| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: searchqu.com/413Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
11.09.2011, 14:26
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  searchqu.com/413 Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.  Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
11.09.2011, 14:36
| #17 |
 | searchqu.com/413 Hallo Arne,
__________________Log des TdSSKillers: 2011/09/11 15:34:26.0225 4584 TDSS rootkit removing tool 2.5.21.0 Sep 10 2011 21:07:05 2011/09/11 15:34:26.0350 4584 ================================================================================ 2011/09/11 15:34:26.0350 4584 SystemInfo: 2011/09/11 15:34:26.0350 4584 2011/09/11 15:34:26.0350 4584 OS Version: 6.0.6002 ServicePack: 2.0 2011/09/11 15:34:26.0350 4584 Product type: Workstation 2011/09/11 15:34:26.0351 4584 ComputerName: ARBEITSZIMMER 2011/09/11 15:34:26.0351 4584 UserName: Frank 2011/09/11 15:34:26.0351 4584 Windows directory: C:\Windows 2011/09/11 15:34:26.0351 4584 System windows directory: C:\Windows 2011/09/11 15:34:26.0351 4584 Running under WOW64 2011/09/11 15:34:26.0351 4584 Processor architecture: Intel x64 2011/09/11 15:34:26.0351 4584 Number of processors: 2 2011/09/11 15:34:26.0351 4584 Page size: 0x1000 2011/09/11 15:34:26.0351 4584 Boot type: Normal boot 2011/09/11 15:34:26.0351 4584 ================================================================================ 2011/09/11 15:34:26.0759 4584 Initialize success 2011/09/11 15:34:47.0833 2780 ================================================================================ 2011/09/11 15:34:47.0833 2780 Scan started 2011/09/11 15:34:47.0833 2780 Mode: Manual; 2011/09/11 15:34:47.0833 2780 ================================================================================ 2011/09/11 15:34:48.0221 2780 ACPI (1965aaffab07e3fb03c77f81beba3547) C:\Windows\system32\drivers\acpi.sys 2011/09/11 15:34:48.0365 2780 adp94xx (f14215e37cf124104575073f782111d2) C:\Windows\system32\drivers\adp94xx.sys 2011/09/11 15:34:48.0409 2780 adpahci (7d05a75e3066861a6610f7ee04ff085c) C:\Windows\system32\drivers\adpahci.sys 2011/09/11 15:34:48.0442 2780 adpu160m (820a201fe08a0c345b3bedbc30e1a77c) C:\Windows\system32\drivers\adpu160m.sys 2011/09/11 15:34:48.0466 2780 adpu320 (9b4ab6854559dc168fbb4c24fc52e794) C:\Windows\system32\drivers\adpu320.sys 2011/09/11 15:34:48.0527 2780 AF15BDA (0517e1670a58213e3f206066cd209273) C:\Windows\system32\DRIVERS\AF15BDA.sys 2011/09/11 15:34:48.0597 2780 AFD (0cc146c4addea45791b18b1e2659f4a9) C:\Windows\system32\drivers\afd.sys 2011/09/11 15:34:48.0638 2780 agp440 (f6f6793b7f17b550ecfdbd3b229173f7) C:\Windows\system32\drivers\agp440.sys 2011/09/11 15:34:48.0669 2780 aic78xx (222cb641b4b8a1d1126f8033f9fd6a00) C:\Windows\system32\drivers\djsvs.sys 2011/09/11 15:34:48.0710 2780 aliide (157d0898d4b73f075ce9fa26b482df98) C:\Windows\system32\drivers\aliide.sys 2011/09/11 15:34:48.0731 2780 amdide (970fa5059e61e30d25307b99903e991e) C:\Windows\system32\drivers\amdide.sys 2011/09/11 15:34:48.0762 2780 AmdK8 (cdc3632a3a5ea4dbb83e46076a3165a1) C:\Windows\system32\drivers\amdk8.sys 2011/09/11 15:34:48.0804 2780 arc (ba8417d4765f3988ff921f30f630e303) C:\Windows\system32\drivers\arc.sys 2011/09/11 15:34:48.0834 2780 arcsas (9d41c435619733b34cc16a511e644b11) C:\Windows\system32\drivers\arcsas.sys 2011/09/11 15:34:48.0867 2780 AsyncMac (22d13ff3dafec2a80634752b1eaa2de6) C:\Windows\system32\DRIVERS\asyncmac.sys 2011/09/11 15:34:48.0903 2780 atapi (e68d9b3a3905619732f7fe039466a623) C:\Windows\system32\drivers\atapi.sys 2011/09/11 15:34:49.0053 2780 BHDrvx64 (41da5845e1f8af445bd626cf085c4541) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110901.001\BHDrvx64.sys 2011/09/11 15:34:49.0133 2780 blbdrive (79feeb40056683f8f61398d81dda65d2) C:\Windows\system32\drivers\blbdrive.sys 2011/09/11 15:34:49.0167 2780 bowser (2348447a80920b2493a9b582a23e81e1) C:\Windows\system32\DRIVERS\bowser.sys 2011/09/11 15:34:49.0202 2780 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\brfiltlo.sys 2011/09/11 15:34:49.0231 2780 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\brfiltup.sys 2011/09/11 15:34:49.0268 2780 Brserid (f0f0ba4d815be446aa6a4583ca3bca9b) C:\Windows\system32\drivers\brserid.sys 2011/09/11 15:34:49.0285 2780 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\system32\drivers\brserwdm.sys 2011/09/11 15:34:49.0311 2780 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\system32\drivers\brusbmdm.sys 2011/09/11 15:34:49.0334 2780 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\system32\drivers\brusbser.sys 2011/09/11 15:34:49.0361 2780 BTHMODEM (e0777b34e05f8a82a21856efc900c29f) C:\Windows\system32\drivers\bthmodem.sys 2011/09/11 15:34:49.0391 2780 cdfs (b4d787db8d30793a4d4df9feed18f136) C:\Windows\system32\DRIVERS\cdfs.sys 2011/09/11 15:34:49.0423 2780 cdrom (c025aa69be3d0d25c7a2e746ef6f94fc) C:\Windows\system32\DRIVERS\cdrom.sys 2011/09/11 15:34:49.0458 2780 circlass (02ea568d498bbdd4ba55bf3fce34d456) C:\Windows\system32\drivers\circlass.sys 2011/09/11 15:34:49.0497 2780 CLFS (3dca9a18b204939cfb24bea53e31eb48) C:\Windows\system32\CLFS.sys 2011/09/11 15:34:49.0540 2780 cmdide (e5d5499a1c50a54b5161296b6afe6192) C:\Windows\system32\drivers\cmdide.sys 2011/09/11 15:34:49.0565 2780 Compbatt (7fb8ad01db0eabe60c8a861531a8f431) C:\Windows\system32\drivers\compbatt.sys 2011/09/11 15:34:49.0598 2780 crcdisk (a8585b6412253803ce8efcbd6d6dc15c) C:\Windows\system32\drivers\crcdisk.sys 2011/09/11 15:34:49.0658 2780 DfsC (8b722ba35205c71e7951cdc4cdbade19) C:\Windows\system32\Drivers\dfsc.sys 2011/09/11 15:34:49.0715 2780 disk (b0107e40ecdb5fa692ebf832f295d905) C:\Windows\system32\drivers\disk.sys 2011/09/11 15:34:49.0795 2780 drmkaud (f1a78a98cfc2ee02144c6bec945447e6) C:\Windows\system32\drivers\drmkaud.sys 2011/09/11 15:34:49.0849 2780 DXGKrnl (b8e554e502d5123bc111f99d6a2181b4) C:\Windows\System32\drivers\dxgkrnl.sys 2011/09/11 15:34:50.0070 2780 E1G60 (264cee7b031a9d6c827f3d0cb031f2fe) C:\Windows\system32\DRIVERS\E1G6032E.sys 2011/09/11 15:34:50.0155 2780 Ecache (5f94962be5a62db6e447ff6470c4f48a) C:\Windows\system32\drivers\ecache.sys 2011/09/11 15:34:50.0239 2780 eeCtrl (5e3a50930447f464c66032e05a4632f5) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys 2011/09/11 15:34:50.0366 2780 elxstor (c4636d6e10469404ab5308d9fd45ed07) C:\Windows\system32\drivers\elxstor.sys 2011/09/11 15:34:50.0454 2780 EraserUtilRebootDrv (dcb76ecc6b50a266fdc16e1963ab98ce) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 2011/09/11 15:34:50.0540 2780 ErrDev (bc3a58e938bb277e46bf4b3003b01abd) C:\Windows\system32\drivers\errdev.sys 2011/09/11 15:34:50.0653 2780 exfat (486844f47b6636044a42454614ed4523) C:\Windows\system32\drivers\exfat.sys 2011/09/11 15:34:50.0705 2780 fastfat (1a4bee34277784619ddaf0422c0c6e23) C:\Windows\system32\drivers\fastfat.sys 2011/09/11 15:34:50.0754 2780 fdc (81b79b6df71fa1d2c6d688d830616e39) C:\Windows\system32\DRIVERS\fdc.sys 2011/09/11 15:34:50.0789 2780 FileInfo (457b7d1d533e4bd62a99aed9c7bb4c59) C:\Windows\system32\drivers\fileinfo.sys 2011/09/11 15:34:50.0814 2780 Filetrace (d421327fd6efccaf884a54c58e1b0d7f) C:\Windows\system32\drivers\filetrace.sys 2011/09/11 15:34:50.0846 2780 flpydisk (230923ea2b80f79b0f88d90f87b87ebd) C:\Windows\system32\DRIVERS\flpydisk.sys 2011/09/11 15:34:50.0873 2780 FltMgr (e3041bc26d6930d61f42aedb79c91720) C:\Windows\system32\drivers\fltmgr.sys 2011/09/11 15:34:50.0911 2780 Fs_Rec (29d99e860a1ca0a03c6a733fdd0da703) C:\Windows\system32\drivers\Fs_Rec.sys 2011/09/11 15:34:50.0939 2780 gagp30kx (c8e416668d3dc2be3d4fe4c79224997f) C:\Windows\system32\drivers\gagp30kx.sys 2011/09/11 15:34:51.0035 2780 HdAudAddService (df45f8142dc6df9d18c39b3effbd0409) C:\Windows\system32\drivers\HdAudio.sys 2011/09/11 15:34:51.0103 2780 HDAudBus (f942c5820205f2fb453243edfec82a3d) C:\Windows\system32\DRIVERS\HDAudBus.sys 2011/09/11 15:34:51.0151 2780 HidBth (b4881c84a180e75b8c25dc1d726c375f) C:\Windows\system32\drivers\hidbth.sys 2011/09/11 15:34:51.0180 2780 HidIr (4e77a77e2c986e8f88f996bb3e1ad829) C:\Windows\system32\drivers\hidir.sys 2011/09/11 15:34:51.0219 2780 HidUsb (443bdd2d30bb4f00795c797e2cf99edf) C:\Windows\system32\DRIVERS\hidusb.sys 2011/09/11 15:34:51.0308 2780 HpCISSs (d7109a1e6bd2dfdbcba72a6bc626a13b) C:\Windows\system32\drivers\hpcisss.sys 2011/09/11 15:34:51.0371 2780 HTTP (098f1e4e5c9cb5b0063a959063631610) C:\Windows\system32\drivers\HTTP.sys 2011/09/11 15:34:51.0408 2780 i2omp (da94c854cea5fac549d4e1f6e88349e8) C:\Windows\system32\drivers\i2omp.sys 2011/09/11 15:34:51.0440 2780 i8042prt (cbb597659a2713ce0c9cc20c88c7591f) C:\Windows\system32\DRIVERS\i8042prt.sys 2011/09/11 15:34:51.0483 2780 iaStorV (3e3bf3627d886736d0b4e90054f929f6) C:\Windows\system32\drivers\iastorv.sys 2011/09/11 15:34:51.0595 2780 IDSVia64 (0b97f1a640ad3d159a7b5d2164c42e50) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110909.030\IDSvia64.sys 2011/09/11 15:34:51.0692 2780 iirsp (8c3951ad2fe886ef76c7b5027c3125d3) C:\Windows\system32\drivers\iirsp.sys 2011/09/11 15:34:51.0792 2780 int15 (8c7fa71cb1ebcd3ede8958d27b1bf0b4) C:\Windows\SysWOW64\drivers\int15_64.sys 2011/09/11 15:34:51.0895 2780 IntcAzAudAddService (504eaa8a5a61b051ad5b26205fc00e12) C:\Windows\system32\drivers\RTKVHD64.sys 2011/09/11 15:34:51.0964 2780 intelide (df797a12176f11b2d301c5b234bb200e) C:\Windows\system32\drivers\intelide.sys 2011/09/11 15:34:51.0992 2780 intelppm (bfd84af32fa1bad6231c4585cb469630) C:\Windows\system32\DRIVERS\intelppm.sys 2011/09/11 15:34:52.0032 2780 IpFilterDriver (d8aabc341311e4780d6fce8c73c0ad81) C:\Windows\system32\DRIVERS\ipfltdrv.sys 2011/09/11 15:34:52.0086 2780 IPMIDRV (9c2ee2e6e5a7203bfae15c299475ec67) C:\Windows\system32\drivers\ipmidrv.sys 2011/09/11 15:34:52.0111 2780 IPNAT (b7e6212f581ea5f6ab0c3a6ceeeb89be) C:\Windows\system32\DRIVERS\ipnat.sys 2011/09/11 15:34:52.0145 2780 IRENUM (8c42ca155343a2f11d29feca67faa88d) C:\Windows\system32\drivers\irenum.sys 2011/09/11 15:34:52.0167 2780 isapnp (0672bfcedc6fc468a2b0500d81437f4f) C:\Windows\system32\drivers\isapnp.sys 2011/09/11 15:34:52.0214 2780 iScsiPrt (e4fdf99599f27ec25d2cf6d754243520) C:\Windows\system32\DRIVERS\msiscsi.sys 2011/09/11 15:34:52.0237 2780 iteatapi (63c766cdc609ff8206cb447a65abba4a) C:\Windows\system32\drivers\iteatapi.sys 2011/09/11 15:34:52.0262 2780 iteraid (1281fe73b17664631d12f643cbea3f59) C:\Windows\system32\drivers\iteraid.sys 2011/09/11 15:34:52.0283 2780 kbdclass (423696f3ba6472dd17699209b933bc26) C:\Windows\system32\DRIVERS\kbdclass.sys 2011/09/11 15:34:52.0314 2780 kbdhid (dbdf75d51464fbc47d0104ec3d572c05) C:\Windows\system32\DRIVERS\kbdhid.sys 2011/09/11 15:34:52.0467 2780 KSecDD (476e2c1dcea45895994bef11c2a98715) C:\Windows\system32\Drivers\ksecdd.sys 2011/09/11 15:34:52.0506 2780 ksthunk (1d419cf43db29396ecd7113d129d94eb) C:\Windows\system32\drivers\ksthunk.sys 2011/09/11 15:34:52.0551 2780 lltdio (96ece2659b6654c10a0c310ae3a6d02c) C:\Windows\system32\DRIVERS\lltdio.sys 2011/09/11 15:34:52.0591 2780 LSI_FC (acbe1af32d3123e330a07bfbc5ec4a9b) C:\Windows\system32\drivers\lsi_fc.sys 2011/09/11 15:34:52.0611 2780 LSI_SAS (799ffb2fc4729fa46d2157c0065b3525) C:\Windows\system32\drivers\lsi_sas.sys 2011/09/11 15:34:52.0649 2780 LSI_SCSI (f445ff1daad8a226366bfaf42551226b) C:\Windows\system32\drivers\lsi_scsi.sys 2011/09/11 15:34:52.0675 2780 luafv (52f87b9cc8932c2a7375c3b2a9be5e3e) C:\Windows\system32\drivers\luafv.sys 2011/09/11 15:34:52.0728 2780 megasas (5c5cd6aaced32fb26c3fb34b3dcf972f) C:\Windows\system32\drivers\megasas.sys 2011/09/11 15:34:52.0770 2780 MegaSR (859bc2436b076c77c159ed694acfe8f8) C:\Windows\system32\drivers\megasr.sys 2011/09/11 15:34:52.0802 2780 Modem (59848d5cc74606f0ee7557983bb73c2e) C:\Windows\system32\drivers\modem.sys 2011/09/11 15:34:52.0834 2780 monitor (c247cc2a57e0a0c8c6dccf7807b3e9e5) C:\Windows\system32\DRIVERS\monitor.sys 2011/09/11 15:34:52.0859 2780 mouclass (9367304e5e412b120cf5f4ea14e4e4f1) C:\Windows\system32\DRIVERS\mouclass.sys 2011/09/11 15:34:52.0892 2780 mouhid (c2c2bd5c5ce5aaf786ddd74b75d2ac69) C:\Windows\system32\DRIVERS\mouhid.sys 2011/09/11 15:34:52.0931 2780 MountMgr (11bc9b1e8801b01f7f6adb9ead30019b) C:\Windows\system32\drivers\mountmgr.sys 2011/09/11 15:34:52.0963 2780 mpio (f8276eb8698142884498a528dfea8478) C:\Windows\system32\drivers\mpio.sys 2011/09/11 15:34:52.0996 2780 mpsdrv (c92b9abdb65a5991e00c28f13491dba2) C:\Windows\system32\drivers\mpsdrv.sys 2011/09/11 15:34:53.0036 2780 Mraid35x (3c200630a89ef2c0864d515b7a75802e) C:\Windows\system32\drivers\mraid35x.sys 2011/09/11 15:34:53.0069 2780 MRxDAV (7c1de4aa96dc0c071611f9e7de02a68d) C:\Windows\system32\drivers\mrxdav.sys 2011/09/11 15:34:53.0109 2780 mrxsmb (1485811b320ff8c7edad1caebb1c6c2b) C:\Windows\system32\DRIVERS\mrxsmb.sys 2011/09/11 15:34:53.0144 2780 mrxsmb10 (3b929a60c833fc615fd97fba82bc7632) C:\Windows\system32\DRIVERS\mrxsmb10.sys 2011/09/11 15:34:53.0163 2780 mrxsmb20 (c64ab3e1f53b4f5b5bb6d796b2d7bec3) C:\Windows\system32\DRIVERS\mrxsmb20.sys 2011/09/11 15:34:53.0212 2780 msahci (1ac860612b85d8e85ee257d372e39f4d) C:\Windows\system32\drivers\msahci.sys 2011/09/11 15:34:53.0244 2780 msdsm (264bbb4aaf312a485f0e44b65a6b7202) C:\Windows\system32\drivers\msdsm.sys 2011/09/11 15:34:53.0294 2780 Msfs (704f59bfc4512d2bb0146aec31b10a7c) C:\Windows\system32\drivers\Msfs.sys 2011/09/11 15:34:53.0316 2780 msisadrv (00ebc952961664780d43dca157e79b27) C:\Windows\system32\drivers\msisadrv.sys 2011/09/11 15:34:53.0354 2780 MSKSSRV (0ea73e498f53b96d83dbfca074ad4cf8) C:\Windows\system32\drivers\MSKSSRV.sys 2011/09/11 15:34:53.0375 2780 MSPCLOCK (52e59b7e992a58e740aa63f57edbae8b) C:\Windows\system32\drivers\MSPCLOCK.sys 2011/09/11 15:34:53.0396 2780 MSPQM (49084a75bae043ae02d5b44d02991bb2) C:\Windows\system32\drivers\MSPQM.sys 2011/09/11 15:34:53.0435 2780 MsRPC (dc6ccf440cdede4293db41c37a5060a5) C:\Windows\system32\drivers\MsRPC.sys 2011/09/11 15:34:53.0459 2780 mssmbios (855796e59df77ea93af46f20155bf55b) C:\Windows\system32\DRIVERS\mssmbios.sys 2011/09/11 15:34:53.0476 2780 MSTEE (86d632d75d05d5b7c7c043fa3564ae86) C:\Windows\system32\drivers\MSTEE.sys 2011/09/11 15:34:53.0501 2780 Mup (0cc49f78d8aca0877d885f149084e543) C:\Windows\system32\Drivers\mup.sys 2011/09/11 15:34:53.0551 2780 NativeWifiP (2007b826c4acd94ae32232b41f0842b9) C:\Windows\system32\DRIVERS\nwifi.sys 2011/09/11 15:34:53.0811 2780 NAVENG (2dbe90210de76be6e1653bb20ec70ec2) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110910.002\ENG64.SYS 2011/09/11 15:34:53.0940 2780 NAVEX15 (346da70e203b8e2c850277713de8f71b) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110910.002\EX64.SYS 2011/09/11 15:34:54.0055 2780 NDIS (65950e07329fcee8e6516b17c8d0abb6) C:\Windows\system32\drivers\ndis.sys 2011/09/11 15:34:54.0102 2780 NdisTapi (64df698a425478e321981431ac171334) C:\Windows\system32\DRIVERS\ndistapi.sys 2011/09/11 15:34:54.0125 2780 Ndisuio (8baa43196d7b5bb972c9a6b2bbf61a19) C:\Windows\system32\DRIVERS\ndisuio.sys 2011/09/11 15:34:54.0193 2780 NdisWan (f8158771905260982ce724076419ef19) C:\Windows\system32\DRIVERS\ndiswan.sys 2011/09/11 15:34:54.0210 2780 NDProxy (9cb77ed7cb72850253e973a2d6afdf49) C:\Windows\system32\drivers\NDProxy.sys 2011/09/11 15:34:54.0250 2780 NetBIOS (a499294f5029a7862adc115bda7371ce) C:\Windows\system32\DRIVERS\netbios.sys 2011/09/11 15:34:54.0287 2780 netbt (fc2c792ebddc8e28df939d6a92c83d61) C:\Windows\system32\DRIVERS\netbt.sys 2011/09/11 15:34:54.0334 2780 nfrd960 (4ac08bd6af2df42e0c3196d826c8aea7) C:\Windows\system32\drivers\nfrd960.sys 2011/09/11 15:34:54.0409 2780 Npfs (b298874f8e0ea93f06ec40aa8d146478) C:\Windows\system32\drivers\Npfs.sys 2011/09/11 15:34:54.0426 2780 nsiproxy (1523af19ee8b030ba682f7a53537eaeb) C:\Windows\system32\drivers\nsiproxy.sys 2011/09/11 15:34:54.0513 2780 Ntfs (bac869dfb98e499ba4d9bb1fb43270e1) C:\Windows\system32\drivers\Ntfs.sys 2011/09/11 15:34:54.0562 2780 Null (dd5d684975352b85b52e3fd5347c20cb) C:\Windows\system32\drivers\Null.sys 2011/09/11 15:34:54.0650 2780 NVENETFD (99ed33f7fe39026a477893d92aea5ef0) C:\Windows\system32\DRIVERS\nvmfdx64.sys 2011/09/11 15:34:56.0748 2780 nvlddmkm (e55cab397f77d5208db18a78b1b7c0d5) C:\Windows\system32\DRIVERS\nvlddmkm.sys 2011/09/11 15:34:57.0084 2780 nvraid (2c040b7ada5b06f6facadac8514aa034) C:\Windows\system32\drivers\nvraid.sys 2011/09/11 15:34:57.0125 2780 nvstor (f7ea0fe82842d05eda3efdd376dbfdba) C:\Windows\system32\drivers\nvstor.sys 2011/09/11 15:34:57.0156 2780 nvstor64 (d1f5dcf8d5a55c0fbbfb49c0ed1f2f5d) C:\Windows\system32\DRIVERS\nvstor64.sys 2011/09/11 15:34:57.0187 2780 nv_agp (19067ca93075ef4823e3938a686f532f) C:\Windows\system32\drivers\nv_agp.sys 2011/09/11 15:34:57.0302 2780 ohci1394 (b5b1ce65ac15bbd11c0619e3ef7cfc28) C:\Windows\system32\DRIVERS\ohci1394.sys 2011/09/11 15:34:57.0333 2780 Parport (aecd57f94c887f58919f307c35498ea0) C:\Windows\system32\drivers\parport.sys 2011/09/11 15:34:57.0366 2780 partmgr (f9b5eda4c17a2be7663f064dbf0fe254) C:\Windows\system32\drivers\partmgr.sys 2011/09/11 15:34:57.0390 2780 pci (47ab1e0fc9d0e12bb53ba246e3a0906d) C:\Windows\system32\drivers\pci.sys 2011/09/11 15:34:57.0420 2780 pciide (2657f6c0b78c36d95034be109336e382) C:\Windows\system32\drivers\pciide.sys 2011/09/11 15:34:57.0490 2780 pcmcia (037661f3d7c507c9993b7010ceee6288) C:\Windows\system32\drivers\pcmcia.sys 2011/09/11 15:34:57.0544 2780 PEAUTH (58865916f53592a61549b04941bfd80d) C:\Windows\system32\drivers\peauth.sys 2011/09/11 15:34:57.0657 2780 PptpMiniport (23386e9952025f5f21c368971e2e7301) C:\Windows\system32\DRIVERS\raspptp.sys 2011/09/11 15:34:57.0686 2780 Processor (5080e59ecee0bc923f14018803aa7a01) C:\Windows\system32\drivers\processr.sys 2011/09/11 15:34:57.0722 2780 PSched (c5ab7f0809392d0da027f4a2a81bfa31) C:\Windows\system32\DRIVERS\pacer.sys 2011/09/11 15:34:57.0749 2780 PxHlpa64 (a6bf0a9b5a30d743623ca0d3be35df05) C:\Windows\system32\Drivers\PxHlpa64.sys 2011/09/11 15:34:57.0825 2780 ql2300 (0b83f4e681062f3839be2ec1d98fd94a) C:\Windows\system32\drivers\ql2300.sys 2011/09/11 15:34:57.0916 2780 ql40xx (e1c80f8d4d1e39ef9595809c1369bf2a) C:\Windows\system32\drivers\ql40xx.sys 2011/09/11 15:34:57.0941 2780 QWAVEdrv (e8d76edab77ec9c634c27b8eac33adc5) C:\Windows\system32\drivers\qwavedrv.sys 2011/09/11 15:34:57.0953 2780 RasAcd (1013b3b663a56d3ddd784f581c1bd005) C:\Windows\system32\DRIVERS\rasacd.sys 2011/09/11 15:34:57.0991 2780 Rasl2tp (ac7bc4d42a7e558718dfdec599bbfc2c) C:\Windows\system32\DRIVERS\rasl2tp.sys 2011/09/11 15:34:58.0034 2780 RasPppoe (4517fbf8b42524afe4ede1de102aae3e) C:\Windows\system32\DRIVERS\raspppoe.sys 2011/09/11 15:34:58.0063 2780 RasSstp (c6a593b51f34c33e5474539544072527) C:\Windows\system32\DRIVERS\rassstp.sys 2011/09/11 15:34:58.0119 2780 rdbss (322db5c6b55e8d8ee8d6f358b2aaabb1) C:\Windows\system32\DRIVERS\rdbss.sys 2011/09/11 15:34:58.0152 2780 RDPCDD (603900cc05f6be65ccbf373800af3716) C:\Windows\system32\DRIVERS\RDPCDD.sys 2011/09/11 15:34:58.0198 2780 rdpdr (c045d1fb111c28df0d1be8d4bda22c06) C:\Windows\system32\drivers\rdpdr.sys 2011/09/11 15:34:58.0213 2780 RDPENCDD (cab9421daf3d97b33d0d055858e2c3ab) C:\Windows\system32\drivers\rdpencdd.sys 2011/09/11 15:34:58.0265 2780 RDPWD (b1d741c87cea8d7282146366cc9c3f81) C:\Windows\system32\drivers\RDPWD.sys 2011/09/11 15:34:58.0311 2780 rspndr (22a9cb08b1a6707c1550c6bf099aae73) C:\Windows\system32\DRIVERS\rspndr.sys 2011/09/11 15:34:58.0336 2780 sbp2port (cd9c693589c60ad59bbbcfb0e524e01b) C:\Windows\system32\drivers\sbp2port.sys 2011/09/11 15:34:58.0399 2780 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 2011/09/11 15:34:58.0438 2780 Serenum (f71bfe7ac6c52273b7c82cbf1bb2a222) C:\Windows\system32\drivers\serenum.sys 2011/09/11 15:34:58.0462 2780 Serial (e62fac91ee288db29a9696a9d279929c) C:\Windows\system32\drivers\serial.sys 2011/09/11 15:34:58.0487 2780 sermouse (a842f04833684bceea7336211be478df) C:\Windows\system32\drivers\sermouse.sys 2011/09/11 15:34:58.0526 2780 sffdisk (14d4b4465193a87c127933978e8c4106) C:\Windows\system32\drivers\sffdisk.sys 2011/09/11 15:34:58.0552 2780 sffp_mmc (7073aee3f82f3d598e3825962aa98ab2) C:\Windows\system32\drivers\sffp_mmc.sys 2011/09/11 15:34:58.0579 2780 sffp_sd (35e59ebe4a01a0532ed67975161c7b82) C:\Windows\system32\drivers\sffp_sd.sys 2011/09/11 15:34:58.0605 2780 sfloppy (6b7838c94135768bd455cbdc23e39e5f) C:\Windows\system32\drivers\sfloppy.sys 2011/09/11 15:34:58.0637 2780 SiSRaid2 (7a5de502aeb719d4594c6471060a78b3) C:\Windows\system32\drivers\sisraid2.sys 2011/09/11 15:34:58.0662 2780 SiSRaid4 (3a2f769fab9582bc720e11ea1dfb184d) C:\Windows\system32\drivers\sisraid4.sys 2011/09/11 15:34:58.0704 2780 Smb (290b6f6a0ec4fcdfc90f5cb6d7020473) C:\Windows\system32\DRIVERS\smb.sys 2011/09/11 15:34:58.0779 2780 spldr (386c3c63f00a7040c7ec5e384217e89d) C:\Windows\system32\drivers\spldr.sys 2011/09/11 15:34:58.0862 2780 SRTSP (90ef30c3867bcde4579c01a6d6e75a7a) C:\Windows\System32\Drivers\NISx64\1206000.01D\SRTSP64.SYS 2011/09/11 15:34:58.0890 2780 SRTSPX (c513e8a5e7978da49077f5484344ee1b) C:\Windows\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS 2011/09/11 15:34:58.0928 2780 srv (880a57fccb571ebd063d4dd50e93e46d) C:\Windows\system32\DRIVERS\srv.sys 2011/09/11 15:34:58.0972 2780 srv2 (a1ad14a6d7a37891fffeca35ebbb0730) C:\Windows\system32\DRIVERS\srv2.sys 2011/09/11 15:34:59.0013 2780 srvnet (4bed62f4fa4d8300973f1151f4c4d8a7) C:\Windows\system32\DRIVERS\srvnet.sys 2011/09/11 15:34:59.0064 2780 swenum (8a851ca908b8b974f89c50d2e18d4f0c) C:\Windows\system32\DRIVERS\swenum.sys 2011/09/11 15:34:59.0096 2780 Symc8xx (2f26a2c6fc96b29beff5d8ed74e6625b) C:\Windows\system32\drivers\symc8xx.sys 2011/09/11 15:34:59.0341 2780 SymDS (6160145c7a87fc7672e8e3b886888176) C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS 2011/09/11 15:34:59.0396 2780 SymEFA (96aeed40d4d3521568b42027687e69e0) C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS 2011/09/11 15:34:59.0452 2780 SymEvent (21a1c2d694c3cf962d31f5e873ab3d6f) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS 2011/09/11 15:34:59.0492 2780 SymIM (3aa3b2df451da88c38ab00b19fa3562e) C:\Windows\system32\DRIVERS\SymIMv.sys 2011/09/11 15:34:59.0570 2780 SymIRON (bd0d711d8cbfcaa19ca123306eaf53a5) C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS 2011/09/11 15:34:59.0630 2780 SYMTDIv (6cb70a5d30e4322bab4ad52866b0a4b8) C:\Windows\System32\Drivers\NISx64\1206000.01D\SYMTDIV.SYS 2011/09/11 15:34:59.0668 2780 Sym_hi (a909667976d3bccd1df813fed517d837) C:\Windows\system32\drivers\sym_hi.sys 2011/09/11 15:34:59.0684 2780 Sym_u3 (36887b56ec2d98b9c362f6ae4de5b7b0) C:\Windows\system32\drivers\sym_u3.sys 2011/09/11 15:34:59.0756 2780 Tcpip (4dad14118fbcf7c609f2a4ce21fbcc5f) C:\Windows\system32\drivers\tcpip.sys 2011/09/11 15:34:59.0830 2780 Tcpip6 (4dad14118fbcf7c609f2a4ce21fbcc5f) C:\Windows\system32\DRIVERS\tcpip.sys 2011/09/11 15:34:59.0936 2780 tcpipreg (c7e72a4071ee0200e3c075dacfb2b334) C:\Windows\system32\drivers\tcpipreg.sys 2011/09/11 15:34:59.0985 2780 TDPIPE (1d8bf4aaa5fb7a2761475781dc1195bc) C:\Windows\system32\drivers\tdpipe.sys 2011/09/11 15:35:00.0011 2780 TDTCP (7f7e00cdf609df657f4cda02dd1c9bb1) C:\Windows\system32\drivers\tdtcp.sys 2011/09/11 15:35:00.0049 2780 tdx (458919c8c42e398dc4802178d5ffee27) C:\Windows\system32\DRIVERS\tdx.sys 2011/09/11 15:35:00.0073 2780 TermDD (8c19678d22649ec002ef2282eae92f98) C:\Windows\system32\DRIVERS\termdd.sys 2011/09/11 15:35:00.0124 2780 tssecsrv (9e5409cd17c8bef193aad498f3bc2cb8) C:\Windows\system32\DRIVERS\tssecsrv.sys 2011/09/11 15:35:00.0145 2780 tunmp (89ec74a9e602d16a75a4170511029b3c) C:\Windows\system32\DRIVERS\tunmp.sys 2011/09/11 15:35:00.0176 2780 tunnel (30a9b3f45ad081bffc3bcaa9c812b609) C:\Windows\system32\DRIVERS\tunnel.sys 2011/09/11 15:35:00.0202 2780 uagp35 (fec266ef401966311744bd0f359f7f56) C:\Windows\system32\drivers\uagp35.sys 2011/09/11 15:35:00.0242 2780 udfs (faf2640a2a76ed03d449e443194c4c34) C:\Windows\system32\DRIVERS\udfs.sys 2011/09/11 15:35:00.0287 2780 uliagpkx (4ec9447ac3ab462647f60e547208ca00) C:\Windows\system32\drivers\uliagpkx.sys 2011/09/11 15:35:00.0325 2780 uliahci (697f0446134cdc8f99e69306184fbbb4) C:\Windows\system32\drivers\uliahci.sys 2011/09/11 15:35:00.0357 2780 UlSata (31707f09846056651ea2c37858f5ddb0) C:\Windows\system32\drivers\ulsata.sys 2011/09/11 15:35:00.0390 2780 ulsata2 (85e5e43ed5b48c8376281bab519271b7) C:\Windows\system32\drivers\ulsata2.sys 2011/09/11 15:35:00.0419 2780 umbus (46e9a994c4fed537dd951f60b86ad3f4) C:\Windows\system32\DRIVERS\umbus.sys 2011/09/11 15:35:00.0500 2780 usbccgp (07e3498fc60834219d2356293da0fecc) C:\Windows\system32\DRIVERS\usbccgp.sys 2011/09/11 15:35:00.0547 2780 usbcir (9247f7e0b65852c1f6631480984d6ed2) C:\Windows\system32\drivers\usbcir.sys 2011/09/11 15:35:00.0596 2780 usbehci (827e44de934a736ea31e91d353eb126f) C:\Windows\system32\DRIVERS\usbehci.sys 2011/09/11 15:35:00.0625 2780 usbhub (bb35cd80a2ececfadc73569b3d70c7d1) C:\Windows\system32\DRIVERS\usbhub.sys 2011/09/11 15:35:00.0653 2780 usbohci (e406b003a354776d317762694956b0fc) C:\Windows\system32\DRIVERS\usbohci.sys 2011/09/11 15:35:00.0676 2780 usbprint (28b693b6d31e7b9332c1bdcefef228c1) C:\Windows\system32\DRIVERS\usbprint.sys 2011/09/11 15:35:00.0719 2780 usbscan (ea0bf666868964fbe8cb10e50c97b9f1) C:\Windows\system32\DRIVERS\usbscan.sys 2011/09/11 15:35:00.0748 2780 USBSTOR (b854c1558fca0c269a38663e8b59b581) C:\Windows\system32\DRIVERS\USBSTOR.SYS 2011/09/11 15:35:00.0795 2780 usbuhci (b2872cbf9f47316abd0e0c74a1aba507) C:\Windows\system32\DRIVERS\usbuhci.sys 2011/09/11 15:35:00.0840 2780 vga (916b94bcf1e09873fff2d5fb11767bbc) C:\Windows\system32\DRIVERS\vgapnp.sys 2011/09/11 15:35:00.0853 2780 VgaSave (b83ab16b51feda65dd81b8c59d114d63) C:\Windows\System32\drivers\vga.sys 2011/09/11 15:35:00.0881 2780 viaide (8294b6c3fdb6c33f24e150de647ecdaa) C:\Windows\system32\drivers\viaide.sys 2011/09/11 15:35:00.0902 2780 volmgr (2b7e885ed951519a12c450d24535dfca) C:\Windows\system32\drivers\volmgr.sys 2011/09/11 15:35:00.0940 2780 volmgrx (cec5ac15277d75d9e5dec2e1c6eaf877) C:\Windows\system32\drivers\volmgrx.sys 2011/09/11 15:35:00.0966 2780 volsnap (5280aada24ab36b01a84a6424c475c8d) C:\Windows\system32\drivers\volsnap.sys 2011/09/11 15:35:00.0990 2780 vsmraid (a68f455ed2673835209318dd61bfbb0e) C:\Windows\system32\drivers\vsmraid.sys 2011/09/11 15:35:01.0027 2780 WacomPen (fef8fe5923fead2cee4dfabfce3393a7) C:\Windows\system32\drivers\wacompen.sys 2011/09/11 15:35:01.0073 2780 Wanarp (b8e7049622300d20ba6d8be0c47c0cfd) C:\Windows\system32\DRIVERS\wanarp.sys 2011/09/11 15:35:01.0084 2780 Wanarpv6 (b8e7049622300d20ba6d8be0c47c0cfd) C:\Windows\system32\DRIVERS\wanarp.sys 2011/09/11 15:35:01.0117 2780 Wd (0c17a0816f65b89e362e682ad5e7266e) C:\Windows\system32\drivers\wd.sys 2011/09/11 15:35:01.0155 2780 Wdf01000 (d02e7e4567da1e7582fbf6a91144b0df) C:\Windows\system32\drivers\Wdf01000.sys 2011/09/11 15:35:01.0298 2780 WmiAcpi (e18aebaaa5a773fe11aa2c70f65320f5) C:\Windows\system32\DRIVERS\wmiacpi.sys 2011/09/11 15:35:01.0370 2780 ws2ifsl (8a900348370e359b6bff6a550e4649e1) C:\Windows\system32\drivers\ws2ifsl.sys 2011/09/11 15:35:01.0425 2780 WUDFRd (501a65252617b495c0f1832f908d54d8) C:\Windows\system32\DRIVERS\WUDFRd.sys 2011/09/11 15:35:01.0466 2780 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 2011/09/11 15:35:01.0787 2780 Boot (0x1200) (01b51880f5a5a98d16fd8cfb83345c50) \Device\Harddisk0\DR0\Partition0 2011/09/11 15:35:01.0833 2780 Boot (0x1200) (d2b8d5be4702041d169a13f63f1cb264) \Device\Harddisk0\DR0\Partition1 2011/09/11 15:35:01.0837 2780 ================================================================================ 2011/09/11 15:35:01.0839 2780 Scan finished 2011/09/11 15:35:01.0839 2780 ================================================================================ 2011/09/11 15:35:01.0851 3804 Detected object count: 0 2011/09/11 15:35:01.0852 3804 Actual detected object count: 0 |
|
11.09.2011, 15:13
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | searchqu.com/413 Dann bitte jetzt CF ausführen:
__________________ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ |
|
11.09.2011, 17:27
| #19 |
| | searchqu.com/413 Hallo Arne, das mit Combofix hat nicht so ganz funktioniert. Beim ersten mal hat er sich bei der Melundung "Fertiggestellt Stufe_4" aufgehängt. Nach einer Stunde habe ich dann das Programm beendet und den Computer neu gestartet. Danach lief das Programm normal durch. Hier das Log: Combofix Logfile: Code:
ATTFilter ComboFix 11-09-11.02 - Frank 11.09.2011 18:01:58.2.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.4093.2600 [GMT 2:00]
ausgeführt von:: e:\desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\acer\Preload\Autorun\DRV\Pro-Nets Modem HPI56M3\_desktop.ini
c:\acer\Preload\Autorun\DRV\Pro-Nets Modem HPI56M3\98\_desktop.ini
c:\acer\Preload\Autorun\DRV\Pro-Nets Modem HPI56M3\ME\_desktop.ini
c:\acer\Preload\Autorun\DRV\Pro-Nets Modem HPI56M3\VISTAXP2K\_desktop.ini
c:\acer\Preload\Autorun\DRV\Pro-Nets Modem HPI56M3\VISTAXP2K\amd64\_desktop.ini
c:\acer\Preload\Autorun\DRV\Pro-Nets Modem HPI56M3\VISTAXP2K\x86\_desktop.ini
c:\program files (x86)\Windows Searchqu Toolbar
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\BrowserConnection.dll
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\datamngr.dll
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\DnsBHO.dll
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\chrome.manifest
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\chrome.manifest.alt
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\components\DataMngrHlp.dll
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\components\DataMngrHlp.xpt
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\components\DataMngrHlpFF3.dll
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content\DnsBHO.js
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content\Error404BHO.js
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content\NewTabBHO.js
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content\overlay.js
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content\overlay.xul
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content\RelatedSearch.js
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content\SearchBHO.js
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content\SettingManager.js
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content\Settings.xml
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content\Settings.xml.alt
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\install.rdf
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\install.rdf.alt
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\IEBHO.dll
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\x64\datamngr.dll
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\x64\datamngrUI.exe
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\x64\DnsBHO.dll
c:\program files (x86)\Windows Searchqu Toolbar\Datamngr\x64\IEBHO.dll
c:\program files (x86)\Windows Searchqu Toolbar\del_DataMngrHlp_73.dll
c:\program files (x86)\Windows Searchqu Toolbar\del_DM_DLL_53.dll
c:\program files (x86)\Windows Searchqu Toolbar\del_DM_DLL_97.dll
c:\program files (x86)\Windows Searchqu Toolbar\del_DM_EXE_42.dll
c:\program files (x86)\Windows Searchqu Toolbar\del_DM_EXE_77.dll
c:\program files (x86)\Windows Searchqu Toolbar\del_IEBHO_1.dll
c:\program files (x86)\Windows Searchqu Toolbar\del_IEBHO_48.dll
c:\program files (x86)\Windows Searchqu Toolbar\uninstall.exe
c:\windows\IsUn0407.exe
c:\windows\system32\Install.cmd
E:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-08-11 bis 2011-09-11 ))))))))))))))))))))))))))))))
.
.
2011-09-11 16:13 . 2011-09-11 16:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-09 20:16 . 2011-09-09 20:16 -------- d-----w- c:\program files (x86)\ESET
2011-09-09 13:36 . 2011-09-09 13:36 -------- d-----w- c:\users\Frank\AppData\Roaming\Malwarebytes
2011-09-09 13:36 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-09-09 13:36 . 2011-09-09 13:36 -------- d-----w- c:\programdata\Malwarebytes
2011-09-09 13:36 . 2011-09-09 13:36 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-09-09 13:36 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-24 03:02 . 2011-07-11 13:45 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-24 03:02 . 2011-07-11 13:25 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-21 19:06 . 2011-08-21 19:06 -------- d-----w- c:\windows\Profiles
2011-08-16 22:51 . 2011-09-07 18:55 134104 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2011-08-16 22:51 . 2011-09-07 18:55 89048 ----a-w- c:\program files (x86)\Mozilla Firefox\libEGL.dll
2011-08-16 22:51 . 2011-09-07 18:55 785368 ----a-w- c:\program files (x86)\Mozilla Firefox\mozsqlite3.dll
2011-08-16 22:51 . 2011-09-07 18:55 478168 ----a-w- c:\program files (x86)\Mozilla Firefox\libGLESv2.dll
2011-08-16 22:51 . 2011-09-07 18:55 1846232 ----a-w- c:\program files (x86)\Mozilla Firefox\mozjs.dll
2011-08-16 22:51 . 2011-09-07 18:55 15832 ----a-w- c:\program files (x86)\Mozilla Firefox\mozalloc.dll
2011-08-16 22:51 . 2011-08-12 03:15 2106216 ----a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll
2011-08-16 22:51 . 2011-08-12 03:15 1998168 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dx9_43.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-05 13:59 . 2009-06-20 15:42 307200 ----a-w- c:\windows\SysWow64\TubeFinder.exe
2011-07-22 05:42 . 2011-08-10 07:09 2303488 ----a-w- c:\windows\system32\jscript9.dll
2011-07-22 05:36 . 2011-08-10 07:09 1389056 ----a-w- c:\windows\system32\wininet.dll
2011-07-22 05:32 . 2011-08-10 07:09 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-07-22 02:54 . 2011-08-10 07:09 1797632 ----a-w- c:\windows\SysWow64\jscript9.dll
2011-07-22 02:48 . 2011-08-10 07:09 1126912 ----a-w- c:\windows\SysWow64\wininet.dll
2011-07-22 02:44 . 2011-08-10 07:09 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-07-06 15:49 . 2011-08-10 05:11 275456 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-29 17:09 . 2011-06-29 17:09 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-20 08:45 . 2011-08-10 05:11 4699536 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-06-17 20:14 . 2011-08-10 05:11 1427344 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-17 16:16 . 2011-08-10 05:12 451072 ----a-w- c:\windows\system32\winsrv.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\program files\PACKARD BELL\SetUpMyPC\SmpSys.exe" [2008-07-07 1038136]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-15 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\program files\Packard Bell\SetupMyPC\SmpSys.exe" [2008-07-07 1038136]
"ScreenManager Pro for LCD"="c:\program files (x86)\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe" [2008-06-05 11932968]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"CHotkey"="mHotkey.exe" [2002-07-05 491008]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-10 417792]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
TMMonitor.lnk - c:\program files (x86)\ArcSoft\TotalMedia 3\TMMonitor.exe [2010-10-27 258048]
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files (x86)\WISO\Steuersoftware 2011\mshaktuell.exe [2011-8-26 1302640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-25 133104]
R2 upixp_ths-dammy;Intrexx Portal ths-dammy;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 B-Service;B-Service;c:\users\Frank\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LP6II3WH\B-Service.exe [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-25 133104]
R3 upixderby;Intrexx Derby Database Server;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixp_intrexx;Intrexx Portal Intrexx;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixp_schulportal;Intrexx Portal Schulportal;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixp_ths-20100614;Intrexx Portal THS-20100614;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixsmtp;Intrexx Mail-Service;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixsupervisor;Intrexx Supervisor;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixtomcat;Intrexx Tomcat Servlet Container;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110901.001\BHDrvx64.sys [2011-09-02 1151096]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110909.030\IDSvia64.sys [2011-08-22 488568]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [x]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NISx64\1206000.01D\SYMTDIV.SYS [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 ETService;Empowering Technology Service;c:\program files\Packard Bell\Packard Bell Recovery Management\Service\ETService.exe [2008-07-16 24576]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 27648]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-07-28 136824]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-15 15:13]
.
2011-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-25 15:14]
.
2011-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-25 15:14]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RAVCpl64.exe" [2008-04-24 6242816]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"FujiKeyboard"="c:\acer\Preload\Autorun\DRV\FUJI Keyboard\ABoard.exe" [2008-09-18 79416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.searchqu.com/413
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0409&m=imedia_d4660_ge
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Bild in &Microsoft PhotoDraw öffnen - c:\progra~2\MICROS~1\Office\1031\phdintl.dll/phdContext.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: Interfaces\{B972FB11-0AEF-40C5-925A-6A9EC110583A}: NameServer = 192.168.178.1
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\2p7h9n0e.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{9D717F81-9148-4f12-8568-69135F087DB0} - c:\progra~2\WI9130~1\Datamngr\x64\BROWSE~1.DLL
HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe
AddRemove-Searchqu 0 MediaBar - c:\program files (x86)\Windows Searchqu Toolbar\uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\windows\system32\HidService.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\SysWOW64\IoctlSvc.exe
c:\windows\SysWOW64\DllHost.exe
c:\windows\mHotkey.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-09-11 18:19:38 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2011-09-11 16:19
.
Vor Suchlauf: 7 Verzeichnis(se), 262.553.219.072 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 262.302.212.096 Bytes frei
.
- - End Of File - - 0FD28A3E8AABE8D5163362CA06B485B4
|
|
11.09.2011, 17:48
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | searchqu.com/413 Combofix - Scripten 1. Starte das Notepad (Start / Ausführen / notepad[Enter]) 2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein. Code:
ATTFilter Driver::
B-Service
Folder::
c:\users\Frank\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LP6II3WH
4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall. (Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !) 5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.  6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien: Combofix.txt Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.09.2011, 18:57
| #21 |
| | searchqu.com/413 Hallo Arne, irgendwie scheint mich Dein Programm Combofix nicht zu mögen. Es hat sich wieder bei "Fertiggestellt Stufe_4" aufgehängt. Nachdem ich das Programm wieder beendet und das System neu gestartet habe, bin ich wie von Dir beschrieben vorgegangen. Dabei meldete Combofix aber plötzlich, dass es aktualisiert werden muss und hat sich neue Daten heruntergeladen und selbständig neu gestartet. Ob dabei die erstellte Textdatei berücksichtigt wurde, weiß ich nicht. Anbei die Log: Combofix Logfile: Code:
ATTFilter ComboFix 11-09-11.04 - Frank 11.09.2011 19:35:56.4.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.4093.2716 [GMT 2:00]
ausgeführt von:: e:\desktop\ComboFix.exe
Benutzte Befehlsschalter :: e:\desktop\CFScript.txt
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_B-Service
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-08-11 bis 2011-09-11 ))))))))))))))))))))))))))))))
.
.
2011-09-11 17:44 . 2011-09-11 17:46 -------- d-----w- c:\users\Frank\AppData\Local\temp
2011-09-09 20:16 . 2011-09-09 20:16 -------- d-----w- c:\program files (x86)\ESET
2011-09-09 13:36 . 2011-09-09 13:36 -------- d-----w- c:\users\Frank\AppData\Roaming\Malwarebytes
2011-09-09 13:36 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-09-09 13:36 . 2011-09-09 13:36 -------- d-----w- c:\programdata\Malwarebytes
2011-09-09 13:36 . 2011-09-09 13:36 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-09-09 13:36 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-24 03:02 . 2011-07-11 13:45 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-24 03:02 . 2011-07-11 13:25 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-08-21 19:06 . 2011-08-21 19:06 -------- d-----w- c:\windows\Profiles
2011-08-16 22:51 . 2011-09-07 18:55 134104 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2011-08-16 22:51 . 2011-09-07 18:55 89048 ----a-w- c:\program files (x86)\Mozilla Firefox\libEGL.dll
2011-08-16 22:51 . 2011-09-07 18:55 785368 ----a-w- c:\program files (x86)\Mozilla Firefox\mozsqlite3.dll
2011-08-16 22:51 . 2011-09-07 18:55 478168 ----a-w- c:\program files (x86)\Mozilla Firefox\libGLESv2.dll
2011-08-16 22:51 . 2011-09-07 18:55 1846232 ----a-w- c:\program files (x86)\Mozilla Firefox\mozjs.dll
2011-08-16 22:51 . 2011-09-07 18:55 15832 ----a-w- c:\program files (x86)\Mozilla Firefox\mozalloc.dll
2011-08-16 22:51 . 2011-08-12 03:15 2106216 ----a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll
2011-08-16 22:51 . 2011-08-12 03:15 1998168 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dx9_43.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-05 13:59 . 2009-06-20 15:42 307200 ----a-w- c:\windows\SysWow64\TubeFinder.exe
2011-07-22 05:42 . 2011-08-10 07:09 2303488 ----a-w- c:\windows\system32\jscript9.dll
2011-07-22 05:36 . 2011-08-10 07:09 1389056 ----a-w- c:\windows\system32\wininet.dll
2011-07-22 05:32 . 2011-08-10 07:09 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-07-22 02:54 . 2011-08-10 07:09 1797632 ----a-w- c:\windows\SysWow64\jscript9.dll
2011-07-22 02:48 . 2011-08-10 07:09 1126912 ----a-w- c:\windows\SysWow64\wininet.dll
2011-07-22 02:44 . 2011-08-10 07:09 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-07-06 15:49 . 2011-08-10 05:11 275456 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-29 17:09 . 2011-06-29 17:09 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-20 08:45 . 2011-08-10 05:11 4699536 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-06-17 20:14 . 2011-08-10 05:11 1427344 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-17 16:16 . 2011-08-10 05:12 451072 ----a-w- c:\windows\system32\winsrv.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-11_16.15.04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 02:23 . 2011-09-11 17:27 73234 c:\windows\system32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 15:45 . 2011-09-11 17:27 82784 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-06-15 15:10 . 2011-09-11 17:27 21956 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1343298961-2414088223-1823932274-1000_UserData.bin
- 2009-06-15 15:02 . 2011-09-11 16:14 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-06-15 15:02 . 2011-09-11 17:46 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-06-15 15:02 . 2011-09-11 16:14 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-06-15 15:02 . 2011-09-11 17:46 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-06-15 15:02 . 2011-09-11 16:14 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-06-15 15:02 . 2011-09-11 17:46 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-09-11 13:58 . 2011-09-11 13:58 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2011-09-11 16:36 . 2011-09-11 16:36 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
- 2011-09-11 16:14 . 2011-09-11 16:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-09-11 17:45 . 2011-09-11 17:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-09-11 16:14 . 2011-09-11 16:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-09-11 17:45 . 2011-09-11 17:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 12:46 . 2011-09-11 17:32 595798 c:\windows\system32\perfh009.dat
- 2006-11-02 12:46 . 2011-09-11 16:01 595798 c:\windows\system32\perfh009.dat
- 2008-01-21 11:09 . 2011-09-11 16:01 628504 c:\windows\system32\perfh007.dat
+ 2008-01-21 11:09 . 2011-09-11 17:32 628504 c:\windows\system32\perfh007.dat
+ 2006-11-02 12:46 . 2011-09-11 17:32 103872 c:\windows\system32\perfc009.dat
- 2006-11-02 12:46 . 2011-09-11 16:01 103872 c:\windows\system32\perfc009.dat
+ 2008-01-21 11:09 . 2011-09-11 17:32 126248 c:\windows\system32\perfc007.dat
- 2008-01-21 11:09 . 2011-09-11 16:01 126248 c:\windows\system32\perfc007.dat
- 2009-06-15 17:43 . 2011-09-11 16:14 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-06-15 17:43 . 2011-09-11 17:46 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2011-02-10 16:16 . 2011-09-11 17:44 393364 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-02-10 16:16 . 2011-09-11 16:13 393364 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-05-10 13:34 . 2011-09-11 17:44 16412328 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1343298961-2414088223-1823932274-1000-8192.dat
- 2011-05-10 13:34 . 2011-09-11 16:13 16412328 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1343298961-2414088223-1823932274-1000-8192.dat
+ 2011-05-10 12:27 . 2011-09-11 17:24 12579024 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1343298961-2414088223-1823932274-1000-4096.dat
- 2011-05-10 12:27 . 2011-09-11 13:46 12579024 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1343298961-2414088223-1823932274-1000-4096.dat
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\program files\PACKARD BELL\SetUpMyPC\SmpSys.exe" [2008-07-07 1038136]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-15 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\program files\Packard Bell\SetupMyPC\SmpSys.exe" [2008-07-07 1038136]
"ScreenManager Pro for LCD"="c:\program files (x86)\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe" [2008-06-05 11932968]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"CHotkey"="mHotkey.exe" [2002-07-05 491008]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-10 417792]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
TMMonitor.lnk - c:\program files (x86)\ArcSoft\TotalMedia 3\TMMonitor.exe [2010-10-27 258048]
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files (x86)\WISO\Steuersoftware 2011\mshaktuell.exe [2011-8-26 1302640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-25 133104]
R2 upixp_ths-dammy;Intrexx Portal ths-dammy;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-25 133104]
R3 upixderby;Intrexx Derby Database Server;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixp_intrexx;Intrexx Portal Intrexx;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixp_schulportal;Intrexx Portal Schulportal;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixp_ths-20100614;Intrexx Portal THS-20100614;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixsmtp;Intrexx Mail-Service;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixsupervisor;Intrexx Supervisor;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 upixtomcat;Intrexx Tomcat Servlet Container;e:\intrexx\bin\windows\amd64\svcwrapper.exe [2011-01-05 490496]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110901.001\BHDrvx64.sys [2011-09-02 1151096]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110909.030\IDSvia64.sys [2011-08-22 488568]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [x]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NISx64\1206000.01D\SYMTDIV.SYS [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 ETService;Empowering Technology Service;c:\program files\Packard Bell\Packard Bell Recovery Management\Service\ETService.exe [2008-07-16 24576]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 27648]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-07-28 136824]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-15 15:13]
.
2011-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-25 15:14]
.
2011-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-09-25 15:14]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0}]
c:\progra~2\WI9130~1\Datamngr\x64\BROWSE~1.DLL [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RAVCpl64.exe" [2008-04-24 6242816]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"FujiKeyboard"="c:\acer\Preload\Autorun\DRV\FUJI Keyboard\ABoard.exe" [2008-09-18 79416]
"combofix"="c:\combofix\CF22218.3XE" [2008-01-21 363008]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.searchqu.com/413
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp64&d=0409&m=imedia_d4660_ge
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Bild in &Microsoft PhotoDraw öffnen - c:\progra~2\MICROS~1\Office\1031\phdintl.dll/phdContext.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: Interfaces\{B972FB11-0AEF-40C5-925A-6A9EC110583A}: NameServer = 192.168.178.1
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\2p7h9n0e.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - www.google.de
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\windows\system32\HidService.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\SysWOW64\IoctlSvc.exe
c:\windows\SysWOW64\DllHost.exe
c:\acer\Preload\Autorun\DRV\FUJI Keyboard\AOSD.exe
c:\windows\mHotkey.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-09-11 19:51:32 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2011-09-11 17:51
ComboFix2.txt 2011-09-11 16:19
.
Vor Suchlauf: 11 Verzeichnis(se), 262.227.492.864 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 261.819.244.544 Bytes frei
.
- - End Of File - - 8127138EE96FE6FAC88462B6ADC0A904
|
|
11.09.2011, 19:00
| #22 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | searchqu.com/413 Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.09.2011, 20:40
| #23 |
| | searchqu.com/413 Hat funktioniert. Log anbei: aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software Run date: 2011-09-11 20:03:41 ----------------------------- 20:03:41.121 OS Version: Windows x64 6.0.6002 Service Pack 2 20:03:41.121 Number of processors: 2 586 0x170A 20:03:41.122 ComputerName: ARBEITSZIMMER UserName: Frank 20:03:42.385 Initialize success 20:06:05.436 AVAST engine defs: 11091100 20:07:58.225 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000052 20:07:58.228 Disk 0 Vendor: WDC_WD10 01.0 Size: 953869MB BusType: 6 20:08:00.242 Disk 0 MBR read successfully 20:08:00.246 Disk 0 MBR scan 20:08:00.251 Disk 0 Windows XP default MBR code 20:08:00.255 Service scanning 20:08:01.616 Modules scanning 20:08:01.622 Disk 0 trace - called modules: 20:08:01.628 ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys storport.sys hal.dll nvstor64.sys 20:08:01.632 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004a10790] 20:08:01.640 3 CLASSPNP.SYS[fffffa6000fc4c33] -> nt!IofCallDriver -> [0xfffffa8003dfac10] 20:08:01.646 5 acpi.sys[fffffa60008fcfde] -> nt!IofCallDriver -> \Device\00000052[0xfffffa80048e99e0] 20:08:02.532 AVAST engine scan C:\Windows 20:08:06.921 AVAST engine scan C:\Windows\system32 20:09:39.267 AVAST engine scan C:\Windows\system32\drivers 20:09:53.924 AVAST engine scan C:\Users\Frank 21:19:01.035 AVAST engine scan C:\ProgramData 21:24:11.763 Scan finished successfully 21:38:17.652 Disk 0 MBR has been saved successfully to "E:\Desktop\MBR.dat" 21:38:17.663 The log file has been saved successfully to "E:\Desktop\aswMBR.txt" |
|
12.09.2011, 08:58
| #24 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | searchqu.com/413 Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.09.2011, 04:56
| #25 |
| | searchqu.com/413 Guten Morgen Arne, Malwarebytes und SUPERAntiSpyware scheinen etwas gefunden zu haben. Hier die Logs: SuperAntispyware: SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 09/13/2011 at 00:21 AM Application Version : 5.0.1118 Core Rules Database Version : 7677 Trace Rules Database Version: 5489 Scan type : Complete Scan Total Scan Time : 01:30:54 Operating System Information Windows Vista Home Premium 64-bit, Service Pack 2 (Build 6.00.6002) UAC On - Limited User Memory items scanned : 492 Memory threats detected : 0 Registry items scanned : 72937 Registry threats detected : 0 File items scanned : 190756 File threats detected : 481 Trojan.Agent/Gen-Krpytik E:\ALTE_FESTPLATTEN\COMPUTERD\PROGRAMME\MEDIATOR6\INSTALLMAKER\INSTALL.EXE E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\GSTOOLS\GSVIEW\ZLIB32.DLL E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\PROGRAMME\WINRAR\RAR.EXE E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\PROGRAMME\WINRAR\UNINSTALL.EXE E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\PROGRAMME\WINRAR\UNRAR.EXE C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\COMPUTERD\PROGRAMME\MEDIATOR6\INSTALLMAKER\INSTALL.EXE C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\GSTOOLS\GSVIEW\ZLIB32.DLL C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\PROGRAMME\WINRAR\RAR.EXE C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\PROGRAMME\WINRAR\UNINSTALL.EXE C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\PROGRAMME\WINRAR\UNRAR.EXE Adware.Vundo/Variant-X32[Header] E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\SONSTIGES\PROGRAMMIEREN\BORLAND DELPHI 5 ENTERPRISE\RUNIMAGE\DELPHI50\WINDOWS\SYSTEM32\WSIWIN32.DLL C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\SONSTIGES\PROGRAMMIEREN\BORLAND DELPHI 5 ENTERPRISE\RUNIMAGE\DELPHI50\WINDOWS\SYSTEM32\WSIWIN32.DLL Adware.Tracking Cookie E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CLIT14_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CLIT12_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CLIT13_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CLIT9_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CT2_HYPERCOUNT(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@COUNTER12_SEXTRACKER(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@COUNTER13_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@COUNTER14_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@COUNTER3_SEXTRACKER(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@COUNTER9_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CT1_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CT3_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CT4_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@GO2XXX.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@HEKATE_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@HITBOX(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@SEXLIST.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@SEXTRACKER(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@SPYLOG.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@STATS3_PORNTRACK(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@STATS4_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@WINDOWSMEDIA.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@XXXCOUNTER(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\DIETER@ADVERTISING.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\DIETER@DOUBLECLICK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@ADTECH.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@APHRODITE_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@ARTEMIS_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@COUNTER8_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@HITBOX(2).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@SEXLIST.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK@ADSERVER_UGO.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK@ADTECH.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CT3_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@ADTECH(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@ARTEMIS_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CLIT9_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@COUNTER12_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@COUNTER13_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@COUNTER3_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@COUNTER9_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CT1_HYPERCOUNT(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CT2_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CT4_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CT5_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@DOUBLECLICK(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@FORTUNECITY(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@FORTUNECITY(2).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@HITBOX(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@MEDIAPLEX.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@PATHFINDER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@SEXIER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@SEXLIST(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@STATS4_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@WINDOWSMEDIA(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@WWW_COMMISSION-JUNCTION(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CLIT14_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CLIT12_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CLIT13_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CLIT9_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CT2_HYPERCOUNT(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@COUNTER12_SEXTRACKER(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@COUNTER13_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@COUNTER14_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@COUNTER3_SEXTRACKER(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@COUNTER9_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CT1_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CT3_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CT4_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@GO2XXX.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@HEKATE_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@HITBOX(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@SEXLIST.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@SEXTRACKER(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@SPYLOG.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@STATS3_PORNTRACK(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@STATS4_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@WINDOWSMEDIA.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@XXXCOUNTER(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\HELGA@2O7(2).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\HELGA@2O7.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@ADTECH.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@APHRODITE_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@ARTEMIS_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@COUNTER8_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@HITBOX(2).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@SEXLIST.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK@ADSERVER_UGO.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK@ADTECH.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@COUNTER3_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@ADTECH(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@ARTEMIS_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CLIT9_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@COUNTER12_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@COUNTER13_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@HITBOX(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@COUNTER9_SEXTRACKER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CT1_HYPERCOUNT(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CT2_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CT3_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CT4_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CT5_HYPERCOUNT.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@DOUBLECLICK(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@FORTUNECITY(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@FORTUNECITY(2).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@MEDIAPLEX.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@PATHFINDER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@SEXIER.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@SEXLIST(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@STATS4_PORNTRACK.TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@WINDOWSMEDIA(1).TXT E:\ALTE_FESTPLATTEN\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@WWW_COMMISSION-JUNCTION(1).TXT .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .traffictrack.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .gallery.teenpinkvideos.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .gallery.teenpinkvideos.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ero-advertising.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .traffictrack.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .imrworldwide.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .imrworldwide.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] track.effiliation.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.localxfinder.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .teenpinkvideos.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] eas.apm.emediate.eu [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.zanox-affiliate.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] in.getclicky.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .a.revenuemax.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adserver.gs [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .eyewonder.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .eyewonder.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ads.quartermedia.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ads.quartermedia.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .collective-media.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] wstat.wibiya.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] partners.webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] de.sitestat.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .im.banner.t-online.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ad.adnet.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] auslieferung.commindo-media-ressourcen.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adxpose.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adserver2.clipkit.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .mm.chitika.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] eas4.emediate.eu [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ads.quartermedia.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .traffictrack.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] de.sitestat.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] de.sitestat.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .pumpendiscounter.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .pumpendiscounter.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] de.sitestat.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.discounter-archiv.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.discounter-archiv.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.discounter-archiv.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] stat.aldi.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .getclicky.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .static.getclicky.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] auslieferung.commindo-media-ressourcen.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] stats.amrum.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .newsclick.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .newsclick.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] urbia.wwe-media.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] laminat.discounter.ruckzuck.biz [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] laminat.discounter.ruckzuck.biz [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.hwg-media.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] banner.testberichte.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webstats4u.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.trafficjmp.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] ad-dus01.stangermedia.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .click-licht.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .click-licht.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] tracking.tchibo.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] deutsch.bestpornstories.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] live.realtimewebstats.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .unitymedia.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] track.collectoffers.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .lucidmedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] zbox.zanox.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .collective-media.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ads.quartermedia.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .teeniecamgirls.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adx.chip.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .server.cpmstar.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .server.cpmstar.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .server.cpmstar.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .server.cpmstar.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ads.quartermedia.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .xxxlmoebelhaeuser.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .xxxlmoebelhaeuser.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ads.quartermedia.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] tracking.klicktel.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .zieltrack.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adserver.wolterskluwer.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] track.effiliation.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ad.adnet.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .teeniecamgirls.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .tracking.mindshare.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] eas.apm.emediate.eu [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ad.adnet.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adserv.kwick.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adserv.kwick.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .eyewonder.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .eyewonder.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .jaxfreeporn.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .jaxfreeporn.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.active-tracking.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.active-tracking.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.active-tracking.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] tracking.sim-technik.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] eas.apm.emediate.eu [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] de.sitestat.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] de.sitestat.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .verticaltechmedia.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adserver.ip-phone-forum.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adcentriconline.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] ad.adserver01.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] ad1.adfarm1.adition.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] s1.trafficmaxx.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.googleadservices.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .lego.112.2o7.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .media6degrees.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .media6degrees.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .invitemedia.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .mediabrandsww.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] gotacha.rotator.hadj7.adjuggler.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ru4.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .media6degrees.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .media6degrees.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .ru4.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adfarm1.adition.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] ad.adition.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] eas.apm.emediate.eu [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adserver.gunaxin.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adserver.gunaxin.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] accounts.google.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.etracker.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adx.chip.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adx.chip.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] adx.chip.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.mediamarkt.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.etracker.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .collective-media.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .tribalfusion.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .collective-media.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .collective-media.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .collective-media.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .collective-media.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .collective-media.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .kontera.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .bs.serving-sys.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] s0.2mdn.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] ad.zanox.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] s0.2mdn.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] track.adform.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] ad3.adfarm1.adition.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] eas.apm.emediate.eu [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] track.adform.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adform.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] s0.2mdn.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] ad2.adfarm1.adition.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] ad4.adfarm1.adition.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .tracking.quisma.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .content.yieldmanager.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .clickfuse.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .clickfuse.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .clickfuse.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .clickfuse.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] fidelity.rotator.hadj7.adjuggler.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .zanox-affiliate.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] www.zanox-affiliate.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .zanox.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .histats.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .histats.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .insightexpressai.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .insightexpressai.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .im.banner.t-online.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .adtech.de [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .clickfuse.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] ww251.smartadserver.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\FRANK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2P7H9N0E.DEFAULT\COOKIES.SQLITE ] C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CLIT14_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CLIT12_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CLIT13_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CLIT9_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CT2_HYPERCOUNT(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@COUNTER12_SEXTRACKER(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@COUNTER13_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@COUNTER14_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@COUNTER3_SEXTRACKER(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@COUNTER9_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CT1_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CT3_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@CT4_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@GO2XXX.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@HEKATE_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@HITBOX(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@SEXLIST.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@SEXTRACKER(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@SPYLOG.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@STATS3_PORNTRACK(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@STATS4_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@WINDOWSMEDIA.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\102@XXXCOUNTER(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\DIETER@ADVERTISING.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\DIETER@DOUBLECLICK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@ADTECH.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@APHRODITE_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@ARTEMIS_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@COUNTER8_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@HITBOX(2).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK, FRANK@SEXLIST.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK@ADSERVER_UGO.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\RIECK@ADTECH.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CT3_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@ADTECH(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@ARTEMIS_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CLIT9_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@COUNTER12_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@COUNTER13_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@COUNTER3_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@COUNTER9_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CT1_HYPERCOUNT(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CT2_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CT4_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@CT5_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@DOUBLECLICK(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@FORTUNECITY(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@FORTUNECITY(2).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@HITBOX(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@MEDIAPLEX.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@PATHFINDER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@SEXIER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@SEXLIST(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@STATS4_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@WINDOWSMEDIA(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\DIETER\COOKIES\ZI101@WWW_COMMISSION-JUNCTION(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CLIT14_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CLIT12_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CLIT13_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CLIT9_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CT2_HYPERCOUNT(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@COUNTER12_SEXTRACKER(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@COUNTER13_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@COUNTER14_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@COUNTER3_SEXTRACKER(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@COUNTER9_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CT1_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CT3_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@CT4_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@GO2XXX.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@HEKATE_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@HITBOX(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@SEXLIST.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@SEXTRACKER(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@SPYLOG.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@STATS3_PORNTRACK(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@STATS4_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@WINDOWSMEDIA.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\102@XXXCOUNTER(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\HELGA@2O7(2).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\HELGA@2O7.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@ADTECH.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@APHRODITE_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@ARTEMIS_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@COUNTER8_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@HITBOX(2).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK, FRANK@SEXLIST.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK@ADSERVER_UGO.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\RIECK@ADTECH.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@COUNTER3_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@ADTECH(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@ARTEMIS_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CLIT9_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@COUNTER12_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@COUNTER13_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@HITBOX(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@COUNTER9_SEXTRACKER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CT1_HYPERCOUNT(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CT2_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CT3_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CT4_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@CT5_HYPERCOUNT.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@DOUBLECLICK(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@FORTUNECITY(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@FORTUNECITY(2).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@MEDIAPLEX.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@PATHFINDER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@SEXIER.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@SEXLIST(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@STATS4_PORNTRACK.TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@WINDOWSMEDIA(1).TXT C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES\ZI101@WWW_COMMISSION-JUNCTION(1).TXT Und Hier die Log von Malwarebyte: Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Datenbank Version: 7702 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 12.09.2011 22:40:18 mbam-log-2011-09-12 (22-40-07).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Durchsuchte Objekte: 726130 Laufzeit: 1 Stunde(n), 45 Minute(n), 49 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: e:\_OTL\movedfiles\09112011_143644\c_program files (x86)\mozilla firefox\extensions\{b922d405-6d13-4a2b-ae89-08a030da4402}\components\pdfforgetoolbarff.dll (Adware.WidgiToolbar) -> No action taken. Das Onlineprogramm führe ich gleich noch durch... Grüße Frank |
|
13.09.2011, 13:10
| #26 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | searchqu.com/413 Viele Viele Cookies und Müll in alten Backupordner. Prüf das selbst was da weg von kann und was nicht. Ich kann keine fremden Daten beurteilen.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.09.2011, 17:00
| #27 |
| | searchqu.com/413 Hallo Arne, hier noch als Nachtrag das Log vom ESET-Scanner: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=98ce74de2ea46a45b7ad05e0148f8d74 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-10 12:19:34 # local_time=2011-09-10 02:19:34 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=3584 16777215 100 0 0 0 0 0 # compatibility_mode=5892 16776574 100 56 62594311 153123508 0 0 # compatibility_mode=8192 67108863 100 0 220 220 0 0 # scanned=565423 # found=5 # cleaned=0 # scan_time=14372 C:\Users\Frank\XXXXX_Festplatte_alt\Download\Downloads\Setup56_FreeFlvConverter.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I C:\Users\Frank\XXXXX_Festplatte_alt\Video_Konvertiert\Setup_FreeFlvConverter25.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I E:\Dokumente\Noch zuordnen\Video_Konvertiert\Setup_FreeFlvConverter25.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I E:\Download\Setup65_FreeFlvConverter.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I E:\Download\Download-alt\Downloads\Setup56_FreeFlvConverter.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=98ce74de2ea46a45b7ad05e0148f8d74 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-13 08:36:20 # local_time=2011-09-13 10:36:20 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=3584 16777215 100 0 0 0 0 0 # compatibility_mode=5892 16776574 100 56 62881099 153410296 0 0 # compatibility_mode=8192 67108863 100 0 287008 287008 0 0 # scanned=560328 # found=5 # cleaned=0 # scan_time=16589 C:\Users\Frank\XXXXX_Festplatte_alt\Download\Downloads\Setup56_FreeFlvConverter.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I C:\Users\Frank\XXXXX_Festplatte_alt\Video_Konvertiert\Setup_FreeFlvConverter25.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I E:\Dokumente\Noch zuordnen\Video_Konvertiert\Setup_FreeFlvConverter25.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I E:\Download\Setup65_FreeFlvConverter.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I E:\Download\Download-alt\Downloads\Setup56_FreeFlvConverter.exe Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I |
|
13.09.2011, 18:57
| #28 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | searchqu.com/413 Nur ungefährliche Setups. ESET erkennt die, weil die Toolbars transportieren und der bei Standardinstallation auch mitinstallieren. Also immer schon jedes Programm benutzerdefiniert installieren, LESEN LESEN LESEN und Müll wie Toolbars immer abwählen. Rechner ansonsten wieder im Lot?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.09.2011, 21:18
| #29 |
| | searchqu.com/413 Hallo Arne, der Rechner läuft soweit gut - meine PDF Creator hat es wohl irgendwie zerschossen, aber den kann ich einfach noch mal installieren. Wie und mit welchem Programm soll ich vorgehen, um die ganzen Cookies und die Fehlermeldungen aus meinem Backupordner raus zu bekommen? SuperAntiSpamware noch einmal drüber gehen lassen? Grüße Frank |
|
14.09.2011, 11:04
| #30 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | searchqu.com/413 Man kann Ordner auch manuell löschen => C:\USERS\FRANK\XXXXX_FESTPLATTE_ALT\HELGA COMUTERSICHER\WINDOWS\PROFILES\HELGA\COOKIES Nicht für alles braucht es ein Tool. Dann wären wir durch!  Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken. Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden. Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern. Microsoftupdate Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Anleitung Windows-Update PDF-Reader aktualisieren Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast) Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink: Mozilla und andere Browser => http://filepony.de/?q=Flash+Player Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind. Java-Update Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu searchqu.com/413 |
| als startseite, browser, browsern, entferne, entfernen, erscheint, firefox, google, guten, interne, internet, löschen, meldung, morgen, neustart, norton, norton internet security, problem, programm, richtig, searchqu.com/413 in browser, security, seite, spybot, startseite, trojaner |
Linear-Darstellung
