| |
| |||||||
Log-Analyse und Auswertung: TR/Spy.Web.H und windows-virus w32/Indus.A, schwarzer Bildschirm, scheinbar alle Dateien wegWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
26.09.2011, 20:40
| #1 |
| |  TR/Spy.Web.H und windows-virus w32/Indus.A, schwarzer Bildschirm, scheinbar alle Dateien weg Hallo zusammen! Heute bekam ich eine E-Mail von eilservice@deutschepost.de. Da ich tatsächlich etwas erwartete, dachte ich nicht lange nach und öffnete den Anhang. Ganz blöde Idee.Im Anhang war eine Zip-Datei, mit enthaltender .exe. Kaum geöffnet meldete Avira einen Trojaner-Befall, den ich löschte. Der Trojaner hieß TR/Spy.Web.H und der Befall bezog sich auf: C: /Users/oem/AppData/Roaming/Microsoft/Protect/wgmom.c Dannach meldete sich dann die Malware unablässig zu Wort. Windows – „Delayed Write Failed. Failed to save all the components for the file /System32/000000390c. The file is corrupted or unreadable. This error may be caused by a PC hardware problem. Cancel, try again, continue” (immer andere Zahlenkombis am Ende) Der Taskmanager ließ sich nicht mehr öffnen, sämtliche geöffnete Dateien wurden geschlossen und es erschien ständig die Meldung die RAM sei beschädigt und die Festplatte ebenfalls. Dann öffnete sich eine nach windows aussehende Datei, „Data Recovery“ und meldete Fehler,.Es gab 4 verschiedene Tests, einmal „my computer“, dann „system drive“, dann „RAM Memory“, dann „system registry“, dort standen so schöne sachen wie „ RAM Memory temperature is 83°C. Optimization is reuqired....“ und dann jeweils eine Einschätzung „failed to fix“ oder „succesfully fixed“. einige seien nicht zu beheben und man könne eine Vollversion kaufen um das System wieder herzustellen (oder so ähnlich). Ich führte einen Neustart im abgesichterten Modus durch, ließ Avira über einen USB-Stick laufen (über anderen PC neu heruntergeladen) und fand den windows-virus w32/Indus.A , der sich jetzt in Quarantäne befindet. Der Bildschirmhintergrund ist in jedem Modus schwarz, sämtliche Ordner sind vom Desktop entschwunden, die Festplatten zeigen noch an, dass sich xyGB auf ihnen befindet, jedoch steht bei Doppelklick darauf nur da, dass die Datei keinen Ordner enthält. Alle Programme – wie zB Microsoft Office Anwendungen, Avira, etc. sind alle noch vorhanden und scheinbar auch benutzbar und lassen sich öffnen. Jedesmal wenn ich im nicht abgesciherten Modus starte erscheint das ganze noch mal (Data Recovery, ca. 30 Fehlermedlungen mit delayed write failed“. Gibt es Hilfe? Wenn ja in welchem modus soll ich log-files etc. erstellen? Soll ich die Programme über einen anderen PC per USB dann benutzen oder ist es im Grunde egal? Verzweifelte Grüße |
|
27.09.2011, 05:45
| #2 | ||||
| /// Helfer-Team    | TR/Spy.Web.H und windows-virus w32/Indus.A, schwarzer Bildschirm, scheinbar alle Dateien weg Hallo und Herzlich Willkommen!
__________________ Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]: Zitat:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen! Ich habe zwei Vorschläge: : 1. Wenn du glaubst zu kennen die Zeitpunkt wo dein System noch einwandfrei funktioniert hat, die Systemwiederherstellung ist einen Versuch Wert!: - Gibt es einen "relativ einfachen Weg",wenn eine frische Infektion vorliegt, oder mal bestimmte Probleme bekommt man auch gelöst, was man sogleich ausprobieren sollte. Dies bietet Dir die Möglichkeit, Systemänderungen am Computer ohne Auswirkung auf persönliche Dateien, wie z. B. E-Mails, Dokumente oder Fotos, rückgängig zu machen. Zitat:
(Kannst noch immer bis zum heutigen Zeitpunkt rückgängig machen, falls liefert nicht das gewünschte Ergebnis) ► berichte mir auch, ob die SWH funktioniert hat, bzw ob Du das System auf einen früheren Wiederherstellungspunkt zurückstellen können? 2. Zitat:
Systemscan mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop.
4. Ich würde gerne noch all deine installierten Programme sehen: Lade dir das Tool CCleaner herunter → Download installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..." wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein Zitat:
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw grußkira
__________________ |
|
27.09.2011, 12:22
| #3 |
| | TR/Spy.Web.H und windows-virus w32/Indus.A, schwarzer Bildschirm, scheinbar alle Dateien weg Die Wiederherstellung hat funktioniert. Ich habe einen günstigen Wiederherstellungstag gefunden. Mein Desktophintergrund ist wieder normal. Über versteckte Ordner anzeigen habe ich alle meine Dateien wiedergefunden. Überall war ein Haken bei "verstecken", diesen habe ich entfernt. Im Anschluss habe ich die "exe-Datei", die den Trojaner enthielt, gelöscht.
__________________Hier die OTL-txt-Datei: Code:
ATTFilter OTL logfile created on: 27.09.2011 13:05:38 - Run 1 OTL by OldTimer - Version 3.2.29.1 Folder = D:\ Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,49 Gb Total Physical Memory | 1,42 Gb Available Physical Memory | 56,84% Memory free 5,19 Gb Paging File | 3,96 Gb Available in Paging File | 76,24% Paging File free Paging file location(s): ?:\pagefile.sys %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 74,52 Gb Total Space | 15,66 Gb Free Space | 21,01% Space Free | Partition Type: NTFS Drive D: | 3,82 Gb Total Space | 2,10 Gb Free Space | 54,95% Space Free | Partition Type: FAT32 Drive E: | 73,06 Gb Total Space | 10,83 Gb Free Space | 14,82% Space Free | Partition Type: NTFS Computer Name: OEM-PC | User Name: oem | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.09.27 13:04:22 | 000,582,656 | ---- | M] (OldTimer Tools) -- D:\OTL.exe PRC - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.05.09 05:42:04 | 000,428,200 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe PRC - [2011.04.21 07:53:10 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.04.21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.03.18 17:50:58 | 002,271,608 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe PRC - [2010.04.16 23:12:28 | 003,872,080 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Messenger\msnmsgr.exe PRC - [2009.04.11 04:28:04 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.04.11 04:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2007.04.03 17:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe PRC - [2007.03.29 17:52:22 | 000,114,688 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe PRC - [2007.03.24 10:04:54 | 004,423,680 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2007.03.14 09:56:04 | 000,192,512 | ---- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\SynTP\SynToshiba.exe PRC - [2007.02.25 21:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) -- c:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe PRC - [2007.02.12 14:38:04 | 000,355,096 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2007.02.12 14:37:58 | 000,174,872 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2006.12.19 23:15:44 | 000,428,152 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\Power Saver\TosCoSrv.exe PRC - [2006.11.14 20:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe PRC - [2006.11.13 10:29:40 | 000,413,696 | ---- | M] (TOSHIBA) -- C:\Programme\TOSHIBA\TOSCDSPD\TOSCDSPD.exe PRC - [2006.10.05 13:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe PRC - [2006.05.25 19:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe ========== Modules (No Company Name) ========== MOD - [2009.11.03 19:51:42 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2007.03.06 11:34:10 | 000,249,856 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll MOD - [2003.07.11 02:09:28 | 000,048,192 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\Web Folders\1031\NSEXTINT.DLL ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- -- (Automatisches LiveUpdate - Scheduler) SRV - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.05.09 05:42:04 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.03.18 17:50:58 | 002,271,608 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.04.03 17:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND) SRV - [2007.03.29 17:52:22 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv) SRV - [2007.02.25 21:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- c:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) SRV - [2007.02.12 14:38:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2006.12.19 23:15:44 | 000,428,152 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv) SRV - [2006.11.14 20:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe -- (CFSvcs) SRV - [2006.10.05 13:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2006.05.25 19:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv) ========== Driver Services (SafeList) ========== DRV - [2011.07.21 12:11:12 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.07.21 12:11:11 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2009.02.04 14:20:10 | 000,038,400 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DgivEcp.sys -- (DgiVecp) DRV - [2008.01.03 06:50:22 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT) DRV - [2007.03.29 17:50:38 | 000,285,184 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tos_sps32.sys -- (tos_sps32) DRV - [2007.03.06 15:01:04 | 000,014,848 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\CplIR.SYS -- (CplIR) DRV - [2007.02.25 06:14:00 | 002,216,448 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R) DRV - [2007.01.31 14:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE) DRV - [2007.01.24 14:44:06 | 000,290,304 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21) DRV - [2007.01.18 16:47:18 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10n.sys -- (KR10N) DRV - [2007.01.18 16:40:56 | 000,219,392 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10i.sys -- (KR10I) DRV - [2007.01.18 15:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA) DRV - [2006.12.25 18:35:08 | 000,067,072 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2006.11.28 16:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2006.11.02 09:30:52 | 000,467,456 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2006.10.23 16:32:20 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec) DRV - [2006.10.18 12:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst) DRV - [2006.10.05 22:22:14 | 000,016,768 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ) DRV - [2006.07.28 16:25:26 | 000,019,456 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\LPCFilter.sys -- (LPCFilter) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1265578516&rver=6.0.5285.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx&lc=1031&id=64855&mkt=de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://bluka.de/" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.50 FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:2.0.12 FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:2.5.3 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.1.0.3 FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110323 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.04.13 22:02:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.04.13 22:02:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.06 22:44:00 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.17 14:55:57 | 000,000,000 | ---D | M] [2008.08.31 01:24:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\oem\AppData\Roaming\mozilla\Extensions [2011.09.27 12:56:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions [2011.09.27 10:05:51 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3} [2011.09.27 10:05:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.09.27 10:05:51 | 000,000,000 | ---D | M] (WOT) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2011.09.27 10:05:51 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\firefox@ghostery.com [2011.09.27 10:05:51 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\moveplayer@movenetworks.com [2011.09.27 12:56:36 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\toolbar@ask.com [2011.04.15 18:17:56 | 000,002,333 | ---- | M] () -- C:\Users\oem\AppData\Roaming\Mozilla\Firefox\Profiles\dai13t6b.default\searchplugins\askcom.xml [2011.08.30 08:25:35 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.08.30 08:25:44 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2010.04.26 03:46:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2011.08.30 08:25:44 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} () (No name found) -- C:\USERS\OEM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI () (No name found) -- C:\USERS\OEM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\OEM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI [2011.09.06 22:44:00 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2010.04.26 03:46:21 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011.05.10 01:13:23 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.05.10 01:13:23 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.05.10 01:13:23 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.05.10 01:13:23 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.05.10 01:13:23 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.05.10 01:13:23 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.08.31 16:29:36 | 000,000,000 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [TOSCDSPD] C:\Programme\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - hxxp://www.webtip.ch/cgi-bin/toshiba/tracker_url_de.pl?hxxp://www.ebay.de/ File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000033 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A3DD0D1-2211-471F-806E-5EB47EFEADE9}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\oem\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\oem\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{3839c53b-450d-11e0-8c4e-0016d4980870}\Shell\AutoRun\command - "" = D:\APPInst.exe O33 - MountPoints2\{ab1457e5-801f-11de-9787-0016d4980870}\Shell\AutoRun\command - "" = D:\Toshiba\more4you.exe O33 - MountPoints2\{cab095ed-728f-11df-80eb-0016d4980870}\Shell\AutoRun\command - "" = G:\selomoje\\sranje.exe O33 - MountPoints2\{cab095ed-728f-11df-80eb-0016d4980870}\Shell\explore\command - "" = G:\selomoje\\\sranje.exe O33 - MountPoints2\{cab095ed-728f-11df-80eb-0016d4980870}\Shell\open\command - "" = G:\selomoje\\\sranje.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKCU\...com [@ = ComFile] -- Reg Error: Key error. File not found O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found ========== Files/Folders - Created Within 30 Days ========== [2011.09.27 12:56:30 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com [2011.09.27 11:33:21 | 000,000,000 | ---D | C] -- C:\.Trash-999 [2011.09.26 18:53:16 | 000,000,000 | ---D | C] -- C:\Users\oem\AppData\Roaming\Avira [2011.09.12 14:21:14 | 000,000,000 | ---D | C] -- C:\Program Files\OpenXML-ODF Translator [2011.09.12 14:21:14 | 000,000,000 | ---D | C] -- C:\Users\oem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ODF Add-In für Microsoft Office [2011.08.30 08:25:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011.08.29 09:39:42 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2011.08.29 09:39:41 | 001,797,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2011.08.29 09:39:41 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2011.08.29 09:39:40 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2011.08.29 09:39:40 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2011.08.28 16:07:57 | 000,375,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll [2011.08.28 16:07:39 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2011.08.28 16:06:41 | 003,602,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2011.08.28 16:06:41 | 003,550,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\oem\Desktop\*.tmp files -> C:\Users\oem\Desktop\*.tmp -> ] [1 C:\Users\oem\*.tmp files -> C:\Users\oem\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.09.27 13:05:07 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.09.27 12:59:03 | 000,000,433 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics [2011.09.27 12:58:42 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.09.27 12:58:28 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.09.27 12:58:28 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.09.27 12:58:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.09.27 12:58:08 | 2674,319,360 | -HS- | M] () -- C:\hiberfil.sys [2011.09.27 12:54:40 | 000,621,942 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.09.27 12:54:40 | 000,590,082 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.09.27 12:54:40 | 000,123,666 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.09.27 12:54:40 | 000,102,094 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.09.27 09:57:06 | 000,006,324 | ---- | M] () -- C:\Users\oem\AppData\Local\d3d9caps.dat [2011.09.26 18:35:22 | 000,000,448 | -H-- | M] () -- C:\ProgramData\6DSS92c31Apgjk [2011.09.26 17:37:10 | 067,980,144 | ---- | M] () -- C:\Users\oem\Desktop\avira_antivir_personal_de.exe [2011.09.13 09:11:00 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2011.09.08 18:22:51 | 000,025,600 | ---- | M] () -- C:\Users\oem\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.09.05 22:30:12 | 000,000,606 | ---- | M] () -- C:\Users\oem\Desktop\Bachelorarbeit - Verknüpfung.lnk [2011.08.30 08:25:02 | 000,001,878 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2011.08.29 21:40:34 | 000,290,793 | ---- | M] () -- C:\Users\oem\Desktop\feriensportprogramm uni.pdf [3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\oem\Desktop\*.tmp files -> C:\Users\oem\Desktop\*.tmp -> ] [1 C:\Users\oem\*.tmp files -> C:\Users\oem\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.09.27 12:55:18 | 067,980,144 | ---- | C] () -- C:\Users\oem\Desktop\avira_antivir_personal_de.exe [2011.09.27 10:07:06 | 2674,319,360 | -HS- | C] () -- C:\hiberfil.sys [2011.09.26 16:53:39 | 000,000,448 | -H-- | C] () -- C:\ProgramData\6DSS92c31Apgjk [2011.09.05 22:30:12 | 000,000,606 | ---- | C] () -- C:\Users\oem\Desktop\Bachelorarbeit - Verknüpfung.lnk [2011.08.30 08:25:02 | 000,001,878 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2011.08.29 21:40:34 | 000,290,793 | ---- | C] () -- C:\Users\oem\Desktop\feriensportprogramm uni.pdf [2010.10.18 16:41:16 | 000,036,864 | ---- | C] () -- C:\Windows\System32\SvcMan.exe [2010.10.18 16:40:35 | 000,172,032 | ---- | C] () -- C:\Windows\System32\SecSNMP.dll [2010.10.18 16:32:34 | 000,113,768 | R--- | C] () -- C:\Windows\WiaInst.exe [2010.10.18 16:30:50 | 000,090,112 | R--- | C] () -- C:\Windows\System32\SaSegFlt.dll [2010.10.18 16:30:49 | 000,270,336 | R--- | C] () -- C:\Windows\System32\SaMinDrv.dll [2010.10.18 16:30:49 | 000,106,496 | R--- | C] () -- C:\Windows\System32\SaImgFlt.dll [2010.10.18 16:30:49 | 000,061,440 | R--- | C] () -- C:\Windows\System32\SaErHdlr.dll [2010.10.18 16:28:32 | 000,022,723 | ---- | C] () -- C:\Windows\System32\sse1ml3.dll [2010.03.05 20:09:24 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2010.03.05 20:07:36 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2010.03.05 20:07:36 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2010.03.05 15:26:58 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2010.02.28 21:54:28 | 000,261,632 | ---- | C] () -- C:\Windows\PEV.exe [2010.02.28 21:54:28 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe [2009.09.16 21:34:05 | 018,015,723 | ---- | C] () -- C:\ProgramData\vlc-1.0.1-win32.exe [2009.08.31 23:00:16 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2009.08.03 20:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll [2009.08.03 20:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe [2009.05.02 16:53:39 | 000,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI [2009.04.04 11:12:32 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat [2008.06.09 19:41:03 | 000,001,644 | ---- | C] () -- C:\Windows\ODBCINST.INI [2008.06.09 19:39:11 | 000,045,056 | ---- | C] () -- C:\Windows\System32\lexazdll32.dll [2007.12.04 21:57:42 | 000,000,016 | -H-- | C] () -- C:\ProgramData\mxfilerelatedcache.mxc2 [2007.11.19 21:20:45 | 000,006,324 | ---- | C] () -- C:\Users\oem\AppData\Local\d3d9caps.dat [2007.10.20 02:56:16 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2007.10.09 20:07:11 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2007.10.05 12:30:19 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2007.09.10 21:16:49 | 000,025,600 | ---- | C] () -- C:\Users\oem\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.08.24 21:03:33 | 000,000,660 | ---- | C] () -- C:\Windows\ODBC.INI [2007.08.17 10:03:34 | 000,000,016 | ---- | C] () -- C:\Users\oem\AppData\Roaming\mxfilerelatedcache.mxc2 [2007.08.17 10:03:34 | 000,000,016 | ---- | C] () -- C:\Users\oem\AppData\Local\mxfilerelatedcache.mxc2 [2007.08.01 11:14:03 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ3.dat [2007.08.01 11:14:03 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ2.dat [2007.08.01 11:14:03 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat [2007.08.01 11:14:03 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat [2007.04.17 13:53:06 | 000,701,840 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll [2007.04.17 13:53:06 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll [2007.04.16 08:35:21 | 000,006,642 | ---- | C] () -- C:\Windows\mgxoschk.ini [2007.04.16 08:02:55 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI [2007.04.16 07:26:26 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini [2007.04.16 07:26:26 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll [2007.04.16 07:26:26 | 000,010,146 | ---- | C] () -- C:\Windows\System32\tosmreg.ini [2007.04.16 07:26:26 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini [2007.04.16 07:23:35 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2007.04.16 06:38:28 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1227.dll [2007.04.03 17:18:26 | 000,197,672 | ---- | C] () -- C:\Windows\System32\vpnapi.dll [2006.12.05 13:05:06 | 000,114,688 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll [2006.11.24 07:48:44 | 000,036,864 | ---- | C] () -- C:\Windows\System32\HWS_Ctrl.dll [2006.11.02 17:33:31 | 000,621,942 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2006.11.02 17:33:31 | 000,123,666 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 000,279,240 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,590,082 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,102,094 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2005.11.23 14:55:42 | 000,024,576 | ---- | C] () -- C:\Windows\System32\SPCtl.dll [2005.07.22 21:30:20 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll [2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI ========== LOP Check ========== [2011.09.27 13:02:21 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\Dropbox [2008.06.09 19:41:19 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\dtv-lexikon [2008.07.27 01:48:02 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\ICQ [2011.09.27 10:05:47 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\JabRef 2.6 [2007.12.02 19:27:49 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\Leadertech [2011.09.02 09:42:16 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\LyX2.0 [2010.07.18 16:42:16 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\MAGIX [2010.03.04 00:12:04 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\Opera [2011.09.27 10:05:52 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\PhotoFiltre [2007.10.05 11:51:53 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\TOSHIBA [2011.09.27 10:05:52 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\VSO [2011.09.27 12:57:20 | 000,032,558 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.06.17 08:17:47 | 000,000,414 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{2424B260-0474-4731-96D8-80148C7DAAB4}.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 85 bytes -> C:\Users\oem\Desktop\IMG_9532.JPG:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\oem\Desktop\IMG_8468.JPG:VsoSummaryInformation < End of report > Code:
ATTFilter OTL Extras logfile created on: 27.09.2011 13:05:38 - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = D:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,49 Gb Total Physical Memory | 1,42 Gb Available Physical Memory | 56,84% Memory free
5,19 Gb Paging File | 3,96 Gb Available in Paging File | 76,24% Paging File free
Paging file location(s): ?:\pagefile.sys
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 15,66 Gb Free Space | 21,01% Space Free | Partition Type: NTFS
Drive D: | 3,82 Gb Total Space | 2,10 Gb Free Space | 54,95% Space Free | Partition Type: FAT32
Drive E: | 73,06 Gb Total Space | 10,83 Gb Free Space | 14,82% Space Free | Partition Type: NTFS
Computer Name: OEM-PC | User Name: oem | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- Reg Error: Key error. File not found
.cmd [@ = cmdfile] -- Reg Error: Key error. File not found
.com [@ = ComFile] -- Reg Error: Key error. File not found
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.pif [@ = piffile] -- Reg Error: Key error. File not found
.vbs [@ = VBSFile] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01518295-B0C3-4B0B-A9C3-C3062648F6DE}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{11B0CD8F-EA07-491F-A311-79110A599B37}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{2E70B345-AFA0-45B0-AB2B-5EEF8832A0A1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{42319464-8FDD-4A21-9F9A-2AAF99A4DFB6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4EF4A94F-C72C-4248-B745-C47622BE4E15}" = lport=2869 | protocol=6 | dir=in | app=system |
"{530BA87F-A36A-435A-807E-508D8229FCC5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{573A1267-3881-4B01-8DA8-25C3B3AE1AD3}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{6624A5AC-A4DD-4954-BECA-3F4ED1E020F3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{69C9F578-5C36-44F6-8BC9-4B8246A73F14}" = lport=2869 | protocol=6 | dir=in | app=system |
"{81163D97-F600-4719-9DD7-BF66B5D3E18F}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{9F7A7C1C-28D7-4CDA-9A72-B2906B2EE6CB}" = lport=139 | protocol=6 | dir=in | app=system |
"{AB5A2F21-07CA-43F1-BCEF-637724C8AA3F}" = rport=445 | protocol=6 | dir=out | app=system |
"{B308AFDE-8657-428D-92EF-FBEDCDE34B0C}" = lport=137 | protocol=17 | dir=in | app=system |
"{B3836E45-1313-4FCD-A923-D42A01128863}" = rport=138 | protocol=17 | dir=out | app=system |
"{C225DBC5-1E68-4448-A87A-8787C953FFF2}" = rport=137 | protocol=17 | dir=out | app=system |
"{C2EEB55C-C4E1-495E-93A6-216A00D1C2C5}" = lport=445 | protocol=6 | dir=in | app=system |
"{D469BEA8-DE78-45AD-9E12-49B6AE297B94}" = rport=2869 | protocol=6 | dir=out | app=system |
"{E083F2B0-95D0-4BCC-8F7B-630FC4DA56C3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{E1E41979-3161-4596-BE97-BFBF37017708}" = lport=138 | protocol=17 | dir=in | app=system |
"{F6EEC5E3-8335-40C4-9D9F-B1DDE85A5552}" = rport=139 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02F7A30F-A626-4FD8-8E17-2BEB97833487}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{05DDA8B9-43EB-41E0-B52F-D618F237BDD2}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{08B1A971-718B-4D9D-B462-4270FE631AE3}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
"{0CCAEBCC-6374-4207-ACC8-73D6A58A3297}" = protocol=6 | dir=in | app=c:\users\oem\appdata\local\temp\7zs4911.tmp\symnrt.exe |
"{103033F5-ABF9-4B67-B92F-7A81E4547163}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{12C08164-28B1-46C2-B303-D8CA1BD745CE}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{1A22BFE6-8D19-4BF6-B459-034C8B3BD8AA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{2DAA9BDD-FACB-4821-B50A-00A1352EEBE5}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{37A77AC1-5068-444E-BEE6-B1A8E5FE40D8}" = protocol=17 | dir=in | app=c:\users\oem\appdata\local\temp\7zs4911.tmp\symnrt.exe |
"{5D5100C3-30A7-4664-B290-BF2D9C1B8044}" = protocol=6 | dir=in | app=c:\program files\apexdc++\apexdc.exe |
"{5F45DBB5-A145-47E4-88B4-59E764244329}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{6307A785-CA96-4AE9-BB46-84981CD3BB72}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{741D33C4-5781-42E7-A9C5-E6EB2CA0B145}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{75E1F1E1-EEED-4029-9501-994E18178C3F}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
"{802F0511-3496-4229-A067-7EFBCE1BA5AE}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
"{816CAD2C-F285-49CD-A257-F534D2E7032A}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{8B89D3B5-E080-430F-A2E1-3F6FF1A2B34B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8C6FAD73-AD28-4DA2-940F-482FE84CEED0}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{907B8277-C667-48FA-AE4C-A89F8364CC60}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9618D166-8A27-4EA6-A285-709E2C15A651}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{99905E91-B6A7-4D60-8B46-52BF3DF9F5B0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{A64498F8-E501-4AB3-9D00-DB967973830B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B444482D-7FFD-4F03-8BF5-72FFF431C7B0}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{B644353B-6ACA-4D71-8326-64FFC2C60079}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{C8D1FA9A-9E80-48B0-B4FA-8749ACC2EDF6}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{D780ECAD-01E8-4797-94FB-ABAF32A0DD8D}" = protocol=17 | dir=in | app=c:\program files\apexdc++\apexdc.exe |
"{E2370C53-6C7A-4024-8E17-184FAE74FB6E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{E98B93E5-882B-4577-A497-D650EB38EA6F}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{EB7E098F-0C6F-423E-A418-718ADFEFF1C9}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
"{EDEDC3A3-A1CF-4D95-A92B-F9D3E1657E9A}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{FBC907E1-21C5-4F6C-9E77-6F9A295425F8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"TCP Query User{05EAA124-20BD-43A2-8BFD-42E60D62DAF0}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{06E99E96-1DF2-4326-ABB5-C3CD42AD7257}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{0B3435B2-63C7-4A8E-9E3D-8EC777857F22}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"TCP Query User{30500507-3252-483D-9E72-9054F9A848DC}C:\program files\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files\trillian\trillian.exe |
"TCP Query User{768A4AB1-DAA2-41ED-BE9A-5B0EA455607D}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{836D49D2-1D54-4E14-9077-99ABF8C74ABF}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{A4F766FF-CD71-4E81-AF04-5F1B523BB374}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{C0AC3A04-4BA8-4495-B186-659E920332A2}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{CCF97235-6513-416D-98A9-1AFAF9744F5E}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{D990F1DB-7F92-4BC0-B537-195500AC4163}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{DEF1BBA9-5582-43AE-9DC3-143754B4D21D}C:\program files\apexdc++\apexdc.exe" = protocol=6 | dir=in | app=c:\program files\apexdc++\apexdc.exe |
"UDP Query User{22D286A4-329E-4AD5-BE2D-EBB3824C5E87}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{2B8AE873-7DB6-4609-8251-255AAB6DC49D}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{4014142A-526A-4616-9EE9-10DD2D3D7D9A}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{4E23543A-1890-414E-A187-D8388137519C}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{6BAD0D87-16DF-4A32-AEBF-8D3FFAE5F498}C:\program files\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files\trillian\trillian.exe |
"UDP Query User{8057F565-A085-4405-828F-1F6A85990FFB}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{C60B14C4-95F1-4A4C-B57B-4F83AAE9180B}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{C70DF6F0-6F90-44E5-B980-CD827443047F}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{D3E092CC-8E80-4825-806E-84084E0D46B2}C:\program files\apexdc++\apexdc.exe" = protocol=17 | dir=in | app=c:\program files\apexdc++\apexdc.exe |
"UDP Query User{D51C8DCF-D9CF-4A08-9F93-5C09C5D17B8D}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{F6715EA6-DAFD-4FF9-B8D6-1B634E7E127E}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{13A5E785-5197-4EAD-8EE3-D660271E49BC}" = Feedback Tool
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{2BC21CD2-8053-406A-80F6-9AB61717B49D}" = ODF Add-In für Microsoft Office
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 3.0.1.72
"{43D1A6DC-F2D3-4EBC-8851-CC8B9C0C8763}_is1" = ApexDC++ 1.4.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}" = TOSHIBA ConfigFree
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Matrix Storage Manager
"{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A6D4234C-CB02-4048-AC3E-AD09404FA35A}" = Emdedded IR Driver
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C73CA646-73B3-4AEF-A136-C37505745174}" = iTunes
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}" = Cisco Systems VPN Client 5.0.00.0340
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D03482C5-9AD8-496D-B388-692AE04C93AF}" = Bonjour
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Aspell" = Aspell Data
"Aspell6-Dictionary-de" = Aspell 0.6 Dictionary (Language: de)
"Aspell6-Dictionary-en" = Aspell 0.6 Dictionary (Language: en)
"Aspell6-Dictionary-es" = Aspell 0.6 Dictionary (Language: es)
"Aspell6-Dictionary-pt_BR" = Aspell 0.6 Dictionary (Language: pt_BR)
"Aspell6-Dictionary-pt_PT" = Aspell 0.6 Dictionary (Language: pt_PT)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"DivX Setup.divx.com" = DivX-Setup
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisorkennwort
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"InstallShield_{A6D4234C-CB02-4048-AC3E-AD09404FA35A}" = Emdedded IR Driver
"InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"LyX20" = LyX 2.0.0-3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MiKTeX 2.9" = MiKTeX 2.9
"Mozilla Firefox 6.0.2 (x86 de)" = Mozilla Firefox 6.0.2 (x86 de)
"Samsung SCX-4300 Series" = Samsung SCX-4300 Series
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 6" = TeamViewer 6
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"VLC media player" = VLC media player 1.1.9
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"WinLiveSuite_Wave3" = Windows Live Essentials
"Wondershare Photo Collage Studio_is1" = Wondershare Photo Collage Studio 4.2.9.2
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 27.09.2011 04:28:43 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.09.2011 04:28:43 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.09.2011 04:28:43 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.09.2011 04:28:43 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 27.09.2011 06:40:48 | Computer Name = oem-PC | Source = Avira AntiVir | ID = 4109
Description = Die Engine wurde verändert oder zerstört! Fehlercode: 0x9
Error - 27.09.2011 06:40:49 | Computer Name = oem-PC | Source = Avira AntiVir | ID = 4112
Description = Bei der Anforderung nach einer Resource des Betriebssystems trat ein
Fehler auf. Die Resource 'ENGINE' wurde nicht zugewiesen. Der Grund hierfür könnte
zu wenig Hauptspeicher oder ein anderer Systemfehler sein. Fehlercode: 0x57
Error - 27.09.2011 06:54:37 | Computer Name = oem-PC | Source = Avira AntiVir | ID = 4109
Description = Die Engine wurde verändert oder zerstört! Fehlercode: 0x9
Error - 27.09.2011 06:54:37 | Computer Name = oem-PC | Source = Avira AntiVir | ID = 4112
Description = Bei der Anforderung nach einer Resource des Betriebssystems trat ein
Fehler auf. Die Resource 'ENGINE' wurde nicht zugewiesen. Der Grund hierfür könnte
zu wenig Hauptspeicher oder ein anderer Systemfehler sein. Fehlercode: 0x57
Error - 27.09.2011 06:55:09 | Computer Name = oem-PC | Source = Avira AntiVir | ID = 4109
Description = Die Engine wurde verändert oder zerstört! Fehlercode: 0x9
Error - 27.09.2011 06:55:10 | Computer Name = oem-PC | Source = Avira AntiVir | ID = 4112
Description = Bei der Anforderung nach einer Resource des Betriebssystems trat ein
Fehler auf. Die Resource 'ENGINE' wurde nicht zugewiesen. Der Grund hierfür könnte
zu wenig Hauptspeicher oder ein anderer Systemfehler sein. Fehlercode: 0x57
[ Media Center Events ]
Error - 16.04.2008 06:28:16 | Computer Name = oem-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: Download von Paket MCESpotlight
gescheitert.
[ System Events ]
Error - 27.09.2011 04:08:50 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 27.09.2011 04:08:50 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 27.09.2011 04:30:13 | Computer Name = oem-PC | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 169.254.221.81 deaktiviert,
da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der
die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die
IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb
dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
Error - 27.09.2011 04:30:15 | Computer Name = oem-PC | Source = ipnathlp | ID = 30005
Description = Ein DHCP-Server mit der IP-Adresse 192.168.0.1 wurde von der DHCP-Zuweisung
im selben Netzwerk gefunden, wie die Schnittstelle mit der IP-Adresse 192.168.0.254.
Die Zuweisung wurde auf der Schnittstelle automatisch deaktiviert, um DHCP-Clientkonflikte
zu vermeiden.
Error - 27.09.2011 06:42:17 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 27.09.2011 06:42:17 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 27.09.2011 06:42:17 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 27.09.2011 06:59:50 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 27.09.2011 06:59:50 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 27.09.2011 06:59:50 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
Code:
ATTFilter 7-Zip 9.20 31.03.2011 3,54MB
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 16.01.2011 10.1.102.64
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 12.09.2011 10.3.183.7
Adobe Reader X (10.1.1) - Deutsch Adobe Systems Incorporated 16.09.2011 165,3MB 10.1.1
ApexDC++ 1.4.3 ApexDC++ Development Team 03.05.2011 59,2MB 1.4.3
Apple Application Support Apple Inc. 01.08.2011 51,0MB 1.5.2
Apple Mobile Device Support Apple Inc. 01.08.2011 22,1MB 3.4.1.2
Apple Software Update Apple Inc. 01.08.2011 2,38MB 2.1.3.127
Ask Toolbar Ask.com 26.09.2011 2,76MB 1.11.3.0
Aspell 0.6 Dictionary (Language: de) 31.03.2011 35,2MB
Aspell 0.6 Dictionary (Language: en) 31.03.2011 35,2MB
Aspell 0.6 Dictionary (Language: es) 31.03.2011 35,2MB
Aspell 0.6 Dictionary (Language: pt_BR) 31.03.2011 35,2MB
Aspell 0.6 Dictionary (Language: pt_PT) 31.03.2011 35,2MB
Aspell Data 31.03.2011 35,2MB
Avira AntiVir Personal - Free Antivirus Avira GmbH 26.09.2011 71,0MB 10.2.0.700
Bluetooth Stack for Windows by Toshiba 15.04.2007 54,7MB v5.10.06(T)
Bonjour Apple Inc. 01.08.2011 1,02MB 3.0.0.2
CCleaner Piriform 15.07.2011 3,82MB 3.08
CD/DVD Drive Acoustic Silencer TOSHIBA 04.03.2010 0,45MB 2.00.02
Cisco Systems VPN Client 5.0.00.0340 Cisco Systems, Inc. 08.12.2007 12,1MB 5.0.0
Click to Call with Skype Skype Technologies S.A. 12.09.2011 13,4MB 5.6.8153
Compatibility Pack for the 2007 Office system Microsoft Corporation 15.09.2011 255MB 12.0.6425.1000
Compatibility Pack für 2007 Office System Microsoft Corporation 15.09.2011 40,4MB 12.0.6425.1000
DivX-Setup DivX, LLC 06.06.2011 2,98MB 2.5.0.11
Emdedded IR Driver Compal Electronics, Inc. 15.04.2007 0,89MB 0.0.0.6C
Feedback Tool Microsoft Corporation 22.07.2011 2,28MB 1.2.0
HijackThis 2.0.2 TrendMicro 04.03.2010 0,41MB 2.0.2
Intel Matrix Storage Manager 04.03.2010 37,1MB
Intel(R) Graphics Media Accelerator Driver 04.03.2010
iTunes Apple Inc. 01.08.2011 141,9MB 10.4.0.80
Java(TM) 6 Update 20 Sun Microsystems, Inc. 24.04.2010 94,5MB 6.0.200
LyX 2.0.0-3 LyX Team 12.07.2011 478MB 2.0.0-3
Malwarebytes' Anti-Malware Malwarebytes Corporation 07.08.2010 4,09MB
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 04.03.2010 27,8MB
Microsoft Office File Validation Add-In Microsoft Corporation 15.09.2011 7,92MB 14.0.5130.5003
Microsoft Office Live Add-in 1.3 Microsoft Corporation 19.03.2009 0,48MB 2.0.2313.0
Microsoft Office Standard Edition 2003 Microsoft Corporation 15.09.2011 11.0.8173.0
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 29.07.2009 0,19MB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Corporation 26.04.2011 0,58MB 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 17.03.2009 0,58MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 17.06.2011 0,58MB 9.0.30729.6161
MiKTeX 2.9 MiKTeX.org 12.07.2011 405MB 2.9
MobileMe Control Panel Apple Inc. 06.04.2010 6,56MB 3.0.0.101
Mozilla Firefox 6.0.2 (x86 de) Mozilla 05.09.2011 39,5MB 6.0.2
MSXML 4.0 SP2 (KB936181) Microsoft Corporation 24.08.2007 1,27MB 4.20.9848.0
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 11.11.2008 1,28MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 25.11.2009 1,34MB 4.20.9876.0
ODF Add-In für Microsoft Office OpenXML/ODF Translator Team 11.09.2011 19,9MB 4.0.5309.0
PDFCreator Frank Heindörfer, Philip Chinery 17.06.2011 21,6MB 1.2.1
QuickTime Apple Inc. 01.08.2011 73,7MB 7.69.80.9
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista Realtek 15.04.2007 0,57MB 1.00.0000
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 15.04.2007 14,2MB 6.0.1.5391
Samsung SCX-4300 Series Samsung Electronics CO.,LTD 17.10.2010 100,8MB
Shared Add-in Extensibility Update for Microsoft .NET Framework 2.0 (KB908002) Microsoft 11.09.2011 0,29MB 1.0.0
Shared Add-in Support Update for Microsoft .NET Framework 2.0 (KB908002) Microsoft 11.09.2011 56,00KB 1.0.0
Skype™ 5.5 Skype Technologies S.A. 12.09.2011 17,0MB 5.5.117
Synaptics Pointing Device Driver Synaptics 04.03.2010 13,3MB 9.1.19.0
TeamViewer 6 TeamViewer GmbH 31.03.2011 22,8MB 6.0.10418
Texas Instruments PCIxx21/x515/xx12 drivers. Ihr Firmenname 15.04.2007 0,94MB 2.00.0001
TOSHIBA Assist 04.03.2010 0,73MB 2.00.03
TOSHIBA ConfigFree TOSHIBA 15.04.2007 39,6MB 7.00.27
TOSHIBA Disc Creator TOSHIBA Corporation 15.04.2007 9,51MB 2.0.0.7a
TOSHIBA DVD PLAYER TOSHIBA Corporation 31.07.2007 17,8MB 1.00.14
TOSHIBA Extended Tiles for Windows Mobility Center Toshiba 15.04.2007 1,28MB 1.01.00
TOSHIBA Flash Cards Support Utility TOSHIBA 15.04.2007 1.48.0.3C
TOSHIBA Hardware Setup TOSHIBA 15.04.2007 1.48.0.9C
Toshiba Online Product Information TOSHIBA 15.04.2007 4,78MB 1.00.0009
TOSHIBA SD Memory Utilities TOSHIBA 15.04.2007 1,61MB 1.8.1.1
TOSHIBA Software Modem Agere Systems 04.03.2010 2.1.77 (SM2177ALD03)
TOSHIBA Supervisorkennwort TOSHIBA 15.04.2007 1.48.0.8C
TOSHIBA Value Added Package TOSHIBA Corporation 15.04.2007 0,89MB 1.0.17
VLC media player 1.1.9 VideoLAN 25.04.2011 49,0MB 1.1.9
VSO Image Resizer 3.0.1.72 VSO-Software 29.01.2010 27,0MB 3.0.1.72
Windows Live Anmelde-Assistent Microsoft Corporation 11.03.2009 1,93MB 5.000.818.6
Windows Live Essentials Microsoft Corporation 19.12.2010 102,5MB 14.0.8117.0416
Windows Live-Uploadtool Microsoft Corporation 19.03.2009 0,22MB 14.0.8014.1029
Windows Media Encoder 9-Reihe 04.03.2010 13,7MB
Windows Media Player Firefox Plugin Microsoft Corp 13.12.2010 0,29MB 1.0.0.8
Wondershare Photo Collage Studio 4.2.9.2 Wondershare Software Co.,Ltd. 21.12.2010 75,2MB 4.2.9.2
|
|
29.09.2011, 06:55
| #4 |
| /// Helfer-Team | TR/Spy.Web.H und windows-virus w32/Indus.A, schwarzer Bildschirm, scheinbar alle Dateien weg 1. Deinstalliere unter `Start→ Systemsteuereung→ Ändern/Entfernen...` Code:
ATTFilter Ask Toolbar - Adware -Toolbar Immer die benutzerdefinierte Installation wählen, nicht die Standardinstallation, weil dann oft Sachen mitinstalliert werden, die man nicht braucht oder nicht möchte. Bei Installation die Lizenzbestimmungen immer lesen, und nicht sofort überall den Haken setzen, weil damit stimmt man nämlich zu, dass Adware (Werbe-Pop-ups) durch Partnerprogrammen, Sponsoren etc - mitinstalliert wird, weil sich Freeware damit finanziert. in diese Kategorie gehören noch einige, wie z.B: -> Unerwünschte Toolbars deinstallieren 2. ALTE VERSION!!!: Code:
ATTFilter Logfile of HijackThis 2.0.2
also lösche/deinstalliere HijackThis "2.0.2." und lade Dir erneut von hier TrendMicro™ HijackThis™/Version 2.0.4 herunter 3. Deine Javaversion ist nicht aktuell! Da aufgrund alter Sicherheitslücken ist Java sehr anfällig, deinstalliere zunächst alle vorhandenen Java-Versionen: → Systemsteuerung → Software → deinstallieren... → Rechner neu aufstarten → Downloade nun die Offline-Version von Java Version 6 Update 27 von Oracle herunter Achte darauf, eventuell angebotene Toolbars abwählen (den Haken bei der Toolbar entfernen)! 4. Fixen mit OTL
Code:
ATTFilter :OTL
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
[2011.09.27 12:56:36 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\toolbar@ask.com
[2011.04.15 18:17:56 | 000,002,333 | ---- | M] () -- C:\Users\oem\AppData\Roaming\Mozilla\Firefox\Profiles\dai13t6b.default\searchplugins\askcom.xml
[2011.05.10 01:13:23 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O9 - Extra Button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url_de.pl?hxxp://www.ebay.de/ File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{3839c53b-450d-11e0-8c4e-0016d4980870}\Shell\AutoRun\command - "" = D:\APPInst.exe
O33 - MountPoints2\{ab1457e5-801f-11de-9787-0016d4980870}\Shell\AutoRun\command - "" = D:\Toshiba\more4you.exe
O33 - MountPoints2\{cab095ed-728f-11df-80eb-0016d4980870}\Shell\AutoRun\command - "" = G:\selomoje\\sranje.exe
O33 - MountPoints2\{cab095ed-728f-11df-80eb-0016d4980870}\Shell\explore\command - "" = G:\selomoje\\\sranje.exe
O33 - MountPoints2\{cab095ed-728f-11df-80eb-0016d4980870}\Shell\open\command - "" = G:\selomoje\\\sranje.exe
[2011.09.27 12:56:30 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2011.09.27 13:05:07 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.09.27 12:59:03 | 000,000,433 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2011.09.27 12:58:42 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.09.26 18:35:22 | 000,000,448 | -H-- | M] () -- C:\ProgramData\6DSS92c31Apgjk
@Alternate Data Stream - 85 bytes -> C:\Users\oem\Desktop\IMG_9532.JPG:VsoSummaryInformation
@Alternate Data Stream - 85 bytes -> C:\Users\oem\Desktop\IMG_8468.JPG:VsoSummaryInformation
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" =-
:Commands
[purity]
[emptytemp]
5. reinige dein System mit Ccleaner:
6. ** Update Malwarebytes Anti-Malware, lass es nochmal anhand der folgenden Anleitung laufen:
7. erneut einen Scan mit OTL:
8.
9. Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware ("Worm.Win32.Autorun") verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen. Schließe jetzt alle externe Datenträgeran (USB Sticks etc) Deinen Rechner an, dabei die Hochstell-Taste [Shift-Taste] gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. (So verhindest Du die Ausführung der AUTORUN-Funktion) - Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung -> Führe dann einen Komplett-Systemcheck mit Eset Online Scanner (NOD32)Kostenlose Online Scanner durch Achtung!: >>Du sollst nicht die Antivirus-Sicherheitssoftware installieren, sondern dein System nur online scannen<< ► Wie ist den aktuellen Zustand des Rechners? Auffälligkeiten, Probleme?
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! |
|
30.09.2011, 12:26
| #5 |
| | TR/Spy.Web.H und windows-virus w32/Indus.A, schwarzer Bildschirm, scheinbar alle Dateien weg 1. Erster OTL Scan, Fixen mit OTL: Code:
ATTFilter All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll not found.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0\ deleted successfully.
Folder C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\toolbar@ask.com\ not found.
C:\Users\oem\AppData\Roaming\Mozilla\Firefox\Profiles\dai13t6b.default\searchplugins\askcom.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\bing.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C08CAF1D-C0A3-40D5-9970-06D067EAC017}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C08CAF1D-C0A3-40D5-9970-06D067EAC017}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3839c53b-450d-11e0-8c4e-0016d4980870}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3839c53b-450d-11e0-8c4e-0016d4980870}\ not found.
File D:\APPInst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab1457e5-801f-11de-9787-0016d4980870}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ab1457e5-801f-11de-9787-0016d4980870}\ not found.
File D:\Toshiba\more4you.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cab095ed-728f-11df-80eb-0016d4980870}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cab095ed-728f-11df-80eb-0016d4980870}\ not found.
File G:\selomoje\\sranje.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cab095ed-728f-11df-80eb-0016d4980870}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cab095ed-728f-11df-80eb-0016d4980870}\ not found.
File G:\selomoje\\\sranje.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cab095ed-728f-11df-80eb-0016d4980870}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cab095ed-728f-11df-80eb-0016d4980870}\ not found.
File G:\selomoje\\\sranje.exe not found.
Folder C:\Program Files\Ask.com\ not found.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\System32\drivers\etc\hosts.ics moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\ProgramData\6DSS92c31Apgjk moved successfully.
Unable to delete ADS C:\Users\oem\Desktop\IMG_9532.JPG:VsoSummaryInformation .
Unable to delete ADS C:\Users\oem\Desktop\IMG_8468.JPG:VsoSummaryInformation .
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\\{86D4B82A-ABED-442A-BE86-96357B70F4FE} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Chef
->Temp folder emptied: 10252345 bytes
->Temporary Internet Files folder emptied: 37103 bytes
->FireFox cache emptied: 28518591 bytes
->Flash cache emptied: 456 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: oem
->Temp folder emptied: 48504782 bytes
->Temporary Internet Files folder emptied: 6448230 bytes
->Java cache emptied: 10414250 bytes
->FireFox cache emptied: 54359302 bytes
->Apple Safari cache emptied: 1074176 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 805 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1644865 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3202834 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 157,00 mb
OTL by OldTimer - Version 3.2.29.1 log created on 09292011_185003
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 7809
Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421
29.09.2011 20:48:30
mbam-log-2011-09-29 (20-48-30).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|F:\|)
Durchsuchte Objekte: 349629
Laufzeit: 1 Stunde(n), 49 Minute(n), 26 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Code:
ATTFilter OTL logfile created on: 29.09.2011 20:50:39 - Run 2 OTL by OldTimer - Version 3.2.29.1 Folder = D:\ Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,49 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 31,67% Memory free 5,19 Gb Paging File | 3,30 Gb Available in Paging File | 63,47% Paging File free Paging file location(s): ?:\pagefile.sys %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 74,52 Gb Total Space | 16,88 Gb Free Space | 22,65% Space Free | Partition Type: NTFS Drive D: | 3,82 Gb Total Space | 2,10 Gb Free Space | 54,87% Space Free | Partition Type: FAT32 Drive E: | 73,06 Gb Total Space | 29,78 Gb Free Space | 40,76% Space Free | Partition Type: NTFS Computer Name: OEM-PC | User Name: oem | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.09.27 13:04:22 | 000,582,656 | ---- | M] (OldTimer Tools) -- D:\OTL.exe PRC - [2011.09.06 22:44:00 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.04.21 07:53:10 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.04.21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.03.18 17:50:58 | 002,271,608 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe PRC - [2009.04.11 04:28:04 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.04.11 04:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2007.03.29 17:52:22 | 000,114,688 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe PRC - [2007.03.24 10:04:54 | 004,423,680 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2007.03.14 09:56:04 | 000,192,512 | ---- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\SynTP\SynToshiba.exe PRC - [2007.02.25 21:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) -- c:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe PRC - [2007.02.12 14:38:04 | 000,355,096 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2007.02.12 14:37:58 | 000,174,872 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2006.12.19 23:15:44 | 000,428,152 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\Power Saver\TosCoSrv.exe PRC - [2006.11.14 20:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe PRC - [2006.11.13 10:29:40 | 000,413,696 | ---- | M] (TOSHIBA) -- C:\Programme\TOSHIBA\TOSCDSPD\TOSCDSPD.exe PRC - [2006.10.05 13:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe PRC - [2006.05.25 19:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe ========== Modules (No Company Name) ========== MOD - [2011.09.13 09:11:00 | 006,277,280 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll MOD - [2011.09.06 22:43:59 | 001,846,232 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2009.11.03 19:51:42 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2007.03.06 11:34:10 | 000,249,856 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Unknown | Stopped] -- -- (Automatisches LiveUpdate - Scheduler) SRV - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.03.18 17:50:58 | 002,271,608 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.03.29 17:52:22 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv) SRV - [2007.02.25 21:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- c:\Programme\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) SRV - [2007.02.12 14:38:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2006.12.19 23:15:44 | 000,428,152 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv) SRV - [2006.11.14 20:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe -- (CFSvcs) SRV - [2006.10.05 13:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2006.05.25 19:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv) ========== Driver Services (SafeList) ========== DRV - [2011.07.21 12:11:12 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.07.21 12:11:11 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2009.02.04 14:20:10 | 000,038,400 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DgivEcp.sys -- (DgiVecp) DRV - [2008.01.03 06:50:22 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT) DRV - [2007.03.29 17:50:38 | 000,285,184 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tos_sps32.sys -- (tos_sps32) DRV - [2007.03.06 15:01:04 | 000,014,848 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\CplIR.SYS -- (CplIR) DRV - [2007.02.25 06:14:00 | 002,216,448 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R) DRV - [2007.01.31 14:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE) DRV - [2007.01.24 14:44:06 | 000,290,304 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21) DRV - [2007.01.18 16:47:18 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10n.sys -- (KR10N) DRV - [2007.01.18 16:40:56 | 000,219,392 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10i.sys -- (KR10I) DRV - [2007.01.18 15:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA) DRV - [2006.12.25 18:35:08 | 000,067,072 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2006.11.28 16:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2006.11.02 09:30:52 | 000,467,456 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2006.10.23 16:32:20 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec) DRV - [2006.10.18 12:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst) DRV - [2006.10.05 22:22:14 | 000,016,768 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ) DRV - [2006.07.28 16:25:26 | 000,019,456 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\LPCFilter.sys -- (LPCFilter) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1265578516&rver=6.0.5285.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx&lc=1031&id=64855&mkt=de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://bluka.de/" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.50 FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:2.0.12 FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:2.5.3 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.1.0.3 FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110323 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.04.13 22:02:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.04.13 22:02:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.06 22:44:00 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.17 14:55:57 | 000,000,000 | ---D | M] [2008.08.31 01:24:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\oem\AppData\Roaming\mozilla\Extensions [2011.09.27 23:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions [2011.09.27 10:05:51 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3} [2011.09.27 10:05:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.09.27 10:05:51 | 000,000,000 | ---D | M] (WOT) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2011.09.27 10:05:51 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\firefox@ghostery.com [2011.09.27 10:05:51 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\oem\AppData\Roaming\mozilla\Firefox\Profiles\dai13t6b.default\extensions\moveplayer@movenetworks.com [2011.09.29 18:43:21 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.08.30 08:25:44 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011.09.29 18:43:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} [2011.08.30 08:25:44 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} () (No name found) -- C:\USERS\OEM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI () (No name found) -- C:\USERS\OEM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\OEM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI [2011.09.06 22:44:00 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.09.29 18:42:41 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011.05.10 01:13:23 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.05.10 01:13:23 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.05.10 01:13:23 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.05.10 01:13:23 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.05.10 01:13:23 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.08.31 16:29:36 | 000,000,000 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [TOSCDSPD] C:\Programme\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.196.128.4 10.196.128.5 134.2.200.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A3DD0D1-2211-471F-806E-5EB47EFEADE9}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F19CF9E7-D111-40C9-A0EA-3FBCA37601C0}: DhcpNameServer = 10.196.128.4 10.196.128.5 134.2.200.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\oem\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\oem\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKCU\...com [@ = ComFile] -- Reg Error: Key error. File not found O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found ========== Files/Folders - Created Within 30 Days ========== [2011.09.29 18:44:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2011.09.29 18:43:16 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2011.09.29 18:43:16 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2011.09.29 18:43:14 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2011.09.27 11:33:21 | 000,000,000 | ---D | C] -- C:\.Trash-999 [2011.09.26 18:53:16 | 000,000,000 | ---D | C] -- C:\Users\oem\AppData\Roaming\Avira [2011.09.12 14:21:14 | 000,000,000 | ---D | C] -- C:\Program Files\OpenXML-ODF Translator [2011.09.12 14:21:14 | 000,000,000 | ---D | C] -- C:\Users\oem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ODF Add-In für Microsoft Office [1 C:\Users\oem\Desktop\*.tmp files -> C:\Users\oem\Desktop\*.tmp -> ] [1 C:\Users\oem\*.tmp files -> C:\Users\oem\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.09.29 20:53:49 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.09.29 20:53:49 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.09.29 18:54:32 | 000,000,433 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics [2011.09.29 18:53:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.09.29 18:53:42 | 2672,259,072 | -HS- | M] () -- C:\hiberfil.sys [2011.09.29 18:46:36 | 000,621,942 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.09.29 18:46:36 | 000,590,082 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.09.29 18:46:36 | 000,123,666 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.09.29 18:46:36 | 000,102,094 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.09.29 18:42:39 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2011.09.29 18:42:39 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2011.09.29 18:42:39 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2011.09.29 18:42:39 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2011.09.27 23:41:33 | 000,001,594 | ---- | M] () -- C:\Windows\VPNUnInstall.MIF [2011.09.27 23:23:34 | 000,040,960 | ---- | M] () -- C:\Users\oem\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.09.27 09:57:06 | 000,006,324 | ---- | M] () -- C:\Users\oem\AppData\Local\d3d9caps.dat [2011.09.13 09:11:00 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2011.09.05 22:30:12 | 000,000,606 | ---- | M] () -- C:\Users\oem\Desktop\Bachelorarbeit - Verknüpfung.lnk [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [1 C:\Users\oem\Desktop\*.tmp files -> C:\Users\oem\Desktop\*.tmp -> ] [1 C:\Users\oem\*.tmp files -> C:\Users\oem\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.09.27 10:07:06 | 2672,259,072 | -HS- | C] () -- C:\hiberfil.sys [2011.09.05 22:30:12 | 000,000,606 | ---- | C] () -- C:\Users\oem\Desktop\Bachelorarbeit - Verknüpfung.lnk [2010.10.18 16:41:16 | 000,036,864 | ---- | C] () -- C:\Windows\System32\SvcMan.exe [2010.10.18 16:40:35 | 000,172,032 | ---- | C] () -- C:\Windows\System32\SecSNMP.dll [2010.10.18 16:32:34 | 000,113,768 | R--- | C] () -- C:\Windows\WiaInst.exe [2010.10.18 16:30:50 | 000,090,112 | R--- | C] () -- C:\Windows\System32\SaSegFlt.dll [2010.10.18 16:30:49 | 000,270,336 | R--- | C] () -- C:\Windows\System32\SaMinDrv.dll [2010.10.18 16:30:49 | 000,106,496 | R--- | C] () -- C:\Windows\System32\SaImgFlt.dll [2010.10.18 16:30:49 | 000,061,440 | R--- | C] () -- C:\Windows\System32\SaErHdlr.dll [2010.10.18 16:28:32 | 000,022,723 | ---- | C] () -- C:\Windows\System32\sse1ml3.dll [2010.03.05 20:09:24 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2010.03.05 20:07:36 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2010.03.05 20:07:36 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2010.03.05 15:26:58 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2010.02.28 21:54:28 | 000,261,632 | ---- | C] () -- C:\Windows\PEV.exe [2010.02.28 21:54:28 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe [2009.09.16 21:34:05 | 018,015,723 | ---- | C] () -- C:\ProgramData\vlc-1.0.1-win32.exe [2009.08.31 23:00:16 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2009.08.03 20:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll [2009.08.03 20:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe [2009.05.02 16:53:39 | 000,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI [2009.04.04 11:12:32 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat [2008.06.09 19:41:03 | 000,001,644 | ---- | C] () -- C:\Windows\ODBCINST.INI [2008.06.09 19:39:11 | 000,045,056 | ---- | C] () -- C:\Windows\System32\lexazdll32.dll [2007.12.04 21:57:42 | 000,000,016 | -H-- | C] () -- C:\ProgramData\mxfilerelatedcache.mxc2 [2007.11.19 21:20:45 | 000,006,324 | ---- | C] () -- C:\Users\oem\AppData\Local\d3d9caps.dat [2007.10.20 02:56:16 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2007.10.09 20:07:11 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2007.10.05 12:30:19 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2007.09.10 21:16:49 | 000,040,960 | ---- | C] () -- C:\Users\oem\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.08.24 21:03:33 | 000,000,660 | ---- | C] () -- C:\Windows\ODBC.INI [2007.08.17 10:03:34 | 000,000,016 | ---- | C] () -- C:\Users\oem\AppData\Roaming\mxfilerelatedcache.mxc2 [2007.08.17 10:03:34 | 000,000,016 | ---- | C] () -- C:\Users\oem\AppData\Local\mxfilerelatedcache.mxc2 [2007.08.01 11:14:03 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ3.dat [2007.08.01 11:14:03 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ2.dat [2007.08.01 11:14:03 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat [2007.08.01 11:14:03 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat [2007.04.17 13:53:06 | 000,701,840 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll [2007.04.17 13:53:06 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll [2007.04.16 08:35:21 | 000,006,642 | ---- | C] () -- C:\Windows\mgxoschk.ini [2007.04.16 08:02:55 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI [2007.04.16 07:26:26 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini [2007.04.16 07:26:26 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll [2007.04.16 07:26:26 | 000,010,146 | ---- | C] () -- C:\Windows\System32\tosmreg.ini [2007.04.16 07:26:26 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini [2007.04.16 07:23:35 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2007.04.16 06:38:28 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1227.dll [2006.12.05 13:05:06 | 000,114,688 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll [2006.11.24 07:48:44 | 000,036,864 | ---- | C] () -- C:\Windows\System32\HWS_Ctrl.dll [2006.11.02 17:33:31 | 000,621,942 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2006.11.02 17:33:31 | 000,123,666 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 000,279,240 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,590,082 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,102,094 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2005.11.23 14:55:42 | 000,024,576 | ---- | C] () -- C:\Windows\System32\SPCtl.dll [2005.07.22 21:30:20 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll [2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI ========== LOP Check ========== [2011.09.27 13:02:21 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\Dropbox [2008.06.09 19:41:19 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\dtv-lexikon [2008.07.27 01:48:02 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\ICQ [2011.09.27 10:05:47 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\JabRef 2.6 [2007.12.02 19:27:49 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\Leadertech [2011.09.02 09:42:16 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\LyX2.0 [2010.07.18 16:42:16 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\MAGIX [2010.03.04 00:12:04 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\Opera [2011.09.27 10:05:52 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\PhotoFiltre [2007.10.05 11:51:53 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\TOSHIBA [2011.09.27 10:05:52 | 000,000,000 | ---D | M] -- C:\Users\oem\AppData\Roaming\VSO [2011.09.29 18:50:49 | 000,032,558 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.06.17 08:17:47 | 000,000,414 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{2424B260-0474-4731-96D8-80148C7DAAB4}.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 85 bytes -> C:\Users\oem\Desktop\IMG_9532.JPG:VsoSummaryInformation @Alternate Data Stream - 85 bytes -> C:\Users\oem\Desktop\IMG_8468.JPG:VsoSummaryInformation < End of report > Code:
ATTFilter OTL Extras logfile created on: 29.09.2011 20:50:39 - Run 2
OTL by OldTimer - Version 3.2.29.1 Folder = D:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,49 Gb Total Physical Memory | 0,79 Gb Available Physical Memory | 31,67% Memory free
5,19 Gb Paging File | 3,30 Gb Available in Paging File | 63,47% Paging File free
Paging file location(s): ?:\pagefile.sys
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 16,88 Gb Free Space | 22,65% Space Free | Partition Type: NTFS
Drive D: | 3,82 Gb Total Space | 2,10 Gb Free Space | 54,87% Space Free | Partition Type: FAT32
Drive E: | 73,06 Gb Total Space | 29,78 Gb Free Space | 40,76% Space Free | Partition Type: NTFS
Computer Name: OEM-PC | User Name: oem | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- Reg Error: Key error. File not found
.cmd [@ = cmdfile] -- Reg Error: Key error. File not found
.com [@ = ComFile] -- Reg Error: Key error. File not found
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.pif [@ = piffile] -- Reg Error: Key error. File not found
.vbs [@ = VBSFile] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01518295-B0C3-4B0B-A9C3-C3062648F6DE}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{11B0CD8F-EA07-491F-A311-79110A599B37}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{2E70B345-AFA0-45B0-AB2B-5EEF8832A0A1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{42319464-8FDD-4A21-9F9A-2AAF99A4DFB6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4EF4A94F-C72C-4248-B745-C47622BE4E15}" = lport=2869 | protocol=6 | dir=in | app=system |
"{530BA87F-A36A-435A-807E-508D8229FCC5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{573A1267-3881-4B01-8DA8-25C3B3AE1AD3}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{6624A5AC-A4DD-4954-BECA-3F4ED1E020F3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{69C9F578-5C36-44F6-8BC9-4B8246A73F14}" = lport=2869 | protocol=6 | dir=in | app=system |
"{81163D97-F600-4719-9DD7-BF66B5D3E18F}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{9F7A7C1C-28D7-4CDA-9A72-B2906B2EE6CB}" = lport=139 | protocol=6 | dir=in | app=system |
"{AB5A2F21-07CA-43F1-BCEF-637724C8AA3F}" = rport=445 | protocol=6 | dir=out | app=system |
"{B308AFDE-8657-428D-92EF-FBEDCDE34B0C}" = lport=137 | protocol=17 | dir=in | app=system |
"{B3836E45-1313-4FCD-A923-D42A01128863}" = rport=138 | protocol=17 | dir=out | app=system |
"{C225DBC5-1E68-4448-A87A-8787C953FFF2}" = rport=137 | protocol=17 | dir=out | app=system |
"{C2EEB55C-C4E1-495E-93A6-216A00D1C2C5}" = lport=445 | protocol=6 | dir=in | app=system |
"{D469BEA8-DE78-45AD-9E12-49B6AE297B94}" = rport=2869 | protocol=6 | dir=out | app=system |
"{E083F2B0-95D0-4BCC-8F7B-630FC4DA56C3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{E1E41979-3161-4596-BE97-BFBF37017708}" = lport=138 | protocol=17 | dir=in | app=system |
"{F6EEC5E3-8335-40C4-9D9F-B1DDE85A5552}" = rport=139 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02F7A30F-A626-4FD8-8E17-2BEB97833487}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{08B1A971-718B-4D9D-B462-4270FE631AE3}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
"{12C08164-28B1-46C2-B303-D8CA1BD745CE}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{1A22BFE6-8D19-4BF6-B459-034C8B3BD8AA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{5D5100C3-30A7-4664-B290-BF2D9C1B8044}" = protocol=6 | dir=in | app=c:\program files\apexdc++\apexdc.exe |
"{5F45DBB5-A145-47E4-88B4-59E764244329}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{75E1F1E1-EEED-4029-9501-994E18178C3F}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
"{802F0511-3496-4229-A067-7EFBCE1BA5AE}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
"{8B89D3B5-E080-430F-A2E1-3F6FF1A2B34B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{99905E91-B6A7-4D60-8B46-52BF3DF9F5B0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{B644353B-6ACA-4D71-8326-64FFC2C60079}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{C8D1FA9A-9E80-48B0-B4FA-8749ACC2EDF6}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{D780ECAD-01E8-4797-94FB-ABAF32A0DD8D}" = protocol=17 | dir=in | app=c:\program files\apexdc++\apexdc.exe |
"{E98B93E5-882B-4577-A497-D650EB38EA6F}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{EB7E098F-0C6F-423E-A418-718ADFEFF1C9}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
"{EDEDC3A3-A1CF-4D95-A92B-F9D3E1657E9A}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{FBC907E1-21C5-4F6C-9E77-6F9A295425F8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"TCP Query User{05EAA124-20BD-43A2-8BFD-42E60D62DAF0}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{0B3435B2-63C7-4A8E-9E3D-8EC777857F22}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"TCP Query User{30500507-3252-483D-9E72-9054F9A848DC}C:\program files\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files\trillian\trillian.exe |
"TCP Query User{768A4AB1-DAA2-41ED-BE9A-5B0EA455607D}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{CCF97235-6513-416D-98A9-1AFAF9744F5E}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{DEF1BBA9-5582-43AE-9DC3-143754B4D21D}C:\program files\apexdc++\apexdc.exe" = protocol=6 | dir=in | app=c:\program files\apexdc++\apexdc.exe |
"UDP Query User{22D286A4-329E-4AD5-BE2D-EBB3824C5E87}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{4014142A-526A-4616-9EE9-10DD2D3D7D9A}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{6BAD0D87-16DF-4A32-AEBF-8D3FFAE5F498}C:\program files\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files\trillian\trillian.exe |
"UDP Query User{C60B14C4-95F1-4A4C-B57B-4F83AAE9180B}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{C70DF6F0-6F90-44E5-B980-CD827443047F}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{D3E092CC-8E80-4825-806E-84084E0D46B2}C:\program files\apexdc++\apexdc.exe" = protocol=17 | dir=in | app=c:\program files\apexdc++\apexdc.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{13A5E785-5197-4EAD-8EE3-D660271E49BC}" = Feedback Tool
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27
"{2BC21CD2-8053-406A-80F6-9AB61717B49D}" = ODF Add-In für Microsoft Office
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 3.0.1.72
"{43D1A6DC-F2D3-4EBC-8851-CC8B9C0C8763}_is1" = ApexDC++ 1.4.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}" = TOSHIBA ConfigFree
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Matrix Storage Manager
"{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A6D4234C-CB02-4048-AC3E-AD09404FA35A}" = Emdedded IR Driver
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C73CA646-73B3-4AEF-A136-C37505745174}" = iTunes
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Aspell" = Aspell Data
"Aspell6-Dictionary-de" = Aspell 0.6 Dictionary (Language: de)
"Aspell6-Dictionary-en" = Aspell 0.6 Dictionary (Language: en)
"Aspell6-Dictionary-es" = Aspell 0.6 Dictionary (Language: es)
"Aspell6-Dictionary-pt_BR" = Aspell 0.6 Dictionary (Language: pt_BR)
"Aspell6-Dictionary-pt_PT" = Aspell 0.6 Dictionary (Language: pt_PT)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"DivX Setup.divx.com" = DivX-Setup
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisorkennwort
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"InstallShield_{A6D4234C-CB02-4048-AC3E-AD09404FA35A}" = Emdedded IR Driver
"InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"LyX20" = LyX 2.0.0-3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MiKTeX 2.9" = MiKTeX 2.9
"Mozilla Firefox 6.0.2 (x86 de)" = Mozilla Firefox 6.0.2 (x86 de)
"Samsung SCX-4300 Series" = Samsung SCX-4300 Series
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 6" = TeamViewer 6
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"VLC media player" = VLC media player 1.1.9
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"WinLiveSuite_Wave3" = Windows Live Essentials
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 28.09.2011 13:58:57 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 28.09.2011 13:58:57 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 28.09.2011 13:58:57 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 28.09.2011 13:58:57 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 28.09.2011 13:58:57 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 28.09.2011 13:58:57 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 28.09.2011 13:58:57 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 28.09.2011 13:58:57 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 28.09.2011 13:58:57 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
Error - 28.09.2011 13:58:57 | Computer Name = oem-PC | Source = Windows Search Service | ID = 3013
Description =
[ Media Center Events ]
Error - 16.04.2008 06:28:16 | Computer Name = oem-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: Download von Paket MCESpotlight
gescheitert.
[ System Events ]
Error - 29.09.2011 03:07:48 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 29.09.2011 03:07:48 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 29.09.2011 12:36:35 | Computer Name = oem-PC | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 10.196.34.241 deaktiviert,
da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der
die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die
IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb
dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
Error - 29.09.2011 12:37:13 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 29.09.2011 12:37:13 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 29.09.2011 12:37:13 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 29.09.2011 12:54:31 | Computer Name = oem-PC | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 10.196.34.241 deaktiviert,
da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der
die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die
IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb
dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
Error - 29.09.2011 12:55:27 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 29.09.2011 12:55:27 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
Error - 29.09.2011 12:55:27 | Computer Name = oem-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
|
|
30.09.2011, 12:27
| #6 |
| | TR/Spy.Web.H und windows-virus w32/Indus.A, schwarzer Bildschirm, scheinbar alle Dateien weg 4. SuperAntiSpyware logfile: Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 09/29/2011 at 10:30 PM
Application Version : 5.0.1128
Core Rules Database Version : 7737
Trace Rules Database Version: 5549
Scan type : Complete Scan
Total Scan Time : 01:26:17
Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Limited User (Administrator User)
Memory items scanned : 691
Memory threats detected : 0
Registry items scanned : 36554
Registry threats detected : 0
File items scanned : 44611
File threats detected : 431
Adware.Tracking Cookie
.msnportal.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.zanox-affiliate.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.fastclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.fastclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adopt.euroclick.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
zbox.zanox.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.bs.serving-sys.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
www.zanox-affiliate.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
www.zanox-affiliate.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
adserver.71i.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tribalfusion.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.yieldmanager.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
statse.webtrendslive.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ad.yieldmanager.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tto2.traffictrack.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
adsrv.admediate.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
adsrv.admediate.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adviva.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.fastclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.fastclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
rotator.adjuggler.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
rotator.adjuggler.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.googleadservices.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
a7.adserver01.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adviva.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.xiti.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.bluestreak.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.euros4click.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ice.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.247realmedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.casalemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tacoda.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tacoda.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tacoda.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.247realmedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.im.banner.t-online.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.euroclick.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.fastclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.euros4click.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
a7.adserver01.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tracking.mindshare.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
tracking.mindshare.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.hitbox.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.count.xhit.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.divx.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.vodafonegroup.122.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.valueclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.wetterstationen.meteomedia.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.guj.122.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
tracking.quisma.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.bs.serving-sys.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.kontera.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
adsrv1.admediate.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.pointroll.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.pointroll.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.pointroll.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.pointroll.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.pointroll.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.pointroll.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ads.pointroll.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.stepstone.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.socialmedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.revenue.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.lfstmedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.lfstmedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adserver.adtechus.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.yadro.ru [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
track.webtrekk.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
tracking.interaktivfabrik.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.clickandload.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.clickandload.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.clickandload.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.clickandload.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.clickandload.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.clickandload.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.hasenet.122.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.im.banner.t-online.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
s02.flagcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.himedia.individuad.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.sifomedia.qx.se [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
a7.adserver01.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
cdn5.specificclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
cdn5.specificclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.goodadvert.ru [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.goodadvert.ru [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.media.photobucket.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.countomat.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.yieldmanager.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adition.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adition.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
advertising.superweb.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.wissende.122.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
fr.sitestat.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
www.countertracker.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
www.countertracker.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
account.live.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
account.live.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.msnaccountservices.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
stat.dealtime.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.dealtime.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
sdc.webtrendslive.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ehg-upcchellomedia.hitbox.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
adserver.sevenload.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.iacas.adbureau.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
banner.testberichte.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.sonyeurope.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads.realmedia.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
c.trafficed.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
track.webtrekk.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.euros4click.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
s04.flagcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ad.adnet.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ad.adnet.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.4stats.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
adserver.sexation.info [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.travelscout24.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.pro-market.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.e-2dj6whk4gicjmho.stats.esomniture.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wjkywocjogo.stats.esomniture.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wfmykiazsao.stats.esomniture.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wfkowlczoco.stats.esomniture.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
stat.onestat.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
stat.onestat.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ads2.medianord.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.at.atwola.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.trvlnet.adbureau.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.bizrate.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.estat.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
traffic.buyservices.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.buycom.122.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.buycom.db.advertising.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.bizrate.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.insightexpressai.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.insightexpressai.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.insightexpressai.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.insightexpressai.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.insightexpressai.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.paypal.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.mmedia.t134.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adserv.quality-channel.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
s4.trafficmaxx.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.de.at.atwola.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.stats4u.traffic4u.nl [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.wallaby.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
nedstat.hostelbookers.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
nedstat.hostelbookers.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.euros4click.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.euros4click.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
tam.ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.b2wviagens.122.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
mfp1.adnetwork.com.br [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.opodo.122.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
track.effiliation.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.zedo.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.zedo.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.fortunecity.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.casalemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.casalemedia.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.fortunecity.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.fortunecity.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.ad.adnet.biz [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.at.atwola.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.highbeam.122.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.clickbank.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
optimize.indieclick.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.adserver01.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
server.iad.liveperson.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
server.iad.liveperson.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.media4ways.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.media4ways.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
stats.andreas-kinkel.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.chitika.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.tracking.3gnet.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.www.traffictrack.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.kaspersky.122.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
track.webtrekk.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
adx.chip.de [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.microsoftwindows.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
.microsoftsto.112.2o7.net [ C:\SANDBOX\OEM\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DAI13T6B.DEFAULT\COOKIES.SQLITE ]
C:\USERS\CHEF\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CHEF@ADFARM1.ADITION[1].TXT [ /ADFARM1.ADITION ]
C:\USERS\CHEF\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CHEF@ATDMT[1].TXT [ /ATDMT ]
C:\USERS\CHEF\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CHEF@BS.SERVING-SYS[1].TXT [ /BS.SERVING-SYS ]
C:\USERS\CHEF\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CHEF@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]
C:\USERS\CHEF\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CHEF@MSNPORTAL.112.2O7[1].TXT [ /MSNPORTAL.112.2O7 ]
C:\USERS\CHEF\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CHEF@SERVING-SYS[1].TXT [ /SERVING-SYS ]
C:\USERS\CHEF\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CHEF@STUDIVZ.ADFARM1.ADITION[2].TXT [ /STUDIVZ.ADFARM1.ADITION ]
C:\USERS\CHEF\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\CHEF@TRADEDOUBLER[2].TXT [ /TRADEDOUBLER ]
.atdmt.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.zanox-affiliate.de [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
www.zanox-affiliate.de [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
ad2.adfarm1.adition.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.msnportal.112.2o7.net [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
statse.webtrendslive.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.content.yieldmanager.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\CHEF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0TRIV9QP.DEFAULT\COOKIES.SQLITE ]
Trojan.Agent/Gen-Cryptor[Virut]
C:\TOSHIBA\EBAY\ADDTOOLBARBUTTON.EXE
Ansonsten scheint alles zu funktionieren, nur kommt mir mein Laptop langsamer vor als vor dem Angriff... Welches Virenprogramm würdest du mir denn empfehlen? Antivir hat ja leider versagt  Vielen Dank für die Hilfe!!! |
|
01.10.2011, 06:37
| #7 | |||
| /// Helfer-Team | TR/Spy.Web.H und windows-virus w32/Indus.A, schwarzer Bildschirm, scheinbar alle Dateien wegZitat:
Zitat:
Zitat:
 Hier die häufigsten Ursachen - Denk- und Anwendungsfehler im Umgang mit Computern: Ungepatchte Windows und veraltete Software-Versionen verwenden Öffnen eines infizierten E-Mail-Anhangs Verseuchte USB-Geräte von ein Guter Freund nützen auf "unsicheren" Seiten surfen (z.B Warez) Filesharing-Netzwerk eMule & Co Cracks & Keygens runterladen usw 1. Programme deinstallieren/entfernen, die wir verwendet haben und nicht brauchst, bis auf: Code:
ATTFilter CCleaner -> Zeitweise laufen lassen:-> Anleitung Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
3. reinige dein System mit Ccleaner:
4. Erstelle manuell einen Wiederherstellungspunkt: Aktivieren und Deaktivieren der Systemwiederherstellung 5. Ändere deine Passworte und Zugangsdaten! - von einem sauberen System aus - Alle Passwörter, die auf dem kompromittierten System verwendet wurden (also z.B. Login-, Mail- oder Website-Passwörter, aber auch die PIN für das Online-Banking) sofort ändern (► am besten von einem anderen, nicht-infizierten Rechner aus! ) Tipps: Die sichere Passwort-Wahl - (sollte man eigentlich regelmäßigen Abständen ca. alle 3-5 Monate ändern) auch noch hier unter: Sicheres Kennwort (Password) 6. Punkt 9. - fehlt noch:-> http://www.trojaner-board.de/103691-...tml#post705498 7. HijackThis starten→ "Do a system scan and save a logfile" klicken→ das erhaltene Logfile "markieren" → "kopieren"→ hier in deinem Thread (rechte Maustaste) "einfügen"
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! |
|
| Themen zu TR/Spy.Web.H und windows-virus w32/Indus.A, schwarzer Bildschirm, scheinbar alle Dateien weg |
| anwendungen, avira, bildschirm, dateien, desktop, e-mail, error, fehler, festplatte, file, hardware, malware, meldung, neustart, nicht mehr, nicht mehr öffnen, office, ordner, programme, ram, schwarzer bildschirm, taskmanager, the file is corrupted, this, tr/spy.web.h, windows, write, zip-datei, öffnen |
.
Linear-Darstellung
