MS removal Tool vollständig entfernen

Deathkid535 · 28.06.2011, 14:13

Hallo M-K-D-B
Ich habe den AntiVir-Guard deaktiviert, und dann ComboFix gestartet, doch dieser schreibt, dass dieser noch immer aktiv ist.
Könntest du mir bitte sagen, wie man ihn Deaktiviert, da ich durch google-suche auch nicht draufgekommen bin

Zu der Frage:
Nein, den habe ich nicht eingerichtet, ich weiss nicht einmal, was das ist.
MFG,
Deathkid

M-K-D-B · 28.06.2011, 14:56

Hallo Deathkid,

Zitat:

Zitat von Deathkid535

Ich habe den AntiVir-Guard deaktiviert, und dann ComboFix gestartet, doch dieser schreibt, dass dieser noch immer aktiv ist.
Könntest du mir bitte sagen, wie man ihn Deaktiviert, da ich durch google-suche auch nicht draufgekommen bin

Bricht ComboFix einfach ab oder kannst du trotzdem mit der Bereinigung fortfahren? In der Regel macht Avira keine großen Probleme.

Es sollte genügen, wenn du rechts unten an der Taskleiste mit einem Rechtsklick auf das Icon von Avira klickst und darüber den AntiVir Guard deaktivierst.

Auch wenn ComboFix meckert, sollte es dennoch in der Lage sein, durchzulaufen.

Bitte nochmal versuchen und berichten.

Deathkid535 · 28.06.2011, 19:43

Hallo M-K-D-B,
Nach einigen Stunden des durchlaufen lassens(sollte wohl nicht so sein), ist bis jetzt genau GAR NICHTS passiert.
Liegt das an dem AntiVir?
MFG,
Deathkid

M-K-D-B · 28.06.2011, 20:05

Hallo Dathkid,

wir versuchen etwas anderes.

Schritt # 1: ComboFix über Befehlszeile ausführen
Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von einem der folgenden Download-Spiegel neu herunter:

BleepingComputer.com - ForoSpyware.com

und speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste und kopiere folgendes in die Ausführen Zeile

Code:

ATTFilter

"%userprofile%\Desktop\Combofix.exe" /killall

Poste bitte die Combofix.txt hier in dein Thema

Schritt # 2: Deine Rückmeldung
Zur weiteren Analyse benötige ich zusammen mit deiner nächsten Antwort

das Logfile von ComboFix.

Deathkid535 · 28.06.2011, 20:27

Hallo M-K-D-B,
Bis jetzt ist noch immer nichts probiert, sieht auch so aus als würde auch die nächsten Stunden wieder nichts passieren.
Gruß,
Deathkid

M-K-D-B · 28.06.2011, 20:30

Hallo Deathkid,

Zitat:

Zitat von Deathkid535

Bis jetzt ist noch immer nichts probiert, sieht auch so aus als würde auch die nächsten Stunden wieder nichts passieren.

Ich erkundige mich intern im Team. Antwort folgt.

M-K-D-B · 29.06.2011, 20:22

Hallo Deathkid,

Schritt # 1: GMER Rootkitscan
Bitte

alle anderen Scanner gegen Viren, Spyware, usw. deaktivieren,
keine bestehende Verbindung zu einem Netzwerk/Internet (WLAN nicht vergessen),
nichts am Rechner arbeiten,
nach jedem Scan den Rechner neu starten.

Gmer scannen lassen

Lade Dir Gmer von dieser Seite herunter
(auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
Alle anderen Programme sollen geschlossen sein.
Starte gmer.exe (Programm hat einen willkürlichen Programm-Namen).
Vista und Win7 User mit Rechtsklick und als Administrator starten.
Sollte sich ein Fenster mit folgender Warnung öffnen:
WARNING !!!
GMER has found system modification, which might have been caused by ROOTKIT activity.
Do you want to fully scan your system ?
Unbedingt auf "No" klicken.
Entferne rechts den Haken bei:
- IAT/EAT
- Alle Festplatten ausser die Systemplatte (normalerweise ist nur C:\ angehackt)
- Show all (sollte abgehackt sein)
Starte den Scan mit "Scan". Mache nichts am Computer während der Scan läuft.
Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Schritt # 2: Systemscan mit OTL

Starte bitte OTL.exe.
Wähle unter Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.

Schritt # 3: Fragen beantworten
Bitte beantworte mir folgende Fragen:

Wie läuft dein Rechner derzeit?
Gibt es irgendwelche Probleme? Wenn ja, beschreibe diese bitte so gut es geht.

Schritt # 4: Deine Rückmeldung
Zur weiteren Analyse benötige ich zusammen mit deiner nächsten Antwort

das Logfile von GMER,
die beiden Logfiles von OTL (OTL.txt und Extras.txt) und
die Beantwortung der gestellten Fragen.

Deathkid535 · 01.07.2011, 13:19

Hallo M-K-D-B,
Ich habe Avira deinstalliert, Computer neugestartet, aber Combofik bleibt bei "... kann sich die Zeit verdoppeln" hängen. Ich habe auch schon versucht, ComboFix über die Befehlszeile auszuführen. Ausserdem jammert das Programm noich immer rum, dass AntiVir Desktop aktiv ist.

M-K-D-B · 01.07.2011, 16:03

Hallo Deathkid535,

Wenns nicht will, dann wills halt nicht.

Wir machen so weiter:

Schritt # 1: Fix mit OTL

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

:OTL
SRV - (PEVSystemStart) --  File not found
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2851647&SearchSource=3&q={searchTerms}"
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?babsrc=toolbar2&q="
[2010.12.16 13:56:14 | 000,000,931 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\0q27vfov.default\searchplugins\conduit.xml
[2010.10.14 20:01:12 | 000,010,017 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\0q27vfov.default\searchplugins\mywebsearch.xml
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
[2011.06.26 21:29:44 | 000,000,000 | ---D | C] -- C:\ProgramData\bL28601DaMcK28601
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:D1B5B4F1

:commands
[Emptytemp]

Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

Schritt # 2: Kontrollscan mit Malwarebytes' Anti-Malware (MBAM)

Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt # 3: Scan mit SuperAntiSpyware (SAS)
Downloade Dir bitte SUPERAntiSpyware FREE Edition

Installiere das Programm und lasse das Programm die neuesten Definition und Updates laden.
Schließe alle Anwendungen inkl. Browser.
Öffne SUPERAntiSpyware und klicke auf Ihren Computer durchsuchen.
Setze ein Häkchen bei Kompletter Scan und klicke auf Weiter.
Wenn der Suchlauf beendet ist, wird Dir eine Übersicht mit den Funden angezeigt, die Du mit OK zur Kenntnis nimmst.
Achte darauf, dass bei allen Funden ein Häkchen steht, klicke dann auf Weiter und OK.
Klicke auf Fertig stellen, was Dich ins Hauptfenster bringt.
Es kann sein, dass Dein Rechner neu gestartet werden muss, um Malware mit dem Neustart vom System zu entfernen.
Um das Logfile zu erhalten, musst du erst auf Präferenzen und dann auf den Statistiken und Protokolle klicken.
Klicke auf das datierte Logfile, drücke auf Protokoll anzeigen. Nun erscheint ein Textfenster.
Bitte kopiere diesen Bericht hier in den Thread.

Schritt # 4: Rootkitscan mit Rootkit Unhooker (RKU)
Downloade Dir bitte RKUnhookerLE
und speichere die Datei auf deinem Desktop.

Trenne dich vom Internet ( Wlan nicht vergessen ), deaktiviere alle Hintergrundwächter, besonders den deiner Anti-Viren Software.
Schließe alle offenen Programme.
Starte die RKUnhookerLE.exe
Windows Vista und Windows 7 mit Rechtsklick "Als Administrator ausführen"
Klicke rechts auf Report und anschließend auf den Scan Button.
Setze ein Häkchen vor
- Drivers
- Stealth Code
- Code Hooks
Entferne alle anderen Haken.
Bestätige mit Ok.
Wenn Du gefragt wirst, welcher Bereich gescannt werden soll, gehe sicher das dein Systemlaufwerk ( meistens C: ) angehakt ist. Deaktiviere alle anderen Laufwerke. Bestätige wieder mit Ok.
Das Tool scannt nun deinen Rechner. Hab Geduld.
Wenn der Scan beendet ist, klicke auf File -> Save Report
Speichere die Datei als RKU.txt auf deinem Desktop.
Klicke auf Close und bestätige mit Ja.
Poste das Logfile mit deiner nächsten Antwort.

Hinweis: Solltest Du folgende Warnung bekommen

Zitat:

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Klicke auf OK

Schritt # 5: Systemscan mit OTL

Starte bitte OTL.exe.
Wähle unter Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.

Schritt # 6: Fragen beantworten
Bitte beantworte mir folgende Fragen:

Wirst du immer noch auf Google-Suchen umgeleitet?
Wenn ja, tritt das Problem mit dem Internet Explorer und Firefox auf? Teste und berichte bitte.

Schritt # 7: Deine Rückmeldung
Zur weiteren Analyse benötige ich zusammen mit deiner nächsten Antwort

das Logfile des OTL-Fix,
das Logfile von MBAM,
das Logfile von SAS,
das Logfile von RKU,
die beiden neuen Logfiles von OTL (OTL.txt und Extras.txt) und
die Beantwortung der gestellten Fragen.

Deathkid535 · 01.07.2011, 21:34

Hallo M-K-D-B,[LIST=1][*]Das OTL Fixfile:

Code:

ATTFilter

All processes killed
========== OTL ==========
Error: No service named PEVSystemStart was found to stop!
Service\Driver key PEVSystemStart not found.
File   File not found not found.
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2851647&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "hxxp://search.babylon.com/?babsrc=toolbar2&q=" removed from keyword.URL
C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\0q27vfov.default\searchplugins\conduit.xml moved successfully.
C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\0q27vfov.default\searchplugins\mywebsearch.xml moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{872B5B88-9DB5-4310-BDD0-AC189557E5F5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HideSCAHealth deleted successfully.
Folder C:\ProgramData\bL28601DaMcK28601\ not found.
ADS C:\ProgramData\Temp:D1B5B4F1 deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 1300062 bytes
->Temporary Internet Files folder emptied: 1913495 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 118129490 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 3025 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Dennis
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6043 bytes
RecycleBin emptied: 31299 bytes
 
Total Files Cleaned = 116,00 mb
 
 
OTL by OldTimer - Version 3.2.24.1 log created on 07012011_173215

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

[*]Das Logfile von MBAM

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6994

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

01.07.2011 17:47:28
mbam-log-2011-07-01 (17-47-28).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 174446
Laufzeit: 6 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

[*]Das File von SAS

Code:

ATTFilter

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 07/01/2011 at 06:45 PM

Application Version : 4.55.1000

Core Rules Database Version : 7363
Trace Rules Database Version: 5175

Scan type       : Complete Scan
Total Scan Time : 00:50:52

Memory items scanned      : 680
Memory threats detected   : 0
Registry items scanned    : 9512
Registry threats detected : 0
File items scanned        : 34598
File threats detected     : 501

Adware.Tracking Cookie
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@clicksor[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ads.glispa[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad.kukori[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@adsrv1.admediate[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@xm.xtendmedia[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@adserver.adtechus[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@find.10topsearches[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@adserving.versaneeds[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad.ad-srv[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@online-tracking[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@www3.sentinelclean-strong.findhere[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@myroitracking[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@webmasterplan[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad.zanox[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@komtrack[3].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@liveperson[3].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@komtrack[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad.adserverplus[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@www.matrix-media[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@adfarm1.adition[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@adxpose[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ads.cpxcenter[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@invitemedia[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ads.gamersmedia[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad2.adfarm1.adition[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ads.adk2[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@audit.median[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@advertise[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@harrenmedianetwork[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@server.lon.liveperson[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ads.inextmedia[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ads.247activemedia[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@zanox-affiliate[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@www.zanox-affiliate[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@servedby.adxpower[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@mediabrandsww[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@collective-media[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad1.adfarm1.adition[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad.harrenmedianetwork[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@da-tracking[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@zanox[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@liveperson[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@tracking1.aleadpay[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@click-lastminute[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@bidtraffic[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@m1.mediasrv[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@fidelity.rotator.hadj7.adjuggler[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ads.ad4game[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad.adc-serv[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@vidasco.rotator.hadj7.adjuggler[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad4.adfarm1.adition[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@adultfriendfinder[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ads.intergi[1].txt
	de.sitestat.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.im.banner.t-online.de [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.zanox.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.zanox.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.zanox.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.traffictrack.de [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.traffictrack.de [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.mm.chitika.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.track.parse.ly [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.invitemedia.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.invitemedia.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adbrite.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adbrite.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adbrite.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adbrite.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.atdmt.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.atdmt.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@advertise[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@www3.sentinelclean-strong.findhere[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@www3.army-internet-personal.findhere[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ads.gamersmedia[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@bidtraffic[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ads.inextmedia[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@www.matrix-media[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad4.adfarm1.adition[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@gamersmedia[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@adserving.versaneeds[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad2.adfarm1.adition[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@m1.mediasrv[1].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@myroitracking[2].txt
	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@xm.xtendmedia[1].txt
	.vodafonegroup.122.2o7.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.elitepvpers.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.elitepvpers.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adserver.adtechus.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	de.sitestat.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.lfstmedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adverticum.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	audit.median.hu [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tribalfusion.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	track.effiliation.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.eyewonder.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.eyewonder.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adverticum.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adverticum.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.etargetnet.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.etargetnet.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.etargetnet.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tns-counter.ru [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	d.jambomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.a.revenuemax.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.apmebf.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.mediaplex.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adtech.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.atdmt.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.atdmt.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	statse.webtrendslive.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.imrworldwide.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.imrworldwide.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.media.xfire.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.media.xfire.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.im.banner.t-online.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.advertising.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.crackfound.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.crackfound.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.crackfound.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.tldadserv.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.xiti.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.edsa.122.2o7.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.paypal.112.2o7.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	eas.apm.emediate.eu [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.divx.112.2o7.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.kontera.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.burstnet.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	gr.burstnet.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.euros4click.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.partypoker.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.partypoker.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adxpose.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.etracker.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.casalemedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.casalemedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.casalemedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.casalemedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.casalemedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adbrite.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adserver2.spele.nl [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.game-advertising-online.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.zedo.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.zedo.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.zedo.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.server.cpmstar.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.yieldmanager.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.partypoker.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.partypoker.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.partypoker.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.blogcounter.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.pro-market.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	fl01.ct2.comclick.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.technoratimedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.pro-market.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.ru4.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.ru4.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.legolas-media.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adtech.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adbrite.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.yadro.ru [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.elitepvpers.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	m1.webstats.motigo.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.zanox.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.etracker.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.etracker.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.etracker.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.elitepvpers.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.smartadserver.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.zedo.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.gostats.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.gostats.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.komtrack.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.komtrack.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.komtrack.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.dyntracker.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.at.atwola.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.clickaider.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	eas.apm.emediate.eu [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.www.qitracking.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adviva.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adviva.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.invitemedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.invitemedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.invitemedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.mediafire.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	fidelity.rotator.hadj7.adjuggler.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	fidelity.rotator.hadj7.adjuggler.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adserver1.mokono.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	in.getclicky.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adserver1.mokono.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adserver1.mokono.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adserver1.mokono.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tradedoubler.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tradedoubler.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.etracker.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	s03.flagcounter.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	s2.trafficmaxx.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	track.effiliation.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	track.effiliation.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	track.effiliation.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	track.effiliation.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	rotator.adjuggler.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	rotator.adjuggler.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	tracking.mlsat02.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adsrv.admediate.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adsrv.admediate.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	rotator.adjuggler.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adsrv.admediate.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.googleadservices.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	rts.pgmediaserve.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	rts.pgmediaserve.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	rts.pgmediaserve.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.partypoker.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.partypoker.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	eas.apm.emediate.eu [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adserver.adreactor.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tacoda.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tacoda.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tacoda.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tacoda.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.at.atwola.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.at.atwola.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.traffictrack.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.traffictrack.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.ice.112.2o7.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	s03.flagcounter.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.mediafire.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.mediafire.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.mediafire.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.mediafire.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.account.frogster-online.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	user.lucidmedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	tracking.gameforge.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.ez-tracks.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.ez-tracks.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.ez-tracks.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.ez-tracks.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.ez-tracks.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.ez-tracks.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.encyclomedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.ez-tracks.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.ez-tracks.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.zanox-affiliate.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.zanox-affiliate.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.media6degrees.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.media6degrees.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.media6degrees.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.media6degrees.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.doubleclick.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.lfstmedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.lfstmedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.warcraftscreensavers.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.warcraftscreensavers.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.legolas-media.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.legolas-media.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.legolas-media.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.kontera.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ww251.smartadserver.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.zedo.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.zedo.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.zedo.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.technoratimedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.technoratimedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.technoratimedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.technoratimedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.specificclick.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.specificclick.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.specificclick.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.specificclick.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.specificclick.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.specificclick.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.warcraftscreensavers.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.warcraftscreensavers.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.warcraftscreensavers.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.warcraftscreensavers.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.warcraftscreensavers.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.warcraftscreensavers.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.kontera.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.kontera.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.googleadservices.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	media.fragster.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.technoratimedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.technoratimedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.technoratimedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.technoratimedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.advertising.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.advertising.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.advertising.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.legolas-media.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.chitika.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ssl.clickbank.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ssl.clickbank.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ssl.clickbank.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adinterax.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adinterax.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adscendmedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adscendmedia.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.statcounter.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.statcounter.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	click.mediadome.ru [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	click.mediadome.ru [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	click.mediadome.ru [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.himedia.individuad.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.himedia.individuad.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	fl01.ct2.comclick.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	fl01.ct2.comclick.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	delivery.atkmedia.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.gametracker.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.web-stat.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.web-stat.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.web-stat.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	cn.clickable.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	cn.clickable.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adfarm1.adition.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.server.cpmstar.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adx.chip.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.revsci.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.clickbank.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.collective-media.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.collective-media.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.collective-media.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.collective-media.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.collective-media.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.collective-media.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.collective-media.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.elitepvpers.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	www.elitepvpers.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.elitepvpers.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.elitepvpers.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tradedoubler.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.fastclick.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.zanox.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adserver.mmoga.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adserver.mmoga.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adserver.mmoga.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.smartadserver.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.smartadserver.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.smartadserver.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.smartadserver.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.smartadserver.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad3.adfarm1.adition.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad4.adfarm1.adition.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tracking.quisma.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tracking.hannoversche.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.mediaplex.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.serving-sys.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.serving-sys.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.serving-sys.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.serving-sys.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.serving-sys.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.serving-sys.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.serving-sys.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.bs.serving-sys.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adtech.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	s2.trafficmaxx.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.crackssite.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.content.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.content.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	adserver.unitedcolo.de [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.crackssite.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.crackssite.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	eas4.emediate.eu [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	eas4.emediate.eu [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adbrite.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adbrite.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adbrite.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.mediabrandsww.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adecn.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	click2go.org [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.azjmp.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.azjmp.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.azjmp.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.adfarm1.adition.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad2.adfarm1.adition.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tradedoubler.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.zanox.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tradedoubler.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.tradedoubler.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.fastclick.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.fastclick.net [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.advertising.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	.advertising.com [ C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@atdmt[2].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@www.elitepvpers[2].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@server.cpmstar[2].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@adserver.adtechus[4].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@ads.intergi[1].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@imrworldwide[2].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@mywebsearch[1].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@adserver.adtechus[2].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@serving-sys[1].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@adserver.adtechus[1].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@atdmt[1].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@fastclick[2].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@doubleclick[2].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\dennis@fastclick[1].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\Low\dennis@doubleclick[1].txt
	C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Cookies\Low\dennis@mywebsearch[2].txt
	.tribalfusion.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.imrworldwide.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.imrworldwide.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.adserver.adtechus.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.doubleclick.net [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	ad.adserver01.de [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.apmebf.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.fastclick.net [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.fastclick.net [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.fastclick.net [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.fastclick.net [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.zanox.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.zanox-affiliate.de [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.adfarm1.adition.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	adfarm1.adition.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.adfarm1.adition.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	ad2.adfarm1.adition.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.adfarm1.adition.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.tradedoubler.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.tradedoubler.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.tradedoubler.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.content.yieldmanager.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	ad.yieldmanager.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.mediaplex.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.mediaplex.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.adxpose.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.content.yieldmanager.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.xm.xtendmedia.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.partypoker.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.partypoker.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.partypoker.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.invitemedia.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.server.cpmstar.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.server.cpmstar.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.server.cpmstar.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.server.cpmstar.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.server.cpmstar.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	www.zanox-affiliate.de [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.webmasterplan.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.server.cpmstar.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]
	.server.cpmstar.com [ C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\8up7pvxa.default\cookies.sqlite ]

Trojan.System32
	C:\PROGRAM FILES\AXBX\VIRUSKEEPER 2011 PRO PROBEVERSION\QUARANTAINE\SYSTEM32.EXE

Trojan.Agent/Gen-Bancos
	C:\PROGRAM FILES\WEBOCTON - SCRIPTLY\ORIGINALS\PLUGINS\WYSIWYG_EDITOR.DLL
	C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\WEBOCTON - SCRIPTLY\PLUGINS\WYSIWYG_EDITOR.DLL

Trojan.Agent/Gen-FakeAlert[Local]
	C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\8 X 8 MEDIA AG\CHESSIMO\ENGINES\CRAFTY\WCRAFTY.EXE

[*]Das RKU Logfile:

Code:

ATTFilter

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows 7
Version 6.1.7600
Number of processors #2
==============================================
>Drivers
==============================================
0x8E82F000 C:\Windows\system32\DRIVERS\atikmdag.sys 5468160 bytes (ATI Technologies Inc., ATI Radeon Kernel Mode Driver)
0x82C05000 C:\Windows\system32\ntkrnlpa.exe 4259840 bytes (Microsoft Corporation, NT Kernel & System)
0x82C05000 PnpManager 4259840 bytes
0x82C05000 RAW 4259840 bytes
0x82C05000 WMIxWDM 4259840 bytes
0x8F43D000 C:\Windows\system32\DRIVERS\bcmwl6.sys 2510848 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver)
0x96C40000 Win32k 2404352 bytes
0x96C40000 C:\Windows\System32\win32k.sys 2404352 bytes (Microsoft Corporation, Mehrbenutzer-Win32-Treiber)
0x88636000 C:\Windows\System32\drivers\tcpip.sys 1347584 bytes (Microsoft Corporation, TCP/IP-Treiber)
0x8241D000 C:\Windows\System32\Drivers\BisonC07.sys 1257472 bytes (Bison Electronics. Inc. , Universal Serial Bus Camera Driver)
0x88209000 C:\Windows\System32\Drivers\Ntfs.sys 1241088 bytes (Microsoft Corporation, NT-Dateisystemtreiber)
0x8E605000 C:\Windows\System32\drivers\dxgkrnl.sys 749568 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x88429000 C:\Windows\system32\drivers\ndis.sys 749568 bytes (Microsoft Corporation, NDIS 6.20-Treiber)
0x8327B000 C:\Windows\system32\CI.dll 700416 bytes (Microsoft Corporation, Codeintegritätsmodul)
0x98352000 C:\Windows\system32\drivers\peauth.sys 618496 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x98211000 C:\Windows\system32\drivers\HTTP.sys 544768 bytes (Microsoft Corporation, HTTP-Protokollstapel)
0x9100F000 C:\Windows\system32\drivers\CHDRT32.sys 528384 bytes (Conexant Systems Inc., High Definition Audio Function Driver)
0x83326000 C:\Windows\system32\drivers\Wdf01000.sys 462848 bytes (Microsoft Corporation, Kernelmodustreiber-Frameworklaufzeit)
0x8E6F5000 C:\Windows\system32\drivers\SRS_AudioFusion_i386.sys 450560 bytes (-, SRS Premium Sound driver)
0x99AB8000 C:\Windows\system32\drivers\spsys.sys 434176 bytes (Microsoft Corporation, security processor)
0x88376000 C:\Windows\System32\Drivers\cng.sys 380928 bytes (Microsoft Corporation, Kernel Cryptography, Next Generation)
0x8D83F000 C:\Windows\system32\drivers\afd.sys 368640 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x99A62000 C:\Windows\System32\DRIVERS\srv.sys 335872 bytes (Microsoft Corporation, Server driver)
0x99A13000 C:\Windows\System32\DRIVERS\srv2.sys 323584 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x8F6CE000 C:\Windows\system32\DRIVERS\USBPORT.SYS 307200 bytes (Microsoft Corporation, USB 1.1 & 2.0-Porttreiber)
0x8808D000 C:\Windows\System32\drivers\volmgrx.sys 307200 bytes (Microsoft Corporation, Treiber für Erweiterung des Volume-Managers)
0x833A5000 C:\Windows\system32\DRIVERS\ACPI.sys 294912 bytes (Microsoft Corporation, ACPI-Treiber für NT)
0x88143000 C:\Windows\system32\DRIVERS\storport.sys 290816 bytes (Microsoft Corporation, Microsoft Storage Port Driver)
0x91153000 C:\Windows\system32\DRIVERS\nwifi.sys 286720 bytes (Microsoft Corporation, Systemeigener WiFi-Miniporttreiber)
0x8ED66000 C:\Windows\system32\DRIVERS\usbhub.sys 278528 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x83239000 C:\Windows\system32\CLFS.SYS 270336 bytes (Microsoft Corporation, Common Log File System Driver)
0x8D969000 C:\Windows\system32\DRIVERS\rdbss.sys 266240 bytes (Microsoft Corporation, Subsystemtreiber für Pufferung des umgeleiteten Laufwerks)
0x887B0000 C:\Windows\system32\DRIVERS\volsnap.sys 258048 bytes (Microsoft Corporation, Volumeschattenkopie-Treiber)
0x884E0000 C:\Windows\system32\drivers\NETIO.SYS 253952 bytes (Microsoft Corporation, Network I/O Subsystem)
0x982E4000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 241664 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x8F774000 C:\Windows\system32\DRIVERS\Apfiltr.sys 233472 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver)
0x8E6BC000 C:\Windows\System32\drivers\dxgmms1.sys 233472 bytes (Microsoft Corporation, DirectX Graphics MMS)
0x83015000 ACPI_HAL 225280 bytes
0x83015000 C:\Windows\system32\halmacpi.dll 225280 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x88193000 C:\Windows\system32\drivers\fltmgr.sys 212992 bytes (Microsoft Corporation, Microsoft Dateisystem-Filter-Manager)
0x8F400000 C:\Windows\system32\drivers\ks.sys 212992 bytes (Microsoft Corporation, Kernel CSA Library)
0x88553000 C:\Windows\System32\DRIVERS\fvevol.sys 204800 bytes (Microsoft Corporation, BitLocker Drive Encryption Driver)
0x8D899000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8877F000 C:\Windows\System32\drivers\fwpkclnt.sys 200704 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x91090000 C:\Windows\system32\drivers\portcls.sys 192512 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x88600000 C:\Windows\System32\drivers\rdyboost.sys 184320 bytes (Microsoft Corporation, ReadyBoost Driver)
0x88338000 C:\Windows\System32\Drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x8802F000 C:\Windows\system32\DRIVERS\pci.sys 172032 bytes (Microsoft Corporation, NT-Plug & Play PCI-Enumerator)
0x88596000 C:\Windows\system32\DRIVERS\CLASSPNP.SYS 151552 bytes (Microsoft Corporation, SCSI Class System Dll)
0x8851E000 C:\Windows\System32\Drivers\ksecpkg.sys 151552 bytes (Microsoft Corporation, Kernel Security Support Provider Interface Packages)
0x82562000 C:\Windows\system32\DRIVERS\SaiK0CFA.sys 151552 bytes (Saitek, Saitek Hid Driver)
0x880F7000 C:\Windows\system32\DRIVERS\ataport.SYS 143360 bytes (Microsoft Corporation, ATAPI Driver Extension)
0x982C1000 C:\Windows\system32\DRIVERS\mrxsmb.sys 143360 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x8E76E000 C:\Windows\system32\DRIVERS\ndiswan.sys 139264 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0x8D941000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)
0x91199000 C:\Windows\System32\DRIVERS\srvnet.sys 135168 bytes (Microsoft Corporation, Server Network driver)
0x8D800000 C:\Windows\system32\DRIVERS\tunnel.sys 135168 bytes (Microsoft Corporation, Microsoft-Tunnelschnittstellentreiber)
0x881D8000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0x885D5000 C:\Windows\system32\DRIVERS\cdrom.sys 126976 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0x8F730000 C:\Windows\system32\DRIVERS\HDAudBus.sys 126976 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x8D8D2000 C:\Windows\system32\DRIVERS\pacer.sys 126976 bytes (Microsoft Corporation, QoS-Paketplaner)
0x96ED0000 C:\Windows\System32\cdd.dll 122880 bytes (Microsoft Corporation, Canonical Display Driver)
0x91135000 C:\Windows\system32\DRIVERS\SaiK0728.sys 122880 bytes (Saitek, Saitek Hid Driver)
0x8259B000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA-Filtertreiber zur Dateivirtualisierung)
0x9831F000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 110592 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x825B6000 C:\Windows\system32\drivers\WudfPf.sys 106496 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0x98296000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x910BF000 C:\Windows\system32\drivers\drmk.sys 102400 bytes (Microsoft Corporation, Microsoft Trusted Audio Drivers)
0x8D9CA000 C:\Windows\System32\Drivers\dfsc.sys 98304 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x8F74F000 C:\Windows\system32\DRIVERS\i8042prt.sys 98304 bytes (Microsoft Corporation, i8042-Anschlusstreiber)
0x8F7E0000 C:\Windows\system32\DRIVERS\rasl2tp.sys 98304 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x8E790000 C:\Windows\system32\DRIVERS\raspppoe.sys 98304 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x8E7A8000 C:\Windows\system32\DRIVERS\raspptp.sys 94208 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x8E7BF000 C:\Windows\system32\DRIVERS\rassstp.sys 94208 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0x8800E000 C:\Windows\system32\DRIVERS\tdx.sys 94208 bytes (Microsoft Corporation, TDI Translation Driver)
0x91113000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0x880D8000 C:\Windows\System32\drivers\mountmgr.sys 90112 bytes (Microsoft Corporation, Bereitstellungspunkt-Manager)
0x82587000 C:\Windows\system32\drivers\usbaudio.sys 81920 bytes (Microsoft Corporation, USB Audio Class Driver)
0x8EDAA000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 77824 bytes (Microsoft Corporation, Hid Class Library)
0x88363000 C:\Windows\System32\Drivers\ksecdd.sys 77824 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x82400000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x8D910000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x8F7CE000 C:\Windows\system32\DRIVERS\AgileVpn.sys 73728 bytes (Microsoft Corporation, RAS Agile Vpn Miniport Call Manager)
0x8F6AC000 C:\Windows\system32\DRIVERS\L1C62x86.sys 73728 bytes (Atheros Communications, Inc., Atheros L1c PCI-E Gigabit Ethernet Controller)
0x982AF000 C:\Windows\System32\drivers\mpsdrv.sys 73728 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x8D821000 C:\Windows\system32\DRIVERS\amdppm.sys 69632 bytes (Microsoft Corporation, Processor Device Driver)
0x88132000 C:\Windows\system32\DRIVERS\amdsata.sys 69632 bytes (Advanced Micro Devices, AHCI 1.2 Device Driver)
0x88585000 C:\Windows\system32\DRIVERS\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x881C7000 C:\Windows\system32\drivers\fileinfo.sys 69632 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x8E7EE000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x88059000 C:\Windows\System32\drivers\partmgr.sys 69632 bytes (Microsoft Corporation, Partition Management Driver)
0x83220000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Plattformspezifischer Hardwarefehlertreiber)
0x8D8F1000 C:\Windows\system32\DRIVERS\vwififlt.sys 69632 bytes (Microsoft Corporation, Virtual WiFi Filter Driver)
0x825D0000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x88543000 C:\Windows\System32\Drivers\mup.sys 65536 bytes (Microsoft Corporation, Multiple UNC Provider Driver)
0x825E0000 C:\Windows\system32\DRIVERS\ndisuio.sys 65536 bytes (Microsoft Corporation, E/A-Treiber für NDIS-Benutzermodus)
0x8D923000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Remote Desktop Server Driver)
0x8807D000 C:\Windows\system32\DRIVERS\volmgr.sys 65536 bytes (Microsoft Corporation, Volume Manager Driver)
0x8F721000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x8D9E2000 C:\Windows\system32\DRIVERS\blbdrive.sys 57344 bytes (Microsoft Corporation, BLB Drive Driver)
0x8D902000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x88000000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x88124000 C:\Windows\system32\DRIVERS\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x883D3000 C:\Windows\System32\drivers\pcw.sys 57344 bytes (Microsoft Corporation, Performance Counters for Windows Driver)
0x8D933000 C:\Windows\System32\Drivers\SCDEmu.SYS 57344 bytes (PowerISO Computing, Inc., PowerISO Virtual Drive)
0x8E7E0000 C:\Windows\system32\DRIVERS\umbus.sys 57344 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x83397000 C:\Windows\system32\drivers\WDFLDR.SYS 57344 bytes (Microsoft Corporation, Kernel Mode Driver Framework Loader)
0x8F7C1000 C:\Windows\system32\DRIVERS\CompositeBus.sys 53248 bytes (Microsoft Corporation, Multi-Transport Composite Bus Enumerator)
0x8F767000 C:\Windows\system32\DRIVERS\kbdclass.sys 53248 bytes (Microsoft Corporation, Tastaturklassentreiber)
0x8F7AD000 C:\Windows\system32\DRIVERS\mouclass.sys 53248 bytes (Microsoft Corporation, Mausklassentreiber)
0x983F3000 C:\Windows\System32\drivers\tcpipreg.sys 53248 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x88413000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x8D9BE000 C:\Windows\System32\drivers\discache.sys 49152 bytes (Microsoft Corporation, System Indexer/Cache Driver)
0x910D8000 C:\Windows\system32\DRIVERS\kbdhid.sys 49152 bytes (Microsoft Corporation, HID-Tastaturfiltertreiber)
0x88407000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x88072000 C:\Windows\system32\DRIVERS\BATTC.SYS 45056 bytes (Microsoft Corporation, Battery Class Driver)
0x9112A000 C:\Windows\system32\DRIVERS\hidusb.sys 45056 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0x83215000 C:\Windows\system32\mcupdate_AuthenticAMD.dll 45056 bytes (Microsoft Corporation, AMD Microcode Update Library)
0x82550000 C:\Windows\system32\DRIVERS\monitor.sys 45056 bytes (Microsoft Corporation, Monitor Driver)
0x910E4000 C:\Windows\system32\DRIVERS\mouhid.sys 45056 bytes (Microsoft Corporation, HID-Mausfiltertreiber)
0x883EA000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x8E763000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x883F5000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x83200000 C:\Windows\system32\DRIVERS\vdrvroot.sys 45056 bytes (Microsoft Corporation, Stammenumerator für virtuelles Laufwerk)
0x910EF000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x8811A000 C:\Windows\system32\DRIVERS\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver)
0x8D9B4000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x8D9AA000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0x8E7D6000 C:\Windows\system32\drivers\SaiBus.sys 40960 bytes (Saitek, Smart Technology Helpers)
0x983E9000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x8F6C4000 C:\Windows\system32\DRIVERS\usbohci.sys 40960 bytes (Microsoft Corporation, OHCI USB Miniport Driver)
0x8F6A2000 C:\Windows\system32\DRIVERS\vwifibus.sys 40960 bytes (Microsoft Corporation, Virtueller WiFi-Bustreiber)
0x8818A000 C:\Windows\system32\DRIVERS\amdxata.sys 36864 bytes (Advanced Micro Devices, Stor Filter Driver)
0x99B22000 C:\Windows\system32\DRIVERS\asyncmac.sys 36864 bytes (Microsoft Corporation, MS Remote Access serial network driver)
0x880EE000 C:\Windows\system32\DRIVERS\atapi.sys 36864 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x99B2B000 C:\Windows\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0x883E1000 C:\Windows\System32\Drivers\Fs_Rec.sys 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x96EA0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x833ED000 C:\Windows\system32\DRIVERS\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x887F7000 C:\Windows\system32\DRIVERS\AtiPcie.sys 32768 bytes (Advanced Micro Devices Inc., AMD PCIE Filter Driver for ATI PCIE chipset)
0x83231000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x8806A000 C:\Windows\system32\DRIVERS\compbatt.sys 32768 bytes (Microsoft Corporation, Composite Battery Driver)
0x8862D000 C:\Windows\System32\drivers\hwpolicy.sys 32768 bytes (Microsoft Corporation, Hardware Policy Driver)
0x80BBB000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Serial Kernel Debugger)
0x833F6000 C:\Windows\system32\DRIVERS\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x88420000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x885BB000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Encoder Miniport)
0x885C3000 C:\Windows\system32\drivers\rdprefmp.sys 32768 bytes (Microsoft Corporation, RDP Reflector Driver Miniport)
0x887EF000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x88400000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x8EDBD000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0x885F4000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x8255B000 C:\Windows\system32\DRIVERS\SaiU0CFA.sys 28672 bytes (Saitek, Saitek Usb Driver)
0x8D8CB000 C:\Windows\system32\DRIVERS\wfplwf.sys 28672 bytes (Microsoft Corporation, WFP NDIS 6.20 Lightweight Filter Driver)
0x8F6BE000 C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0x8F7F8000 C:\Windows\system32\DRIVERS\psadd.sys 24576 bytes (Lenovo (United States) Inc., SMBIOS Driver)
0x8D963000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)
0x8F719000 C:\Windows\system32\DRIVERS\usbfilter.sys 24576 bytes (Advanced Micro Devices, AMD USB Filter Driver)
0x8F7BA000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0x99AB4000 C:\Windows\system32\drivers\mbam.sys 16384 bytes (Malwarebytes Corporation, Malwarebytes' Anti-Malware)
0x8F434000 C:\Windows\system32\DRIVERS\SaiMini.sys 16384 bytes (Saitek, Saitek Magic Mini Driver)
0x8F7BE000 C:\Windows\system32\DRIVERS\AcpiVpc.sys 12288 bytes (Lenovo Corporation, ACPI Virtual Power Controller Driver)
0x8F7FE000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x8F71F000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
==============================================
>Stealth
==============================================
==============================================
>Hooks
==============================================
[1668]rundll32.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77C617B8-->752A5E25 [apphelp.dll]
[1668]rundll32.exe-->crypt32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x719B14EC-->752A5E25 [apphelp.dll]
[1668]rundll32.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77B611B8-->752A5E25 [apphelp.dll]
[1668]rundll32.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77D114E0-->752A5E25 [apphelp.dll]
[1668]rundll32.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71201454-->752A5E25 [apphelp.dll]
[2720]realsched.exe-->kernel32.dll-->SetUnhandledExceptionFilter, Type: Inline - PushRet 0x76FC3162-->EC810004 [unknown_code_page]

Deathkid535 · 01.07.2011, 21:37

Das OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 01.07.2011 19:29:27 - Run 6
OTL by OldTimer - Version 3.2.24.1     Folder = C:\Users\Administrator\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
1,75 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 45,37% Memory free
6,98 Gb Paging File | 5,79 Gb Available in Paging File | 82,92% Paging File free
Paging file location(s): [Binary data over 100 bytes]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 153,68 Gb Total Space | 71,14 Gb Free Space | 46,29% Space Free | Partition Type: NTFS
Drive D: | 78,03 Gb Total Space | 35,76 Gb Free Space | 45,84% Space Free | Partition Type: NTFS
 
Computer Name: DENNIS-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
PRC - C:\Programme\Google\Update\1.3.21.57\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Users\Administrator\AppData\Local\Apps\2.0\W55HJDXV.742\KR5R0CNL.RO1\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\CurseClient.exe (Curse)
PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Programme\IObit\IObit SmartDefrag\IObit SmartDefrag.exe (IObit)
PRC - C:\Programme\DAEMON Tools Pro\DTShellHlp.exe (DT Soft Ltd)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Programme\Lenovo\Energy Management\utility.exe (Lenovo(Beijing)Limited)
PRC - C:\Programme\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll (Microsoft Corporation)
MOD - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchrome10browserrecordhelper.dll (RealNetworks, Inc.)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (SUService) -- C:\Program Files\Lenovo\System Update\SUService.exe (Lenovo Group Limited)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AcSvc) -- C:\Programme\Lenovo\Access Connections\AcSvc.exe (Lenovo)
SRV - (AcPrfMgrSvc) -- C:\Programme\Lenovo\Access Connections\AcPrfMgrSvc.exe (Lenovo)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WindowBlinds) -- C:\Programme\Stardock\MyColors\VistaSrv.exe (Stardock Corporation)
SRV - (SBSDWSCService) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (SRS_AudioFusion_Service) -- C:\Windows\System32\drivers\SRS_AudioFusion_i386.sys ()
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (SaiNtBus) -- C:\Windows\System32\drivers\SaiBus.sys (Saitek)
DRV - (SaiMini) -- C:\Windows\System32\drivers\SaiMini.sys (Saitek)
DRV - (SaiK0CFA) -- C:\Windows\System32\drivers\SaiK0CFA.sys (Saitek)
DRV - (SaiU0CFA) -- C:\Windows\System32\drivers\SaiU0CFA.sys (Saitek)
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SCDEmu) -- C:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (CnxtHdAudService) -- C:\Windows\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)
DRV - (Cam5607) -- C:\Windows\System32\drivers\BisonC07.sys (Bison Electronics. Inc. )
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (L1C) -- C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.)
DRV - (usbfilter) -- C:\Windows\System32\drivers\usbfilter.sys (Advanced Micro Devices)
DRV - (RSUSBSTOR) -- C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV - (wsvd) -- C:\Windows\System32\drivers\wsvd.sys (CyberLink)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (SaiK0728) -- C:\Windows\System32\drivers\SaiK0728.sys (Saitek)
DRV - (ACPIVPC) -- C:\Windows\System32\drivers\AcpiVpc.sys (Lenovo Corporation)
DRV - (psadd) -- C:\Windows\System32\drivers\psadd.sys (Lenovo (United States) Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 03 5B 60 61 79 69 CB 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2851647&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=382950"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.com/ig"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?babsrc=toolbar2&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.03.13 19:28:40 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.03.13 19:28:40 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.04.28 20:56:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.28 20:55:53 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.28 20:56:19 | 000,000,000 | ---D | M]
 
[2010.10.14 20:00:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Extensions
[2011.07.01 13:22:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\0q27vfov.default\extensions
[2011.05.22 20:40:15 | 000,000,000 | ---D | M] (IE Tab 2 (FF 3.6+)) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\0q27vfov.default\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
[2011.06.23 13:09:09 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\0q27vfov.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.05.07 08:23:55 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\0q27vfov.default\extensions\battlefieldplay4free@ea.com
[2011.05.20 21:44:33 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.07.02 16:36:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.09.02 17:21:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.12.16 14:31:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.04.26 18:15:44 | 000,000,000 | ---D | M] ("Babylon Spelling and Proofreading") -- C:\Programme\Mozilla Firefox\extensions\adapter@babylontc.com
File not found (No name found) -- 
[2010.07.02 16:36:38 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.09.02 17:21:39 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.12.16 14:31:09 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.04.26 18:15:44 | 000,000,000 | ---D | M] ("Babylon Spelling and Proofreading") -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\ADAPTER@BABYLONTC.COM
[2011.04.28 20:56:01 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
() (No name found) -- C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0Q27VFOV.DEFAULT\EXTENSIONS\{20A82645-C095-46ED-80E3-08825760534B}.XPI
() (No name found) -- C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0Q27VFOV.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
() (No name found) -- C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0Q27VFOV.DEFAULT\EXTENSIONS\FFXTLBR@BABYLON.COM.XPI
[2011.03.18 19:56:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll
[2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.04.26 18:13:26 | 000,002,226 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\babylon.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.06.27 21:45:14 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Energy Management] C:\Programme\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4 - HKLM..\Run: [EnergyUtility] C:\Programme\Lenovo\Energy Management\utility.exe (Lenovo(Beijing)Limited)
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Speech Recognition] C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Translate this web page with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O8 - Extra context menu item: Translate with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.186.211.21 195.34.133.21 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~3\GO36F4~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\SETUP.EXE
O33 - MountPoints2\H\Shell\configure\command - "" = H:\SETUP.EXE
O33 - MountPoints2\H\Shell\install\command - "" = H:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.07.01 17:51:29 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\SUPERAntiSpyware.com
[2011.07.01 17:51:29 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011.07.01 17:50:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011.07.01 17:50:14 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware
[2011.07.01 14:17:01 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011.07.01 09:21:05 | 001,448,752 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Administrator\Desktop\tdsskiller.exe
[2011.06.30 09:05:29 | 000,100,736 | ---- | C] (GMER) -- C:\pwdirpog.sys
[2011.06.29 12:25:32 | 001,401,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll
[2011.06.29 12:25:31 | 001,553,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll
[2011.06.29 12:25:30 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll
[2011.06.29 12:25:30 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll
[2011.06.29 12:25:30 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll
[2011.06.29 12:25:30 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll
[2011.06.28 21:15:18 | 004,130,198 | R--- | C] (Swearware) -- C:\Users\Administrator\Desktop\ComboFix.exe
[2011.06.28 16:12:35 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011.06.28 16:12:35 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011.06.28 16:12:35 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011.06.28 15:05:22 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011.06.28 15:00:55 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011.06.27 21:06:30 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.06.27 20:55:08 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2011.06.27 20:55:07 | 000,000,000 | ---D | C] -- C:\Programme\VS Revo Group
[2011.06.27 19:18:41 | 001,904,128 | ---- | C] (AVAST Software) -- C:\Users\Administrator\Desktop\aswMBR.exe
[2011.06.27 13:22:09 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\RealUI 0612
[2011.06.27 12:09:11 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2011.06.26 22:50:35 | 000,000,000 | -H-D | C] -- C:\Windows\PIF
[2011.06.26 21:29:44 | 000,000,000 | ---D | C] -- C:\ProgramData\bL28601DaMcK28601
[2011.06.24 10:38:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011.06.22 19:34:53 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\RIFT
[2011.06.22 19:34:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RIFT
[2011.06.22 19:34:45 | 000,000,000 | ---D | C] -- C:\Programme\RIFT Game
[2011.06.22 07:50:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.06.20 19:16:22 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\LeilaUI 3.13
[2011.06.18 09:43:48 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2011.06.17 14:37:45 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.06.17 14:37:45 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.06.17 14:37:45 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011.06.17 14:37:45 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.06.17 14:37:44 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011.06.17 14:37:44 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011.06.17 14:37:44 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011.06.17 14:37:44 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011.06.17 14:37:44 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011.06.17 14:37:43 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.06.17 14:37:43 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.06.16 13:23:54 | 000,000,000 | ---D | C] -- C:\Users\Administrator\dwhelper
[2011.06.11 22:47:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes
[2011.06.11 22:46:37 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.06.11 22:46:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.06.11 22:46:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.06.11 22:46:31 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.06.11 22:46:31 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.06.10 21:15:42 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chessimo
[2011.06.10 21:15:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\chessimo
[2011.06.10 21:15:36 | 000,260,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RICHTX32.OCX
[2011.06.10 21:15:36 | 000,244,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSFLXGRD.OCX
[2011.06.10 21:15:36 | 000,152,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\COMDLG32.OCX
[2011.06.10 21:15:36 | 000,132,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSINET.OCX
[2011.06.10 21:15:36 | 000,067,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SYSINFO.OCX
[2011.06.10 21:15:26 | 000,000,000 | ---D | C] -- C:\Programme\chessimo
[2011.06.10 21:15:26 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\8 x 8 Media AG
[2011.06.10 21:15:25 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
[2011.06.07 13:06:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
[2011.06.07 12:56:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
 
========== Files - Modified Within 30 Days ==========
 
[2011.07.01 19:25:38 | 000,015,008 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.07.01 19:25:37 | 000,015,008 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.07.01 19:22:12 | 000,000,728 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2011.07.01 19:21:43 | 000,139,264 | ---- | M] () -- C:\Users\Administrator\Desktop\RKUnhookerLE.EXE
[2011.07.01 19:19:42 | 000,001,022 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2011.07.01 19:19:04 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.07.01 19:17:15 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.07.01 19:17:14 | 000,000,398 | ---- | M] () -- C:\Windows\tasks\AutoSmartDefrag.job
[2011.07.01 19:17:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.07.01 19:16:59 | 1406,300,160 | -HS- | M] () -- C:\hiberfil.sys
[2011.07.01 19:09:00 | 000,001,122 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1140944107-3424129360-3757389648-1000UA.job
[2011.07.01 17:50:19 | 000,001,961 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011.07.01 13:42:05 | 004,130,198 | R--- | M] (Swearware) -- C:\Users\Administrator\Desktop\ComboFix.exe
[2011.07.01 09:21:11 | 001,448,752 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Administrator\Desktop\tdsskiller.exe
[2011.06.30 09:05:29 | 000,100,736 | ---- | M] (GMER) -- C:\pwdirpog.sys
[2011.06.30 09:03:59 | 000,302,592 | ---- | M] () -- C:\Users\Administrator\Desktop\drv0czgm.exe
[2011.06.29 20:09:00 | 000,001,070 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1140944107-3424129360-3757389648-1000Core.job
[2011.06.29 17:08:02 | 000,449,928 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.06.28 08:02:33 | 000,000,400 | ---- | M] () -- C:\Windows\tasks\SmartDefrag.job
[2011.06.27 21:45:14 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011.06.27 20:55:08 | 000,001,222 | ---- | M] () -- C:\Users\Administrator\Desktop\Revo Uninstaller.lnk
[2011.06.27 19:19:02 | 001,904,128 | ---- | M] (AVAST Software) -- C:\Users\Administrator\Desktop\aswMBR.exe
[2011.06.27 13:13:38 | 000,027,484 | ---- | M] () -- C:\Users\Administrator\Desktop\Logfiles.zip
[2011.06.27 12:33:26 | 000,302,592 | ---- | M] () -- C:\Users\Administrator\Desktop\c06dgghb.exe
[2011.06.27 12:09:21 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2011.06.27 12:05:08 | 000,000,020 | ---- | M] () -- C:\Users\Administrator\defogger_reenable
[2011.06.27 12:03:04 | 000,050,477 | ---- | M] () -- C:\Users\Administrator\Desktop\Defogger.exe
[2011.06.26 23:12:02 | 001,007,120 | ---- | M] () -- C:\Users\Administrator\Desktop\duadas.exe
[2011.06.26 10:05:41 | 000,518,050 | ---- | M] () -- C:\Users\Administrator\Desktop\Unbenannt.PNG
[2011.06.26 08:45:56 | 000,256,000 | ---- | M] () -- C:\Windows\PEV.exe
[2011.06.24 10:38:56 | 000,002,170 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.06.22 07:50:33 | 000,002,503 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.06.20 19:12:48 | 000,095,049 | ---- | M] () -- C:\Users\Administrator\Desktop\IceHUD_RealUI.lua
[2011.06.20 14:12:59 | 000,949,916 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.06.20 14:12:59 | 000,704,552 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.06.20 14:12:59 | 000,222,136 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.06.20 14:12:59 | 000,189,032 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.06.11 18:58:04 | 000,004,107 | ---- | M] () -- C:\Windows\wininit.ini
[2011.06.11 14:11:05 | 000,001,246 | ---- | M] () -- C:\Users\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2011.06.11 10:49:21 | 000,166,400 | RHS- | M] () -- C:\Windows\System32\KBDINMALV.dll
[2011.06.11 10:45:29 | 000,000,152 | ---- | M] () -- C:\Windows\System32\sysplog2.dll
[2011.06.11 10:45:29 | 000,000,152 | ---- | M] () -- C:\Windows\System32\sysplog.dll
[2011.06.10 21:15:42 | 000,000,997 | ---- | M] () -- C:\Users\Public\Desktop\chessimo.lnk
[2011.06.10 19:08:58 | 000,000,129 | ---- | M] () -- C:\Users\Administrator\jagex_runescape_preferences2.dat
[2011.06.10 19:07:59 | 000,000,034 | ---- | M] () -- C:\Users\Administrator\jagex_runescape_preferences.dat
[2011.06.07 13:06:07 | 000,000,973 | ---- | M] () -- C:\Users\Administrator\Desktop\SpywareBlaster.lnk
 
========== Files Created - No Company Name ==========
 
[2011.07.01 19:21:40 | 000,139,264 | ---- | C] () -- C:\Users\Administrator\Desktop\RKUnhookerLE.EXE
[2011.07.01 17:50:19 | 000,001,961 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011.06.30 09:03:58 | 000,302,592 | ---- | C] () -- C:\Users\Administrator\Desktop\drv0czgm.exe
[2011.06.28 16:12:35 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011.06.28 16:12:35 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011.06.28 16:12:35 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011.06.28 16:12:35 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011.06.28 16:12:35 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011.06.27 22:34:59 | 000,000,400 | ---- | C] () -- C:\Windows\tasks\SmartDefrag.job
[2011.06.27 20:55:08 | 000,001,222 | ---- | C] () -- C:\Users\Administrator\Desktop\Revo Uninstaller.lnk
[2011.06.27 13:13:38 | 000,027,484 | ---- | C] () -- C:\Users\Administrator\Desktop\Logfiles.zip
[2011.06.27 12:33:18 | 000,302,592 | ---- | C] () -- C:\Users\Administrator\Desktop\c06dgghb.exe
[2011.06.27 12:04:42 | 000,000,020 | ---- | C] () -- C:\Users\Administrator\defogger_reenable
[2011.06.27 12:03:02 | 000,050,477 | ---- | C] () -- C:\Users\Administrator\Desktop\Defogger.exe
[2011.06.26 23:11:45 | 001,007,120 | ---- | C] () -- C:\Users\Administrator\Desktop\duadas.exe
[2011.06.26 09:56:45 | 000,095,049 | ---- | C] () -- C:\Users\Administrator\Desktop\IceHUD_RealUI.lua
[2011.06.24 10:38:56 | 000,002,170 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.06.22 07:50:33 | 000,002,503 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.06.13 12:57:16 | 000,000,044 | ---- | C] () -- C:\Users\Administrator\Desktop\Track05.cda
[2011.06.13 12:57:16 | 000,000,044 | ---- | C] () -- C:\Users\Administrator\Desktop\Track04.cda
[2011.06.13 12:57:16 | 000,000,044 | ---- | C] () -- C:\Users\Administrator\Desktop\Track03.cda
[2011.06.13 12:57:16 | 000,000,044 | ---- | C] () -- C:\Users\Administrator\Desktop\Track02.cda
[2011.06.13 12:57:16 | 000,000,044 | ---- | C] () -- C:\Users\Administrator\Desktop\Track01.cda
[2011.06.11 14:33:23 | 000,004,107 | ---- | C] () -- C:\Windows\wininit.ini
[2011.06.11 10:49:21 | 000,166,400 | RHS- | C] () -- C:\Windows\System32\KBDINMALV.dll
[2011.06.10 21:16:36 | 000,000,152 | ---- | C] () -- C:\Windows\System32\sysplog2.dll
[2011.06.10 21:16:28 | 000,000,152 | ---- | C] () -- C:\Windows\System32\sysplog.dll
[2011.06.10 21:15:42 | 000,000,997 | ---- | C] () -- C:\Users\Public\Desktop\chessimo.lnk
[2011.06.07 13:06:07 | 000,000,973 | ---- | C] () -- C:\Users\Administrator\Desktop\SpywareBlaster.lnk
[2011.06.07 12:56:17 | 000,001,246 | ---- | C] () -- C:\Users\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2011.05.07 12:12:25 | 000,138,264 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011.05.07 12:12:24 | 000,138,056 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\PnkBstrK.sys
[2011.05.07 12:11:54 | 000,234,768 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2011.05.07 12:11:18 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2011.03.13 20:14:06 | 000,390,944 | ---- | C] () -- C:\Windows\System32\drivers\SRS_AudioFusion_i386.sys
[2010.12.01 10:06:58 | 000,000,262 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010.10.14 20:58:05 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010.10.14 20:00:49 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.07.09 21:04:40 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
[2010.07.01 20:16:11 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.07.01 20:10:06 | 000,015,190 | ---- | C] () -- C:\Windows\M3000Twn.ini
[2010.07.01 20:02:18 | 000,006,088 | ---- | C] () -- C:\Windows\System32\drivers\CDConfig.bin
[2009.10.22 17:59:00 | 000,196,565 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2009.07.14 10:47:43 | 000,949,916 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,222,136 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,449,928 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,704,552 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,189,032 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009.06.09 10:55:58 | 000,057,904 | ---- | C] () -- C:\Windows\System32\wbload.dll
[2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll

< End of report >

[*]Das OTL Extrascanfile:

Code:

ATTFilter

OTL Extras logfile created on: 01.07.2011 19:29:27 - Run 6
OTL by OldTimer - Version 3.2.24.1     Folder = C:\Users\Administrator\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
1,75 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 45,37% Memory free
6,98 Gb Paging File | 5,79 Gb Available in Paging File | 82,92% Paging File free
Paging file location(s): [Binary data over 100 bytes]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 153,68 Gb Total Space | 71,14 Gb Free Space | 46,29% Space Free | Partition Type: NTFS
Drive D: | 78,03 Gb Total Space | 35,76 Gb Free Space | 45,84% Space Free | Partition Type: NTFS
 
Computer Name: DENNIS-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ACD183-EAEC-82C8-F71E-8FF0B6143D7B}" = CCC Help Portuguese
"{02602409-9189-4567-BC07-562605243B69}" = Windows Live Remote Client Resources
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{063BBC11-7F75-3BBA-02AA-A1B5FC0E17AC}" = CCC Help Polish
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{11C39430-2BC0-4C47-4541-B6C8150D4A65}" = Catalyst Control Center InstallProxy
"{1375616C-B818-9FC7-0BE3-AE9AC45F1188}" = CCC Help Chinese Standard
"{14AEA387-7A94-575A-4328-07BE82BD7F32}" = ATI Catalyst Install Manager
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{25C64847-B900-48AD-A164-1B4F9B774650}" = System Update
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 23
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2B4E24A0-A06F-488D-87D8-16738E5E1104}" = Windows Live Family Safety
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3253AC2A-EC76-DC6C-6ED1-EBA5E67A79A1}" = ccc-utility
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{36B38C30-94C1-2B9C-B973-59B2FB37CCB0}" = CCC Help Dutch
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3931705A-D653-44A8-9BB5-759B7965BE99}_is1" = YABOT Build Order Editor version 1.0
"{3A65A74A-5B6E-451A-92D8-50F1182BBE9A}" = Windows Live Remote Service Resources
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D1FB742-A73A-2403-639F-C8CD64A70449}" = CCC Help Chinese Traditional
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{417CE154-54E7-3655-0C24-34FBFCA5163C}" = CCC Help Finnish
"{420F882E-36E5-9C3B-BF07-B0C1911F4739}" = CCC Help Italian
"{460495AF-988E-CDD4-591D-7E75AC1CAF4A}" = Catalyst Control Center Core Implementation
"{46E8BDC8-F7BD-3F44-8DA1-9B26DAB62205}" = CCC Help Swedish
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{4761EB82-E8BD-45A4-B19B-586FA9D1D7E6}" = Camtasia Studio 6
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BB1DCED-84D3-47F9-B718-5947E904593E}" = Lenovo EasyCamera
"{4E0BEC25-51C6-30AE-348D-AA208ABA3400}" = CCC Help Japanese
"{55718B4B90B54F7EADC5621C750A14E6}" = DivX Author 1.5
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BDA2F58-1F21-4D10-9910-92B01EBCC958}" = AMD USB Filter Driver
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6128B845-A2F4-283F-92B8-C02B393373A4}" = CCC Help Hungarian
"{613B9AA5-33A3-B2BB-D87D-BF7B1C02315E}" = Catalyst Control Center Localization All
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{65C0025A-2CDE-43C5-82D0-C7A56EF0DB39}" = Bing Bar Platform
"{65C743AF-D881-B71D-A753-A95C5219E78B}" = Catalyst Control Center Graphics Full Existing
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6F7614CC-F33A-4877-8814-49856F441F3C}" = Stardock MyColors
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{836180C6-4998-B1EE-782A-EF196850A98F}" = CCC Help Turkish
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{84738B59-F709-5737-524D-CAC71D74C23F}" = CCC Help English
"{848249FC-EA31-81CC-914B-7401C37B03CE}" = CCC Help Russian
"{8518ECC0-0DE4-4475-D0C1-C8114A8F0C0B}" = CCC Help French
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{87686C21-8A15-4b4d-A3F1-11141D9BE094}" = Battlefield Play4Free
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8AA1963A-5234-BECC-B5E7-7469ABBC6514}" = Catalyst Control Center Graphics Light
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8D540B8F-1325-CF57-0C84-B59B03B153FB}" = CCC Help Spanish
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E537894-A559-4D60-B3CB-F4485E3D24E3}" = ThinkVantage Access Connections
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90140000-0015-0416-0000-0000000FF1CE}" = Microsoft Office Access MUI (Portuguese (Brazil)) 2010
"{90140000-0016-0416-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Portuguese (Brazil)) 2010
"{90140000-0018-0416-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010
"{90140000-0019-0416-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010
"{90140000-001A-0416-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010
"{90140000-001B-0416-0000-0000000FF1CE}" = Microsoft Office Word MUI (Portuguese (Brazil)) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0416-0000-0000000FF1CE}" = Microsoft Office Proofing (Portuguese (Brazil)) 2010
"{90140000-0044-0416-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2010
"{90140000-006E-0416-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Portuguese (Brazil)) 2010
"{90140000-00A1-0416-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010
"{90140000-00BA-0416-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Portuguese (Brazil)) 2010
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93ABEBEB-EEE0-4AB9-A925-2F2EC791A4CE}" = Smart Technology Programming Software 7.0.2.7
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{96CC86A2-997F-46BF-9ADF-3857DB648765}" = chessimo 3.42
"{97BBECCF-B1FD-4010-8D4B-EFC9E3CCEECF}" = Driver Whiz
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A3D7DCF8-A79C-882D-1B6F-2A5106053F9B}" = CCC Help Danish
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96BFADF-A159-4395-8E9C-A9E2F059A3BB}" = Camtasia Studio 7
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA1AF34D-9056-4B72-A588-D9A7B8CB305B}" = Saitek Cyborg Keyboard Volume 6.2.1.3
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}" = Energy Management
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B569783D-389B-BA36-6A8E-1457C12E77F1}" = CCC Help Thai
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{BDAFF03F-3E7D-427B-A658-3807C4C58B0C}" = Goldfinger 8
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C8E95BF5-C07F-4D98-BB42-F58FC98BC03E}" = Google Apps
"{C9A3120D-C729-875A-AD54-C3AE3F9C826B}" = CCC Help Korean
"{CA050D8C-770A-41A7-B966-0056456EA27E}" = Razer StarCraft II
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF051DB4-9E13-0A5B-314D-B0AC3B3BF9D9}" = CCC Help German
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{D7A0A22A-C132-4B6F-8D68-67B95117DE93}" = RIFT
"{D8EDD457-B59B-FFC6-7E6B-749734E71D03}" = Catalyst Control Center Graphics Previews Common
"{D9D1A2FD-56B2-4F21-B959-745FE43CAB8C}" = Vegas Pro 9.0
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E28FD821-1863-4BC0-8B8C-959EEE805FDE}" = SRS AudioFusion
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EEAADF6C-CB48-DE4C-C934-1A9C11F1D7AE}" = ccc-core-static
"{EF1D891C-1616-C383-AD0B-6C8B0A8F8CC9}" = CCC Help Czech
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F231A12D-5C87-6201-DF65-25106365399D}" = Catalyst Control Center Graphics Full New
"{F25E99CD-A296-85C2-BF1A-9E6BCDE8FA4A}" = CCC Help Greek
"{F3DCF8E5-F5BA-492B-8113-7FAAED125BE0}" = capella 1200
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFCB7CDF-534B-3297-8B3E-2E7587A4AE1A}" = CCC Help Norwegian
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Babylon" = Babylon
"CABAL Online: Episode IV_is1" = Cabal Online Europe - Episode IV
"Camtasia Studio 3" = Camtasia Studio 3
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Der Schreibtrainer" = Der Schreibtrainer 3.7
"DivX Setup.divx.com" = DivX-Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.50
"Free YouTube Download_is1" = Free YouTube Download 2.6
"FreeApp v1" = FreeApps
"Game Booster_is1" = Game Booster
"Game Maker 8.0" = Game Maker 8.0
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"Google Updater" = Google Updater
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"InstallShield_{D7A0A22A-C132-4B6F-8D68-67B95117DE93}" = RIFT
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.0.1200
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 4.0 (x86 de)" = Mozilla Firefox 4.0 (x86 de)
"Notepad++" = Notepad++
"PC SECURITY TEST 2009_is1" = PC SECURITY TEST 2009
"Picasa 3" = Picasa 3
"PowerISO" = PowerISO
"PunkBusterSvc" = PunkBuster Services
"RAR Password Cracker" = RAR Password Cracker 4.12
"RealPlayer 12.0" = RealPlayer
"Revo Uninstaller" = Revo Uninstaller 1.92
"RocketDock_is1" = RocketDock 1.3.5
"SC2 Replay Catcher_is1" = SC2 Replay Catcher version 0.1.0.3a
"Smart Defrag_is1" = Smart Defrag
"SpywareBlaster_is1" = SpywareBlaster 4.4
"StarCraft II" = StarCraft II
"Stardock MyColors" = Stardock MyColors
"SW-Tukupdater_is1" = SW-TukUpdater
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Test Drive Unlimited 2_is1" = Test Drive Unlimited 2
"Uninstall_is1" = Uninstall 1.0.0.1
"Webocton - Scriptly_is1" = Webocton - Scriptly 0.8.95.6
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"World of Warcraft" = World of Warcraft
"World of Warcraft Public Test" = World of Warcraft Public Test
"Xfire" = Xfire (remove only)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"ccb6737a8af9d4ff" = Lenovo Driver Download Manager
"UnityWebPlayer" = Unity Web Player
"WinPump" = WinPump
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 27.06.2011 02:14:03 | Computer Name = Dennis-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\spybot
 - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der Wert "*" des "language"-Attributs
 im assemblyIdentity-Element ist ungültig.
 
Error - 27.06.2011 07:10:46 | Computer Name = Dennis-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: pev.exe, Version: 0.0.0.0, Zeitstempel:
 0x4d334d98  Name des fehlerhaften Moduls: ADVAPI32.dll_unloaded, Version: 0.0.0.0,
 Zeitstempel: 0x4a5bd97e  Ausnahmecode: 0xc0000005  Fehleroffset: 0x7785b663  ID des fehlerhaften
 Prozesses: 0x10ec  Startzeit der fehlerhaften Anwendung: 0x01cc34badcb26d09  Pfad der
 fehlerhaften Anwendung: C:\Users\ADMINI~1\AppData\Local\Temp\RarSFX4\pev.exe  Pfad
 des fehlerhaften Moduls: ADVAPI32.dll  Berichtskennung: 1a9c5f98-a0ae-11e0-b70a-705ab65c33b2
 
Error - 27.06.2011 15:11:42 | Computer Name = Dennis-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.24.1 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: e98    Startzeit: 
01cc34fd433820d1    Endzeit: 15    Anwendungspfad: C:\Users\Administrator\Desktop\OTL.exe

Berichts-ID:
 4791b746-a0f1-11e0-b9c2-705ab65c33b2  
 
Error - 27.06.2011 15:17:00 | Computer Name = Dennis-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.24.1 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: d74    Startzeit: 
01cc34feaf5feadb    Endzeit: 0    Anwendungspfad: C:\Users\Administrator\Desktop\OTL.exe

Berichts-ID:
 05a386d6-a0f2-11e0-b7a3-705ab65c33b2  
 
Error - 29.06.2011 02:53:30 | Computer Name = Dennis-PC | Source = SideBySide | ID = 16842811
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Lenovo\Access
 Connections\AcCryptHlpr.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program
 Files\Lenovo\Access Connections\AcCryptHlpr.dll" in Zeile 0.  Ungültige XML-Syntax.
 
Error - 29.06.2011 02:56:44 | Computer Name = Dennis-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Razer\Drivers\RzSynapse\DPInst_amd64.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 29.06.2011 03:02:24 | Computer Name = Dennis-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\spybot
 - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der Wert "*" des "language"-Attributs
 im assemblyIdentity-Element ist ungültig.
 
Error - 30.06.2011 04:22:35 | Computer Name = Dennis-PC | Source = SideBySide | ID = 16842811
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Lenovo\Access
 Connections\AcCryptHlpr.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program
 Files\Lenovo\Access Connections\AcCryptHlpr.dll" in Zeile 0.  Ungültige XML-Syntax.
 
Error - 30.06.2011 04:25:11 | Computer Name = Dennis-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Razer\Drivers\RzSynapse\DPInst_amd64.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 30.06.2011 04:30:19 | Computer Name = Dennis-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\spybot
 - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der Wert "*" des "language"-Attributs
 im assemblyIdentity-Element ist ungültig.
 
[ Media Center Events ]
Error - 28.03.2011 07:25:42 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0
Description = 13:25:41 - Fehler beim Herstellen der Internetverbindung.  13:25:41 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 28.03.2011 07:25:55 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0
Description = 13:25:49 - Fehler beim Herstellen der Internetverbindung.  13:25:49 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 16.04.2011 04:34:45 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0
Description = 10:34:44 - Fehler beim Herstellen der Internetverbindung.  10:34:45 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 16.04.2011 04:35:36 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0
Description = 10:35:14 - Fehler beim Herstellen der Internetverbindung.  10:35:14 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 16.04.2011 06:37:45 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0
Description = 12:37:45 - Fehler beim Herstellen der Internetverbindung.  12:37:45 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 16.04.2011 06:38:25 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0
Description = 12:38:14 - Fehler beim Herstellen der Internetverbindung.  12:38:14 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 24.04.2011 03:57:10 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0
Description = 09:54:53 - Directory konnte nicht abgerufen werden (Fehler: Die Anfrage
 wurde abgebrochen: Die Anfrage wurde abgebrochen..)  
 
Error - 24.04.2011 04:16:26 | Computer Name = Dennis-PC | Source = MCUpdate | ID = 0
Description = 10:15:06 - MCESpotlight konnte nicht abgerufen werden (Fehler: Invalid
 security token.)  
 
[ OSession Events ]
Error - 28.09.2010 15:26:09 | Computer Name = Dennis-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3436
 seconds with 480 seconds of active time.  This session ended with a crash.
 
Error - 05.10.2010 15:37:15 | Computer Name = Dennis-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1278
 seconds with 300 seconds of active time.  This session ended with a crash.
 
Error - 25.11.2010 16:24:56 | Computer Name = Dennis-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 10330
 seconds with 2460 seconds of active time.  This session ended with a crash.
 
Error - 13.12.2010 16:19:25 | Computer Name = Dennis-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8119
 seconds with 780 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 01.07.2011 11:34:21 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190
Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
 
Error - 01.07.2011 11:34:22 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190
Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
 
Error - 01.07.2011 11:34:29 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190
Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
 
Error - 01.07.2011 11:34:29 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190
Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
 
Error - 01.07.2011 11:34:36 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SBSD Security Center Service" ist vom Dienst "wscsvc" 
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 01.07.2011 13:16:55 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190
Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
 
Error - 01.07.2011 13:16:55 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190
Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
 
Error - 01.07.2011 13:17:02 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190
Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
 
Error - 01.07.2011 13:17:02 | Computer Name = Dennis-PC | Source = volmgr | ID = 262190
Description = Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
 
Error - 01.07.2011 13:17:09 | Computer Name = Dennis-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SBSD Security Center Service" ist vom Dienst "wscsvc" 
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
 
< End of report >

[*]Fragen: Wirst du immer noch auf Google-Suchen umgeleitet? Ja
Wenn ja, tritt das Problem mit dem Internet Explorer und Firefox auf? Teste und berichte bitte. Ja[/LIST]Achja, darf ich Avira wieder Installieren oder wäre das eher nicht empfehlenswert?
Sry, dass ich das ganze in 2 Seiten Posten musste, nicht genügend Schriftzeichenplätze :P
MFG,
Deathkid

M-K-D-B · 02.07.2011, 13:29

Hallo Deathkid,

Aufgrund der Umleitungen vermute ich ein Rootkit. Wir müssen es möglichst schnell finden:

Schritt # 1: AV Programm installieren
Wenn du bei Avira bleiben möchtest, kannst du es wieder installieren.
Wir empfehlen seit kurzem Avira nicht mehr. Den Grund dafür findest du hier: aviras neue partner: uniblue und ask

Wir empfehlen nur noch Avast! Free und Microsoft Security Essentials. Solltest du dich dennoch für Avira entscheiden, so empfehle ich dir bei der Installation die vorgeschlagene Toolbar nicht mit zu installieren.

Schritt # 2: Kontrolle mit VirusTotal
Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.

Klicke auf Durchsuchen
Kopiere nun folgendes in die Suchleiste.
Code:
ATTFilter
```
C:\Windows\System32\drivers\volsnap.sys
         
```
und klicke auf Öffnen.
Klicke auf Send File.

Warte bitte bis die Datei vollständig hochgeladen wurde. Solltest Du folgende Meldung bekommen.

Zitat:

File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:

klicke auf Reanalyse.
Warte bis unter Current status: Finished steht.

Kopiere den Link aus deiner Adresszeile und poste ihn hier.

Schritt # 3: Benutzerdefinierter Scan mit OTL

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

C:\ProgramData\bL28601DaMcK28601\bL28601DaMcK28601\* /S
C:\Qoobox\* /s

Schließe bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Nichts und danach den Scan Button.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Schritt # 4: Stoppen von Treibern mit Defogger

Starte das Tool mit Doppelklick.
Vista und Windows 7 User: Bitte mit Rechtsklick "als Administrator starten".
Klicke nun auf den Disable Button um die Treiber gewisser Emulatoren zu deaktivieren.
Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
Defogger fordert nun zum Neustart auf. Bestätige dies mit OK.
DeFogger erstellt nun ein Logfile auf dem Desktop (defogger_disable).

Poste bitte den Inhalt der Logfile in Deiner nächsten Antwort.
Wenn wir die Bereinigung beendet haben, starte bitte defogger erneut und klicke den Re-enable Button.

Schritt # 5: aswMBR.exe ausführen

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Schritt # 6: Deine Rückmeldung
Zur weiteren Analyse benötige ich zusammen mit deiner nächsten Antwort

den Link zum Ergebnis von VirusTotal,
das Logfile von OTL (OTL.txt),
das Logfile von Defogger und
das Logfile von aswMBR.

28.06.2011, 14:13	#1
Deathkid535 /// Malwareteam	MS removal Tool vollständig entfernen Hallo M-K-D-B Ich habe den AntiVir-Guard deaktiviert, und dann ComboFix gestartet, doch dieser schreibt, dass dieser noch immer aktiv ist. Könntest du mir bitte sagen, wie man ihn Deaktiviert, da ich durch google-suche auch nicht draufgekommen bin Zu der Frage: Nein, den habe ich nicht eingerichtet, ich weiss nicht einmal, was das ist. MFG, Deathkid

28.06.2011, 19:43	#3
Deathkid535 /// Malwareteam	MS removal Tool vollständig entfernen Hallo M-K-D-B, Nach einigen Stunden des durchlaufen lassens(sollte wohl nicht so sein), ist bis jetzt genau GAR NICHTS passiert. Liegt das an dem AntiVir? MFG, Deathkid __________________

28.06.2011, 20:27	#5
Deathkid535 /// Malwareteam	MS removal Tool vollständig entfernen Hallo M-K-D-B, Bis jetzt ist noch immer nichts probiert, sieht auch so aus als würde auch die nächsten Stunden wieder nichts passieren. Gruß, Deathkid

01.07.2011, 13:19	#8
Deathkid535 /// Malwareteam	MS removal Tool vollständig entfernen Hallo M-K-D-B, Ich habe Avira deinstalliert, Computer neugestartet, aber Combofik bleibt bei "... kann sich die Zeit verdoppeln" hängen. Ich habe auch schon versucht, ComboFix über die Befehlszeile auszuführen. Ausserdem jammert das Programm noich immer rum, dass AntiVir Desktop aktiv ist.

MS removal Tool vollständig entfernen

Log-Analyse und Auswertung: MS removal Tool vollständig entfernen