sys
[2008.03.25 05:22:22 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=2D77788D0B7FE269044F58C86AE099CE -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.22142_none_ba734aead7ed1bb6\AGP440.sys
[2008.03.26 05:38:23 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=ED91751834103DB2A74470CD763A49FE -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_e4087235\AGP440.sys
[2008.03.26 05:38:23 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=ED91751834103DB2A74470CD763A49FE -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20800_none_b8b64d46daa7e57a\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.03.12 08:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys
[2008.03.12 08:38:18 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.03.12 08:24:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2009.06.04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\drivers\iaStor.sys
[2009.06.04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_0813ee45\iaStor.sys
[2008.04.15 18:53:44 | 000,312,344 | ---- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_77c04a30\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2008.04.07 21:59:42 | 000,372,736 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\System32\ATIDEMGX.dll
[2006.11.02 11:46:04 | 000,380,957 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\expsrv.dll
[2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
< End of report >
         
--- --- ---
2. Ist es nicht besser die Neuinstallation incl Partition anlegen von einem Fachmann machen zu lassen auch wenns kostet? Eure Beschreibung ist sehr gut, doch bei Partition anlegen etc. kenn ich mich gar nicht aus?
Schöne Grüsse
Markus


Alt 09.08.2010, 21:11   #6
MarkusB
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



Hi,
hier ist der andere Report:
OTL EXTRAS Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 09.08.2010 20:21:12 - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\MARKUS\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 31,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 58,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 150,66 Gb Total Space | 76,82 Gb Free Space | 50,99% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 145,97 Gb Total Space | 140,80 Gb Free Space | 96,46% Space Free | Partition Type: NTFS
Drive F: | 4,20 Gb Total Space | 3,36 Gb Free Space | 79,93% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: MARKUS-PC
Current User Name: MARKUS
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe (Deutsche Telekom AG)
 
[HKEY_USERS\S-1-5-21-2688840325-2365804445-392268656-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe" "%1" (Deutsche Telekom AG)
htmlfile [opennew] -- "C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe" "%1" (Deutsche Telekom AG)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2CB1B668-E08C-4679-AE9B-C059053D7D5B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{52158ED0-7FE4-44E9-9D6E-D74A2C70D0F7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{64579DF7-687E-4B47-9152-8878A29EC5AB}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{98CEB072-3AC9-4A6F-8C82-EF1246BF567C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{99ED39F7-40A9-4340-B928-CE96706517FB}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{B4BFE370-ED8C-4A02-A3C2-B22523458244}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{C3932497-4F4D-4A15-B22B-8D059E552AB6}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{E4DDF0C1-B845-47C6-9D25-A7B90FAEFA93}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02E6B23E-B75A-40FA-8D68-645206EFEF46}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{09BD1F1C-75CE-42F7-9E27-95786C2B96F9}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{114DC8FD-5B76-41B5-A936-6003BA126818}" = protocol=17 | dir=in | app=c:\windows\system32\cnab4rpk.exe | 
"{11A91E33-EA09-44E7-A0A9-DEE9389A1DAC}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{192B2952-71C3-404E-90D6-371E4C87B02E}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{1C8E7182-3E05-4B23-B8E7-8F7A73EB2A99}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{1EDC7D93-B579-4D2F-9DCC-900F414786A8}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{23FA297F-BCA4-4660-A945-517D5F4F2B21}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{29473F39-A159-468A-B6E2-D2842EB25E5F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{2B9633A3-71E4-4A9C-8568-758F23560190}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{34358CD8-CB95-4C37-9EDA-AB52C0DAB897}" = protocol=6 | dir=in | app=c:\windows\system32\cnab4rpk.exe | 
"{3F34B8E2-2805-43A8-B642-7459F69A7DAE}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{3FAFB024-9CDA-461F-AD2F-EE24FD777171}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{41A2F8CE-8122-4116-B056-C2DD41E737B2}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{4599B02F-D939-4D00-9DCD-99A5F0A912AA}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{4B1CF3B0-4308-42D4-8FB4-EEDBC672E1BF}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{4BBB60C4-491A-402C-A81E-BD0B2B16EFA2}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{527ED8F5-FAA9-4CD2-8221-41B56F282FB6}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{52CCB772-040F-4245-BCDC-387466C4EF20}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{542F0414-D5D4-4014-855A-8BE2A323E61D}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{5A671101-6A52-4BDB-B270-6C2F7EFB895B}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{5AD7D88D-7D87-4D44-80A6-161A64F6259C}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{601A4687-6D3C-4B22-A8BB-BA2204630936}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{61B8A90A-767B-45B8-8417-8698041B047E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{7A7366D4-5E84-4530-8AA3-F1B0B20E6889}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{82239369-C1CB-4546-B917-5D5236077B43}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{845C4846-B37D-4AA8-9B13-12876D69B9FD}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{8F9A0747-03C4-4987-86CB-F36F4E80EE63}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{907B8620-F7E3-47F7-BFED-D0928240C2E4}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{9E0C97E2-5022-4103-AAAC-E068F3F1A611}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{A26F5D92-BFCD-4B47-8DB1-C366BE238913}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{A4F87951-A7FA-4F68-931C-6935B9E9D032}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{A696C0A0-7A25-4749-B6E4-B48985D675DD}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{AE4719EA-3252-42B6-AFC1-297611BD6C03}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{B4FA11C4-C915-4855-B406-98056CF0B1EA}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{B57FF825-3376-48AF-85B1-4E5D540BD91D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BCAD20FF-FC0A-49C7-9CBC-B189738C99CD}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{C8161EAC-E540-4C76-8AED-BFE42ED50D5C}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{F90AC71E-33E3-4A51-BF81-5424FA5DB4DB}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{FC79BCA5-9EEC-43BF-8907-678E081411B3}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"TCP Query User{035F3151-7EB9-4600-B26C-6787A4FFF26E}C:\gts\gts.exe" = protocol=6 | dir=in | app=c:\gts\gts.exe | 
"TCP Query User{10150D6B-B2ED-4472-AF28-E3397F819365}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe | 
"TCP Query User{15F9D7AF-120C-4A87-A406-734747DB6DD3}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 
"TCP Query User{1F9A79A7-1309-4F6B-A332-37D8F9833B8E}C:\gts\gts.exe" = protocol=6 | dir=in | app=c:\gts\gts.exe | 
"TCP Query User{3C02E468-127A-47BE-8EBD-A5B6D5D7F03A}C:\program files\zattoo\zattood.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattood.exe | 
"TCP Query User{44651961-CC11-40C6-8178-C1B7DDD8AC52}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"TCP Query User{49EE1AFF-39FE-463E-93B5-51D022C27F9D}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe | 
"TCP Query User{5BE47E59-6061-452C-A2F3-DF43E577FD3C}C:\program files\free download manager\fdm.exe" = protocol=6 | dir=in | app=c:\program files\free download manager\fdm.exe | 
"TCP Query User{61E80C6B-4230-449C-9852-859AB80A3E68}C:\gts\update.exe" = protocol=6 | dir=in | app=c:\gts\update.exe | 
"TCP Query User{628A8831-42D2-442A-887A-3416A5DC164D}C:\program files\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files\tvants\tvants.exe | 
"TCP Query User{63AF4528-CD34-4EAE-927B-72F432964675}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe | 
"TCP Query User{8BCB7B72-9B85-4BC6-B5D1-35F5EF6CDE22}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe | 
"TCP Query User{C024AAA8-39AE-49A2-AD47-414013B1DF04}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{C18D30E0-9EDB-489E-B592-AE8E9A2E427F}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{C49EB9A1-B818-47AE-8ACA-CB315F5B35D5}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{D635B823-0895-4A8A-8950-2D1C45B929F1}C:\program files\zattoo\zattoo.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattoo.exe | 
"TCP Query User{EFE04263-54C9-4EFA-8F11-61692A178B23}C:\gts\update.exe" = protocol=6 | dir=in | app=c:\gts\update.exe | 
"TCP Query User{FB0C9EE6-9B60-47B3-8658-9A9A66864773}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe | 
"UDP Query User{00866BFE-9DEE-4D8A-B4A8-6854727093F5}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 
"UDP Query User{208757E2-345E-49DB-AC0B-FC977BD49C43}C:\program files\zattoo\zattood.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattood.exe | 
"UDP Query User{23650263-A31F-4C92-9164-E29C0282CDA1}C:\gts\gts.exe" = protocol=17 | dir=in | app=c:\gts\gts.exe | 
"UDP Query User{259C7BAD-B81B-465A-83EE-BFFC772D7136}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{7FECDE9B-1E9A-49DA-ABEB-A1D1EEA28C6E}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe | 
"UDP Query User{80F909C3-A146-44E4-9EDF-6736373599CA}C:\program files\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files\tvants\tvants.exe | 
"UDP Query User{970C3ED8-21AD-4F83-BC43-DE361B032A11}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 
"UDP Query User{99771BD1-F739-44EB-92FB-B3AAC47A1EA0}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{B9FB4560-FA55-423A-B732-BC7E77DEAC5E}C:\program files\free download manager\fdm.exe" = protocol=17 | dir=in | app=c:\program files\free download manager\fdm.exe | 
"UDP Query User{BB267437-B34F-45BD-85C5-0359DD252B5C}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{BF3346F4-434D-4768-9F28-3FFF6FD612AD}C:\gts\update.exe" = protocol=17 | dir=in | app=c:\gts\update.exe | 
"UDP Query User{CC6B4B3E-3548-4951-803C-E0D39169AE6A}C:\gts\gts.exe" = protocol=17 | dir=in | app=c:\gts\gts.exe | 
"UDP Query User{D2456704-CECE-403B-9F2F-007CC9AC5ACD}C:\program files\zattoo\zattoo.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattoo.exe | 
"UDP Query User{DA7B0229-DCF7-4BE3-933E-A1A59E6674B9}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe | 
"UDP Query User{DACF17EB-1285-405C-8F6E-8BFE37213A79}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe | 
"UDP Query User{E053975E-D638-4EF2-A64E-561475B39EFC}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe | 
"UDP Query User{E9A42933-53EC-416A-95C6-77DD84559C25}C:\gts\update.exe" = protocol=17 | dir=in | app=c:\gts\update.exe | 
"UDP Query User{F099B628-5A5A-414E-9D37-8AC331C6B29E}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{08233ADA-AA4C-A977-58FD-DB6C684BE010}" = Catalyst Control Center Localization Norwegian
"{0B4C7D42-323A-F3FD-5B18-0222082E6FDD}" = Catalyst Control Center Localization Dutch
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{0D348034-9CBE-19FC-19B0-B2CDC78E50F1}" = ccc-core-static
"{0D5D0BEE-FBA9-4928-A50D-6CDFAB827755}" = TOSHIBA ConfigFree
"{0EABFEF6-6D10-4C12-8667-3029C481D355}" = Nokia Photos
"{10B35323-BE1A-61FB-C4D1-E88F24147617}" = Catalyst Control Center Localization Thai
"{11FC2772-F7FD-21FD-614F-CE58BF52C398}" = Catalyst Control Center Localization Chinese Standard
"{12911298-DDB4-AD44-E530-AEB8127503C9}" = CCC Help Italian
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{156E98D0-1AEC-4013-A41A-94A1A01BFD68}" = O2Micro Flash Memory Card Reader Driver (x86)
"{1714616C-61CE-44D5-AF0B-53404D7FA83A}" = Catalyst Control Center Localization Korean
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18625A47-84A9-6F6C-3780-79221B6095C3}" = CCC Help Norwegian
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{19DC9559-9C20-4A46-A67D-7ECBA52A2788}" = Nokia PC Suite
"{19F62E2F-ABDB-4BE7-A7BB-38DF264D8F72}" = xVideoServiceThief
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1C3F57C7-8474-DF38-8F9F-0EBFB554FD56}" = Catalyst Control Center Localization Hungarian
"{1C971EE3-B4C4-4367-9676-57549919C6CE}" = TOSHIBA Benutzerhandbücher
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{264324EA-35F7-AD77-CC96-F9F47A9A6284}" = Catalyst Control Center Localization Czech
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 20
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2A6F930B-12DA-AD4F-C4A4-E008F73A8016}" = CCC Help English
"{2AEC1EC0-0C01-8831-B04F-41FB4A92B677}" = Catalyst Control Center Localization Spanish
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{31326B80-1D01-4DBA-1DCA-A0731182A2E6}" = CCC Help Korean
"{31DD9FF4-23CD-7898-0305-70D806E2F7DB}" = CCC Help Japanese
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6
"{33AC44A1-81C2-0A61-0EC0-59EFC503A1EA}" = Catalyst Control Center Localization Danish
"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DFE65B6-3AC9-C44A-1160-A449E0DFFE94}" = CCC Help Greek
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{405AE172-0CE0-E2A1-1693-1B120B71AF32}" = Catalyst Control Center Localization Japanese
"{43B74FAB-FB58-447D-8D3A-5F638AF36FD1}" = Netzmanager
"{45D4F727-43B5-49CD-B474-B9866A8F4FB8}" = Nokia Map Loader
"{47D3E4CE-B7D1-4EA7-87E4-ED06F1BB5FA3}" = Internationaler Zugang
"{491DD193-1B57-4D1C-8B14-18B96992A89F}" = TOSHIBA Supervisor Password
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DC3B285-BE6C-E873-42A1-AE221B3BE4F2}" = CCC Help Hungarian
"{4E1CD3D5-D4EE-4246-AE24-F0FD5A60390D}" = OviMPlatform
"{4F77F6EE-2C99-49F7-940A-2E9C208C3BE1}" = Paint.NET v3.5.2
"{52573F8D-F099-4CB5-9EDE-5C27ECB4A02B}" = TOSHIBA Hardware Setup
"{54CAB637-25EA-33FE-2FF4-6F6182BCCF12}" = CCC Help Chinese Standard
"{567AE922-FB8D-943D-921E-B390A2FBD625}" = CCC Help Russian
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5788504C-08BC-E414-C019-60D8E2A2A1EB}" = CCC Help Portuguese
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F65ECEE-EB1D-4C85-8D8C-9C7CE2DBB1D6}" = Marco Polo Mobile Navigator 2
"{60DED9C2-22BF-47A3-B6C8-6B141BA31DFD}" = Ovi Desktop Sync Engine
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69E5255D-9D43-4CFF-8984-843ABD7753B7}" = Catalyst Control Center - Branding
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6BCE01B8-333E-667E-0FC9-5070EA9B8108}" = Catalyst Control Center Localization Swedish
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D3A2A6C-59CD-4A6D-9516-0A34C393ED95}" = Nokia MTP driver
"{6EA4F33E-8F12-AB92-D497-2D454E3C4BB7}" = CCC Help Polish
"{6FB6D968-6E8D-3FCB-1F2D-7ED24FC1BA07}" = CCC Help Swedish
"{7206AFB8-99ED-B788-3DE8-0AE3DBD97B24}" = Catalyst Control Center Localization French
"{72CBC468-82F9-48F8-B5B0-3300387E41AA}" = Nokia Ovi Suite Software Updater
"{732662AE-82C0-9184-CE57-4257695EE1CE}" = CCC Help German
"{73C0DA51-DB32-4F66-970B-7298F3CAF37F}" = Nokia Software Updater
"{754F90E7-DE41-0ADE-2E3F-2C269ED9C2EE}" = CCC Help Finnish
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder
"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
"{7B12F319-43E1-D2DD-ABFE-50E34F76A740}" = Catalyst Control Center Graphics Full New
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C30283C-8DC7-4FBB-805E-52BEA5F580E8}" = Toshiba TEMPRO
"{7CD8E2EF-AD40-7BD3-13E5-2B2847E568DD}" = ATI Catalyst Install Manager
"{7E340EDB-9BF0-5CF2-C12D-7C31992070E3}" = CCC Help Turkish
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{909D42D6-8FCE-4A07-9181-2D9571B122E8}" = GTS
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{911A0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Outlook 2002
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{971F3D40-5145-45D3-A5A2-FAAB5DDF07CA}" = Final Draft 6 Viewer
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AF16DB8-2845-88FE-BDC2-EEF067F9B1EC}" = Catalyst Control Center Graphics Full Existing
"{9E166691-B3ED-0F76-1FE9-AB3DBAAD75DD}" = CCC Help French
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A508C1F7-08EA-4CD4-91F4-A4FC91309FA9}" = GTS der Onvista Bank
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB6FFA58-F491-11D3-8951-000000015799}" = Internationaler Zugang
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch
"{AED994C5-E6CE-0377-09ED-C4000E4189BF}" = Catalyst Control Center Core Implementation
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF899B9E-5842-8839-3EDB-AF9EADF52F45}" = ccc-utility
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B245D989-F88A-C2C3-1958-A91254DEC387}" = Catalyst Control Center Graphics Light
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B3D15F34-F377-26A0-4CCF-2CB47E5810CD}" = CCC Help Dutch
"{B5359AD5-4950-174E-4070-CDB1881B161F}" = CCC Help Czech
"{B547CB8D-549A-436E-97B5-E79F911B11E2}" = SDP Downloader
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{C07CA803-141E-A7C3-13E0-AB99FC5DC7B4}" = Catalyst Control Center Localization Polish
"{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C7838AAD-8B29-86D3-6E04-417C7B7EE628}" = Catalyst Control Center Localization Greek
"{C8585E46-A5C9-8E20-77CA-378D5C291B09}" = Catalyst Control Center Localization Finnish
"{C92C2F87-1E84-A9E5-81F3-3B93DC991A4E}" = Catalyst Control Center Localization Chinese Traditional
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CB01DA5C-48B7-D9A6-22DE-D678D6007C56}" = Catalyst Control Center Localization German
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D05EB4EF-29BE-8031-9AF5-2DC9485D5870}" = Catalyst Control Center Localization Russian
"{D0C73318-7B4A-4D16-A0C4-3B83F075EA88}" = Search Settings 1.2
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D7F069BF-7A9F-6A09-D5AE-E77F8B2E892F}" = CCC Help Danish
"{DA18FD01-4830-45D6-8408-8F20A9D89D95}" = PC Connectivity Solution
"{DA29D017-6E24-481D-BC7C-2B69335A0B3A}" = TrueSuite Access Manager
"{DDC519DE-AC45-634C-C009-6FCE1EF313F3}" = Catalyst Control Center Localization Portuguese
"{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}" = Nokia Ovi Suite
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile-Gerätecenter: Treiberupdate
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E94603CA-2996-4154-8EE2-A5FCD4BFB500}" = Nokia Lifeblog 2.5
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{ED3C1C9D-0496-6884-8B32-8A2B73219C20}" = Catalyst Control Center Localization Italian
"{F0A85260-5B90-4C0E-07FF-72A89AA18F77}" = Skins
"{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA
"{F24E1A94-76DD-85BD-5B6C-6701CC4E8A0F}" = CCC Help Chinese Traditional
"{F4614173-1F8B-A19A-C2CC-57834FBCCE6C}" = CCC Help Spanish
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F81AB80B-5BB7-4E36-8BA5-E07541CE1BFC}" = HDMI Control Manager
"{F89CF986-3AA7-8B20-390A-D5C09F27F85D}" = Catalyst Control Center Localization Turkish
"{F8F37F88-4CB6-9162-AE65-7BBA7E476547}" = Catalyst Control Center Graphics Previews Vista
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"{FFF7CB0F-FA65-7115-2CEC-16C21037C88E}" = CCC Help Thai
"05B59228C7E1C21DFBE89260F879BD95880548D8" = Windows-Treiberpaket - Nokia Modem  (10/05/2009 4.2)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"7-Zip" = 7-Zip 4.65
"8CDCFB95BB84DD9C0F88F22266A0CA86035E55BA" = Windows-Treiberpaket - Nokia Modem  (06/01/2009 7.01.0.4)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon LBP2900" = Canon LBP2900
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_5051&SUBSYS_1179" = HDAUDIO Soft Data Fax Modem with SmartCP
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDFab 6_is1" = DVDFab 6.0.1.0 (May 15, 2009)
"FeedReader_is1" = FeedReader
"Firebird SQL Server D" = Firebird SQL Server - MAGIX Edition 2.0.0.1 (D)
"FormatFactory" = FormatFactory 2.20
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free FLV Converter_is1" = Free FLV Converter V 6.7.4
"Free YouTube Download_is1" = Free YouTube Download 2.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.3
"Google Desktop" = Google Desktop
"GXTranscoder v2" = GXTranscoder v2
"GXTranscoder_is1" = GX::Transcoder v5.0 Beta 10.8
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{491DD193-1B57-4D1C-8B14-18B96992A89F}" = TOSHIBA Supervisor Password
"InstallShield_{52573F8D-F099-4CB5-9EDE-5C27ECB4A02B}" = TOSHIBA Hardware Setup
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TRDCReminder
"InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition
"InstallShield_{DA29D017-6E24-481D-BC7C-2B69335A0B3A}" = TrueSuite Access Manager
"InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORDCLauncher
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"MAGIX Digital Foto Maker SE D" = MAGIX Digital Foto Maker SE 4.1.0.835 (D)
"MAGIX Foto Suite D" = MAGIX Foto Suite 1.12.0.89 (D)
"MAGIX Online Druck Service D" = MAGIX Online Druck Service 2.3.2.0 (D)
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"myphotobook" = myphotobook 3.6
"Netzmanager" = Netzmanager
"Nokia Ovi Suite" = Nokia Ovi Suite
"Nokia PC Suite" = Nokia PC Suite
"oyomo" = Favorit
"Personal Backup_is1" = Personal Backup 5.0
"Picasa 3" = Picasa 3
"Samsung ML-2510 Series" = Samsung ML-2510 Series
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SMPlayer" = SMPlayer 0.6.9
"Songbird-release-1438" = Songbird 1.4.3 (Build 1438)
"SopCast" = SopCast 3.0.3
"SUPER ©" = SUPER © Version 2009.bld.35 (Jan 5, 2009)
"TVAnts 1.0" = TVAnts 1.0
"TVUPlayer" = TVUPlayer 2.4.5.1
"Uninstall_is1" = Uninstall 1.0.0.1
"Videoload Manager" = Videoload Manager 1.0.1545
"VLC media player" = VLC media player 1.1.0
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"XMedia Recode" = XMedia Recode 2.2.4.7
"XnView_is1" = XnView 1.96
"XSManager" = XSManager
"Zattoo4" = Zattoo4 4.0.5
"Zylom Games Player Plugin" = Zylom Games Player Plugin
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 18.04.2010 04:50:45 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 18.04.2010 07:51:01 | Computer Name = MARKUS-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung mcupdate.EXE, Version 6.0.6002.18005, Zeitstempel
 0x49e02324, fehlerhaftes Modul KERNEL32.dll, Version 6.0.6002.18005, Zeitstempel
 0x49e037dd, Ausnahmecode 0xe0434f4d, Fehleroffset 0x0003fbae,  Prozess-ID 0x484, 
Anwendungsstartzeit 01cadeed58fa6220.
 
Error - 18.04.2010 11:32:14 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 18.04.2010 17:26:01 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 18.04.2010 17:28:58 | Computer Name = MARKUS-PC | Source = Application Hang | ID = 1002
Description = Programm cfmain.exe, Version 7.2.0.20 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: dcc  Anfangszeit: 01cadf3e07f925ac  Zeitpunkt der Beendigung:
 0
 
Error - 19.04.2010 03:00:15 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 19.04.2010 07:50:52 | Computer Name = MARKUS-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung mcupdate.EXE, Version 6.0.6002.18005, Zeitstempel
 0x49e02324, fehlerhaftes Modul KERNEL32.dll, Version 6.0.6002.18005, Zeitstempel
 0x49e037dd, Ausnahmecode 0xe0434f4d, Fehleroffset 0x0003fbae,  Prozess-ID 0xe28, 
Anwendungsstartzeit 01cadfb6836a892b.
 
Error - 19.04.2010 13:54:33 | Computer Name = MARKUS-PC | Source = EventSystem | ID = 4621
Description = 
 
Error - 19.04.2010 16:26:03 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 20.04.2010 02:58:03 | Computer Name = MARKUS-PC | Source = WinMgmt | ID = 10
Description = 
 
[ OSession Events ]
Error - 12.12.2009 08:27:09 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1234
 seconds with 1200 seconds of active time.  This session ended with a crash.
 
Error - 12.12.2009 12:08:17 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 739
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 15.12.2009 19:08:51 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 23994
 seconds with 180 seconds of active time.  This session ended with a crash.
 
Error - 16.02.2010 16:49:23 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7446
 seconds with 300 seconds of active time.  This session ended with a crash.
 
Error - 06.03.2010 11:13:39 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 19209
 seconds with 480 seconds of active time.  This session ended with a crash.
 
Error - 02.04.2010 07:30:42 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 194
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 24.04.2010 14:31:30 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 198
 seconds with 180 seconds of active time.  This session ended with a crash.
 
Error - 17.05.2010 09:28:00 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 15011
 seconds with 1380 seconds of active time.  This session ended with a crash.
 
Error - 31.05.2010 16:34:19 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 383
 seconds with 60 seconds of active time.  This session ended with a crash.
 
Error - 28.06.2010 14:57:55 | Computer Name = MARKUS-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 489
 seconds with 300 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 07.08.2010 04:25:42 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 07.08.2010 05:03:04 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 07.08.2010 05:03:04 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 08.08.2010 02:08:07 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 08.08.2010 02:08:07 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 08.08.2010 10:18:08 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 08.08.2010 10:18:08 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 09.08.2010 04:24:55 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 09.08.2010 04:24:55 | Computer Name = MARKUS-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 09.08.2010 06:41:28 | Computer Name = MARKUS-PC | Source = cdrom | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.
 
 
< End of report >
         
--- --- ---


Ja ich weiß, es sollten 2 sein. Habs erst jetzt geschnallt.
Falls sensible Daten in dem report sind-bitte die Postings nach Durchcheck einfach wieder löschen.
Schöne Grüsse
Markus

Alt 09.08.2010, 21:27   #7
markusg
/// Malware-holic
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



das ist eig quatsch dafür nen fachmann aufzusuchen.
windows cd rein, anweisungen folgen, irgendwann kannst du die c partition wählen, dann gibts die punkte schnelles formatieren oder normal, das letztere wählst du. dann wird formatiert und windows wird instaliert.
wenn du ne recovery cd hast, geht das automatisch ab.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

danach schalte den avira guard ab, öffne "mein computer"(arbeitsplatz) dort c:
dann rechtsklick auf qoobox, zu qoobox.zip oder rar hinzufügen, und das archiv hochladen.
http://www.trojaner-board.de/54791-a...ner-board.html
ich geb dir morgen tipps, wie du den pc absichern solltest.

Alt 09.08.2010, 22:21   #8
MarkusB
 
Onlinbankingsperre wg Zeus2 - Icon27

Onlinbankingsperre wg Zeus2



bei combofix ausführen wrant ne Seite mit lautem pieps wg neg Downloadsieten und bezahlung. Zitter?
Habe es vom Bleeping computerseite über euer link downgeloaded und geöffnet, aber dann abgebrochen.
Braucht es diese logfile wirklich?
Verstehe auch das Hochladen nicht ganz, da bei rechtsclick auf C bei mir keine qoobox auftaucht?

Alt 09.08.2010, 23:47   #9
MarkusB
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



Hilfe, combofix logfile hochgeladen und seitdem Probelme mit dem T-Online Startcenter, das nicht aufgeht sondern meldet: sie haben das center mit adminsitratorrechten gestartet, es braucht aber nur benutzerrechte, und verlangt für die administartorrechte eine einwilligung?
Was heisst das?
Krieg meine emailsoftware nicht auf: Schock.

Alt 10.08.2010, 09:39   #10
MarkusB
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



Hab die T-online software wieder zum Laufen gekriegt via Systemwiederherstellungspunkt = createrstorepoint otl.
Hab Dateien gesafed auf DVD. Will jetzt neuinstallieren:
Muß ich das aktuelle infizierte Betriebsystem löschen oder formatieren oder defragmentieren bevor ich die Rediscoverydisk einlege?
Was muß ich noch beachten vor Neuinstallation?
Dank für Info vom Könner.

Alt 10.08.2010, 11:17   #11
markusg
/// Malware-holic
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



hmm vllt liegts daran das du combofix abgebrochen hast...? du sollst c: öffnen und dann nen rechtsklick auf qoobox machen, aber ohne das log gesehen zu haben kann ich dir nicht sagen was da passiert ist

Alt 10.08.2010, 11:41   #12
MarkusB
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



habe gestern nacht 2 Logs aus combofix hochgeladen, allerdings nicht aus qoobox sondern einfach die beiden Kopiert und eingefügt und uploaded
?
Falsch?
Will jetzt neuausfsetzen kann aber dateien nicht mehr über das DVDlaufwerk sichern, da die dvds als schreibegschützt angegben werden und windows installer settings versucht und dann stoppt mit error 1706.
Kann nichts mehr auf dvds speichern, da laufwerk und dvd als schreibgeschützt gemeldet werden.
Absichern über usb stick geht.
DVD Laufwerk ignorieren und Neuaufsetzen beginnen?

Alt 10.08.2010, 23:16   #13
MarkusB
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



Habe Vista neuinstalliert. Hab von einemUSB Stick worddateien, Bilder und Videos geladen - lag alles vor der Zues2 Infektion.
Kann ich von einer DVD+USB Stick Back Ups, die nach der Zeus2 Infektion lagen, laden?
Geht um Worddateien, JPEG und MMS vom handy, Emails aus der T-onlinesoftware incl Adressbuch.
Hab Angst, daß der /Die Torjaner dann wieder kommen.
??
Sehr dankbar für Hilfe
MB

Alt 11.08.2010, 11:36   #14
markusg
/// Malware-holic
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



hi, du kannst die dvd ja scannen.
aber erst mal n paar tipps, um den pc abzusichern.
Standard nutzer einrichten.
standard und admin konto sollten natürlich beide passwort geschützt sein.
klicke start, tippe unter suchen (ausführen) systemsteuerung. wähle dort Benutzerkonten hinzufügen/entfernen.
wähle "neues konto erstellen"
Wähle standard benutzer.
wenn du jetzt auf das neue konto klickst, kannst du ein kennwort vergeben, das solltest du natürlich auch für das admin konto machen.
windows vista kann bei instalationen kurzfristig höhere rechte vergeben von daher sollten instalationen im standard konto möglich sein.
2.
dep für alle prozesse:
Datenausführungsverhinderung (DEP)
• "Datenausführungsverhinderung für alle Programme und Dienste mit Ausnahme der ausgewählten einschalten:".
wenn es zu problemen kommen sollte, kann man die betroffenen prozesse aus der Überwachung entfernen.
3.
SEHOP aktivieren:
Aktivieren von SEHOP &#40;Structured Exception Handling Overwrite Protection&#41; in Windows-Betriebssystemen
klicke auf "Feature automatisch aktivieren"
und folge den anweisungen
4. firefox,
http://filepony.de/download-noscript//
hiermit werden java und sonstige scripts blokiert, wenn du für irgend eine seite freigaben benötigst, rechtsklick auf der seite, noscript, alle beschrenkungen
aufheben, hebt sie dauerhaft auf, temporär nur für den jeweiligen besuch, du kannst die enderungen natürlich auch rückgängig machen.
adblock zum werbung blocken:
Adblock Plus: Bekannte Filterlisten für Adblock Plus
nimm dir 2 deutsche filter + malware filter liste.
5.
um das surfen sicherer zu machen, würde ich Sandboxie empfehlen.
Download:
drop.io
(als pdf)
wenn du mit dem programm gut auskommst, ist ne lizenz zu empfehlen.
1. es gibt dann noch ein paar mehr funktionen.
2. kommt nach nem monat die anzeige, dass das programm freeware ist, die verschwindet erst nach ner zeit, find ich n bissel nerfig.
3. ist die lizenz lebenslang gültig, kostenpunkt rund 25 €, und du kannst sie auf allen pcs in deinem haushalt einsetzen.

6.
update checker:
würde da secunia
http://www.trojaner-board.de/83959-s...ector-psi.html
und file hippo laufen lassen:
FileHippo.com - Download Free Software
windows updates und servicepacks hast du ja hoffendlich schon alle instaliert.

Alt 11.08.2010, 13:18   #15
MarkusB
 
Onlinbankingsperre wg Zeus2 - Standard

Onlinbankingsperre wg Zeus2



Danke MarkusG. Hab die Combo LOgs vorgestern wirklich hochgeladen.
Jetzt Alles gemacht ausser Sehop - wichtig?
Beim Scan mit AV der USB sticks und DVDs hab ich nur 1 Warnung im Protokoll ohne nähere angaben wovor genau. Ignorieren?

Antwort

Themen zu Onlinbankingsperre wg Zeus2
32 bit, aktuelle, antivir, bilder, computer, edition, emails, frage, freeware, gefährlich, gesperrt, home, home premium, komplett, passwörter, quarantäne, scan, service, service pack 2, system, trojaner, version, virenscan, vista, vista home premium, windows, windows vista, windows vista home, worddateien



Ähnliche Themen: Onlinbankingsperre wg Zeus2


  1. Trojanisches Pferd "zeus2" auf meinem Computer
    Plagegeister aller Art und deren Bekämpfung - 10.07.2013 (44)
  2. Onlinebanking-Trojaner Zeus2 / ZBot obwohl KEIN Onlinebanking genutzt wird
    Plagegeister aller Art und deren Bekämpfung - 21.05.2013 (4)
  3. Zeus2 onlinebanking gesperrt
    Plagegeister aller Art und deren Bekämpfung - 12.05.2013 (16)
  4. Onlinebanking-Trojaner Zeus2 / ZBot
    Log-Analyse und Auswertung - 31.01.2013 (8)
  5. Zeus2 und Zbot. Sperrung des Online Bankings
    Plagegeister aller Art und deren Bekämpfung - 14.01.2013 (1)
  6. Online Banking gesperrt-Zeus2/Zbot- Formatierung empfohlen?
    Log-Analyse und Auswertung - 01.11.2012 (5)
  7. Trojaner vom Typ Zeus2 sicher löschen
    Log-Analyse und Auswertung - 09.08.2012 (1)
  8. Trojaner zeus2 eingefangen
    Plagegeister aller Art und deren Bekämpfung - 08.08.2012 (8)
  9. Bankingsperre wg Zeus2 - zum zweiten Mal!
    Plagegeister aller Art und deren Bekämpfung - 11.10.2011 (9)
  10. Nachricht von der Bank, Rechner sei mit Zeus/Zeus2 infiziert
    Log-Analyse und Auswertung - 17.11.2010 (17)
  11. Anruf von Sparkasse: Phishing-Attacke durch Zeus2
    Plagegeister aller Art und deren Bekämpfung - 19.07.2010 (23)

Zum Thema Onlinbankingsperre wg Zeus2 - Hallo, meine Bank hat meinen Onlinebankingzugang gesperrt, da sie einen Zeus2 Trojaner feststellten, der von meinem Computer kam und den sie als gefährlich einstufen, da er PINs und Passwörter ausspioniert. - Onlinbankingsperre wg Zeus2...
Archiv
Du betrachtest: Onlinbankingsperre wg Zeus2 auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.