| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Backdoorprogramm BDS/Cycbot.176128.56Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
15.12.2011, 08:23
| #1 |
 |  Backdoorprogramm BDS/Cycbot.176128.56 Hallo, avira hat heute den Virus BDS/Cycbot.176128.56 bei mir gefunden. Ist jetzt noch in der Quarantäne. Außerdem habe ich seit gestern das Problem, dass ich wenn ich bei google auf einen link klicke auf eine völlig andere Seite geführt werde. Wer kann mir helfen? Habe Windows 7, 64bit. Weitere Angaben folgen noch. Viele Grüße Rheingold |
|
15.12.2011, 08:51
| #2 | ||
| /// Helfer-Team    | Backdoorprogramm BDS/Cycbot.176128.56 Hallo und Herzlich Willkommen!
__________________ Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]: Zitat:
Für Vista und Win7: Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen! 1. Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org
2. Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
3. Ich würde gerne noch all deine installierten Programme sehen: Lade dir das Tool CCleaner herunter → Download installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ Sprache → Deutsch auswählen dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..." wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein 4. Mache bitte ein Rechtsklick auf den AntiVir-Schirm in der Taskleiste → AntiVir starten → Übersicht → Ereignisse jeden Fund markieren → Rechtsklick auf Funde → Ereignis(se) exportieren und als Ereignisse.txt auf dem Desktop speichern und den Inhalt hier posten. Zitat:
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw grußkira
__________________ |
|
15.12.2011, 10:38
| #3 |
| | Backdoorprogramm BDS/Cycbot.176128.56 Liebe Kira, vielen Dank für deine Antwort.
__________________1. defogger hat, glaube ich, nicht funktioniert. Hier der defogger disable log: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 08:41 on 15/12/2011 (Jasmina)
Viele Grüße Jasmina Malwarebytes im Anhang OTL muss ich noch mal laufen lassen, logfilge ist nicht mehr lesbar. Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- 2. OTL |
|
15.12.2011, 11:59
| #4 |
| | Backdoorprogramm BDS/Cycbot.176128.56 sorry, muss zum job. bis später, jasmina |
|
16.12.2011, 09:38
| #5 |
| | Backdoorprogramm BDS/Cycbot.176128.56Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 8377
Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514
15.12.2011 21:45:19
mbam-log-2011-12-15 (21-45-19).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 479185
Laufzeit: 1 Stunde(n), 2 Minute(n), 29 Sekunde(n)
Infizierte Speicherprozesse: 3
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 1
Infizierte Dateien: 11
Infizierte Speicherprozesse:
c:\Users\administrator\AppData\Roaming\B8457\6D1A7.exe (Trojan.Dropper.PE4) -> 4112 -> Unloaded process successfully.
c:\program files (x86)\LP\A7CB\737.exe (Trojan.Dropper.PE4) -> 4652 -> Unloaded process successfully.
c:\program files (x86)\57168\lvvm.exe (Trojan.Dropper.PE4) -> 5224 -> Unloaded process successfully.
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\737.exe (Trojan.Dropper.PE4) -> Value: 737.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen) -> Value: Shell -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig (Windows.Tool.Disabled) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Infizierte Verzeichnisse:
c:\Users\nico.dell-pc.000\m-1-25-5432-6437-5685 (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
Infizierte Dateien:
c:\Users\administrator\AppData\Roaming\B8457\6D1A7.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\program files (x86)\LP\A7CB\737.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\program files (x86)\57168\lvvm.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\Jasmina\AppData\Roaming\firefox.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\Jasmina\AppData\Roaming\57168\lvvm.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\Jasmina\AppData\Roaming\B8457\6D1A7.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\Jasmina\AppData\Roaming\microsoft\A7CB\737.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\nico.dell-pc.000\AppData\Roaming\firefox.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\nico.dell-pc.000\AppData\Roaming\57168\lvvm.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\nico.dell-pc.000\AppData\Roaming\microsoft\A7CB\737.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\nico.dell-pc.000\m-1-25-5432-6437-5685\winmgr.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
|
|
16.12.2011, 09:42
| #6 |
| | Backdoorprogramm BDS/Cycbot.176128.56Code:
ATTFilter OTL logfile created on: 15.12.2011 19:58:30 - Run 8 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Administrator\Desktop\Virus\OTL 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,90 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 52,57% Memory free 7,79 Gb Paging File | 5,89 Gb Available in Paging File | 75,64% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 235,24 Gb Total Space | 112,40 Gb Free Space | 47,78% Space Free | Partition Type: NTFS Drive D: | 215,77 Gb Total Space | 206,35 Gb Free Space | 95,63% Space Free | Partition Type: NTFS Computer Name: DELL-PC | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Administrator\Desktop\Virus\OTL\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\57168\lvvm.exe () PRC - C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe () PRC - C:\Program Files (x86)\LP\A7CB\737.exe () PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) PRC - C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files (x86)\Secunia\PSI\PSIA.exe (Secunia) PRC - C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia) PRC - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS) PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe () PRC - C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (DATA BECKER GmbH & Co KG) PRC - C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe () PRC - C:\Windows\tray\wintmr.exe (Salfeld Computer) PRC - C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer) PRC - C:\Windows\SysWOW64\ccsync.exe (Salfeld Computer) PRC - C:\Windows\SysWOW64\cchservice.exe (Salfeld Computer) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\57168\lvvm.exe () MOD - C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe () MOD - C:\Program Files (x86)\LP\A7CB\737.exe () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\LibXml2.dll () MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe () MOD - C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe () ========== Win32 Services (SafeList) ========== SRV:64bit: - (TurboBoost) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation) SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_b427739.dll () SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (Kodak AiO Network Discovery Service) -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe (Secunia) SRV - (Secunia Update Agent) -- C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (Bluetooth OBEX Service) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) SRV - (Bluetooth Media Service) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation) SRV - (Bluetooth Device Monitor) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation) SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation) SRV - (MyWiFiDHCPDNS) -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe () SRV - (RegSrvc) Intel(R) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (RoxWatch12) -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe (Sonic Solutions) SRV - (RoxMediaDB12OEM) -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe (Sonic Solutions) SRV - (AdobeActiveFileMonitor9.0) -- C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (NOBU) -- C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe (Dell, Inc.) SRV - (ksupmgr) -- C:\Windows\SysWOW64\ksupmgr.exe (Salfeld Computer) SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS) SRV - (DBService) -- C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (DATA BECKER GmbH & Co KG) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (AERTFilters) -- C:\Programme\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (NBVol) -- C:\Windows\SysNative\drivers\NBVol.sys (Nero AG) DRV:64bit: - (NBVolUp) -- C:\Windows\SysNative\drivers\NBVolUp.sys (Nero AG) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (HPub4DE3) USB Mouse Low Filter Driver_4DE3 (WDF Version) -- C:\Windows\SysNative\drivers\HPub4DE3.sys (TPMX Electronics Ltd.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HPMo4DE3) Mouse Suite Driver_4DE3 (WDF Version) -- C:\Windows\SysNative\drivers\HPMo4DE3.sys (TPMX Electronics Ltd.) DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation) DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (btmaux) -- C:\Windows\SysNative\drivers\btmaux.sys (Intel Corporation) DRV:64bit: - (iBtFltCoex) -- C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation) DRV:64bit: - (btmhsf) -- C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (NETwNs64) ___ Intel(R) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation) DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics) DRV:64bit: - (NvStUSB) -- C:\Windows\SysNative\drivers\nvstusb.sys () DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation) DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys (Intel(R) Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation) DRV:64bit: - (MEIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (IntcDAud) Intel(R) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation) DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation) DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation) DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation) DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation) DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf.sys (Secunia) DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics) DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.) DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer) DRV:64bit: - (AVer7231_x64) -- C:\Windows\SysNative\drivers\AVer7231_x64.sys (AVerMedia TECHNOLOGIES, Inc.) DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions) DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation) DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH) DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (PDNMp50) -- C:\Windows\SysWOW64\drivers\PDNMp50.sys (Printing Communications Assoc., Inc. (PCAUSA)) DRV - (PDNSp50) -- C:\Windows\SysWOW64\drivers\PDNSp50.sys (Printing Communications Assoc., Inc. (PCAUSA)) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = IE - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50263 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "" FF - prefs.js..browser.search.defaultthis.engineName: "" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.selectedEngine: "" FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 50263 FF - prefs.js..network.proxy.type: 1 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF:64bit: - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll File not found FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.12.15 11:29:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.11 09:40:26 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.15 11:29:12 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files (x86)\Mozilla Sunbird\components [2011.12.15 11:29:01 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Sunbird\plugins [2011.12.15 11:29:12 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.11.11 18:53:38 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.05.19 12:42:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Extensions [2011.05.19 12:42:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011.09.12 11:27:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\3cers2zs.default\extensions [2011.11.11 09:40:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.10.01 08:52:30 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011.10.17 08:31:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} [2011.10.29 10:21:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2011.12.15 11:29:03 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT [2011.11.11 09:40:26 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.10.29 10:21:40 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011.09.16 21:59:18 | 000,170,064 | ---- | M] (Tracker Software Products Ltd.) -- C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll [2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.09.12 21:31:56 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation) O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe () O4:64bit: - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\SysNative\spool\drivers\x64\3\EKIJ5000MUI.exe (Eastman Kodak Company) O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe () O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation) O4:64bit: - HKLM..\Run: [NVHotkey] C:\Windows\SysNative\nvHotkey.dll (NVIDIA Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [737.exe] C:\Program Files (x86)\LP\A7CB\737.exe () O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe () O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" File not found O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [ChicoSys] C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer) O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe (Dell, Inc.) O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd) O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe () O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe File not found O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe (Nero AG) O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions) O4 - HKLM..\Run: [SMSTray] C:\Program Files (x86)\Samsung\EmoDio\SMSTray.exe (SAMSUNG ELECTRONICS) O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKU\.DEFAULT..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer) O4 - HKU\S-1-5-18..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer) O4 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-3230886925-126132133-2629391164-500..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background File not found O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks) O4 - HKU\.DEFAULT..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company) O4 - HKU\S-1-5-18..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company) O4 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Jasmina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk = File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8:64bit: - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Administrator\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Administrator\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Administrator\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Administrator\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C8601AA9-2FCA-424D-B13E-12984594DCE3}: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - AppInit_DLLs: (C:\Windows\System32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) -C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKU\S-1-5-21-3230886925-126132133-2629391164-500 Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKU\S-1-5-21-3230886925-126132133-2629391164-500 Winlogon: Shell - (C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe) -C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe () O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O32 - Unable to read "AutoRun" value or value not present! O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP CREATERESTOREPOINT Error creating restore point. ========== Files/Folders - Created Within 30 Days ========== [2011.12.15 11:50:27 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\SoftGrid Client [2011.12.15 11:50:25 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\SoftGrid Client [2011.12.15 11:47:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.12.15 11:47:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.12.15 11:35:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2011.12.15 11:34:51 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2011.12.15 11:34:50 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2011.12.15 11:34:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes [2011.12.15 11:29:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\xing shared [2011.12.15 11:29:01 | 000,198,832 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\SysWow64\rmoc3260.dll [2011.12.15 11:28:57 | 000,006,656 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\SysWow64\pndx5016.dll [2011.12.15 11:28:57 | 000,005,632 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\SysWow64\pndx5032.dll [2011.12.15 11:28:56 | 000,272,896 | ---- | C] (Progressive Networks) -- C:\Windows\SysWow64\pncrt.dll [2011.12.15 11:28:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Real [2011.12.15 11:25:22 | 000,713,472 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer.exe [2011.12.15 11:22:52 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\4d0d2e25 [2011.12.15 11:19:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\57168 [2011.12.15 11:19:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\B8457 [2011.12.15 11:14:51 | 009,852,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Program Files (x86)\mbam-setup-1.51.2.1300.exe [2011.12.15 10:41:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.12.15 10:41:55 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2011.12.15 10:39:52 | 003,552,208 | ---- | C] (Piriform Ltd) -- C:\Program Files (x86)\ccsetup313.exe [2011.12.15 08:29:11 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\Virus [2011.12.14 23:09:17 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll [2011.12.14 23:09:17 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll [2011.12.14 23:09:15 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll [2011.12.14 08:33:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LP [2011.12.02 16:28:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Nexon [2011.12.02 16:25:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexon [2011.12.02 16:22:22 | 000,000,000 | ---D | C] -- C:\ProgramData\NexonEU [2011.12.02 15:45:54 | 000,000,000 | ---D | C] -- C:\Download [2011.12.02 15:45:20 | 000,000,000 | ---D | C] -- C:\Nexon [2011.12.02 15:45:19 | 000,446,464 | ---- | C] (NEXON Inc.) -- C:\Windows\NEXON_EU_DownloaderUpdater.exe [2011.11.24 09:38:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak [2011.11.24 09:36:02 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\spool [2011.11.24 09:23:29 | 012,713,136 | ---- | C] (Eastman Kodak Company) -- C:\Program Files (x86)\aio_install.exe [2011.11.18 13:07:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2011.11.18 10:33:58 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Temp [2011.10.29 11:49:39 | 039,401,336 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\QuickTimeInstaller.exe [2011.10.29 11:04:38 | 010,311,496 | ---- | C] (Opera Software ASA) -- C:\Program Files (x86)\Opera_1152_int_Setup.exe [2011.10.29 10:10:18 | 000,910,624 | ---- | C] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\jxpiinstall.exe [2011.10.25 12:17:18 | 009,756,672 | ---- | C] ((c) Phoenix Technologies Ltd. ) -- C:\Program Files\L502X_A__06.exe [2011.10.17 08:29:10 | 001,739,400 | ---- | C] (Secunia) -- C:\Program Files (x86)\PSISetup2003.exe [2011.10.17 08:05:48 | 013,885,360 | ---- | C] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 7.0.1.exe [2011.09.29 09:11:38 | 022,482,384 | ---- | C] (Salfeld Computer GmbH ) -- C:\Program Files (x86)\kisi2011.exe [2011.09.24 17:12:36 | 001,291,624 | ---- | C] (Microsoft Corporation) -- C:\Program Files\wlsetup-web__1_.exe [2011.09.23 14:09:00 | 000,676,624 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer_1406666_de.exe [2011.09.22 10:34:36 | 003,089,056 | ---- | C] (Adobe Systems, Inc.) -- C:\Program Files (x86)\install_flash_player.exe [2011.08.28 11:11:15 | 051,975,388 | ---- | C] (Acresso Software Inc.) -- C:\Program Files (x86)\VSX4_Pro_TBYB.exe.part [2011.08.27 11:56:04 | 001,228,384 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files (x86)\PremiereElements_9_LS15.exe [2011.08.25 17:58:21 | 006,716,353 | ---- | C] (Mozilla) -- C:\Program Files (x86)\Sunbird_Setup_1.0_Beta_1.exe [2011.07.18 15:59:52 | 013,522,064 | ---- | C] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 5.0.1.exe [2011.05.28 13:13:41 | 014,212,584 | ---- | C] (DVDVideoSoft Ltd. ) -- C:\Program Files (x86)\FreeYouTubeToiPodConverter.exe [2011.05.28 13:11:38 | 014,563,768 | ---- | C] (DVDVideoSoft Ltd. ) -- C:\Program Files (x86)\FreeYouTubeToMP3Converter.exe [2011.05.22 09:35:05 | 021,255,560 | ---- | C] (Skype Technologies S.A.) -- C:\Program Files (x86)\SkypeSetupFull.exe [2011.05.19 14:37:24 | 081,797,928 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\iTunes64Setup.exe [2011.05.19 14:17:51 | 020,240,744 | ---- | C] (The GIMP Team ) -- C:\Program Files (x86)\gimp-2.6.11-i686-setup.exe [2011.05.19 14:17:11 | 019,735,256 | ---- | C] ( ) -- C:\Program Files (x86)\gimp-2.6.8-x64-setup.exe [2011.05.19 14:06:00 | 000,767,064 | ---- | C] (NCH Software) -- C:\Program Files (x86)\wpsetup4.57.exe [2011.05.19 12:34:44 | 000,568,648 | ---- | C] (Google Inc.) -- C:\Program Files (x86)\GoogleEarthSetup.exe [2011.05.19 12:26:57 | 009,559,320 | ---- | C] (Opera Software ASA) -- C:\Program Files (x86)\Opera_1111_int_Setup.exe [2011.05.19 12:26:00 | 009,326,056 | ---- | C] (Mozilla) -- C:\Program Files (x86)\Thunderbird Setup 3.1.10.exe [2011.05.19 12:25:04 | 012,362,480 | ---- | C] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 4.0.1.exe [10 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.12.15 19:59:33 | 000,055,163 | ---- | M] () -- C:\Windows\SysWow64\ccsync.err [2011.12.15 19:57:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004UA.job [2011.12.15 19:45:09 | 000,005,142 | ---- | M] () -- C:\Windows\SysWow64\cchservice.err [2011.12.15 19:40:42 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.12.15 19:40:42 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.12.15 19:30:21 | 000,001,207 | ---- | M] () -- C:\Windows\SysWow64\excltmp~.dat [2011.12.15 19:30:16 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.12.15 19:28:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.12.15 19:28:47 | 3137,994,752 | -HS- | M] () -- C:\hiberfil.sys [2011.12.15 19:06:12 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.12.15 11:47:50 | 000,001,162 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.12.15 11:35:17 | 000,001,836 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2011.12.15 11:29:09 | 000,001,308 | ---- | M] () -- C:\Users\Public\Desktop\RealPlayer.lnk [2011.12.15 11:29:01 | 000,198,832 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\SysWow64\rmoc3260.dll [2011.12.15 11:28:57 | 000,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\SysWow64\pndx5016.dll [2011.12.15 11:28:57 | 000,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\SysWow64\pndx5032.dll [2011.12.15 11:28:56 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\Windows\SysWow64\pncrt.dll [2011.12.15 11:27:59 | 000,000,948 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1025UA.job [2011.12.15 11:25:23 | 000,713,472 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer.exe [2011.12.15 11:22:41 | 001,500,062 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.12.15 11:22:41 | 000,654,798 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.12.15 11:22:41 | 000,616,640 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.12.15 11:22:41 | 000,130,380 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.12.15 11:22:41 | 000,106,762 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.12.15 11:18:00 | 000,000,936 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003UA.job [2011.12.15 11:14:56 | 009,852,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Program Files (x86)\mbam-setup-1.51.2.1300.exe [2011.12.15 10:41:56 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.12.15 10:39:52 | 003,552,208 | ---- | M] (Piriform Ltd) -- C:\Program Files (x86)\ccsetup313.exe [2011.12.15 08:25:41 | 000,353,408 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.12.15 08:02:34 | 000,000,118 | ---- | M] () -- C:\Windows\SysNative\MRT.INI [2011.12.14 21:33:43 | 000,000,348 | ---- | M] () -- C:\NET.INI [2011.12.14 20:28:00 | 000,000,926 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1025Core.job [2011.12.14 20:18:00 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003Core.job [2011.12.14 08:38:37 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2011.12.14 08:38:00 | 000,000,390 | ---- | M] () -- C:\Windows\tasks\At2.job [2011.12.14 08:34:00 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\At1.job [2011.12.12 16:57:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004Core.job [2011.12.02 16:25:10 | 000,001,632 | ---- | M] () -- C:\Users\Public\Desktop\Combat Arms EU.lnk [2011.12.02 15:45:20 | 000,000,235 | ---- | M] () -- C:\Windows\SysWow64\nxEuUninstall.bat [2011.12.02 15:45:19 | 000,446,464 | ---- | M] (NEXON Inc.) -- C:\Windows\NEXON_EU_DownloaderUpdater.exe [2011.11.24 09:39:41 | 000,002,209 | ---- | M] () -- C:\Users\Public\Desktop\KODAK AiO Home Center.lnk [2011.11.24 09:23:39 | 012,713,136 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\aio_install.exe [2011.11.18 13:07:22 | 000,002,265 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk [10 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] [1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.12.15 18:48:38 | 000,054,813 | ---- | C] () -- C:\Windows\SysWow64\ccsync.err [2011.12.15 11:47:50 | 000,001,162 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.12.15 11:35:17 | 000,001,836 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2011.12.15 11:29:09 | 000,001,308 | ---- | C] () -- C:\Users\Public\Desktop\RealPlayer.lnk [2011.12.15 10:41:56 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.12.15 08:02:34 | 000,000,118 | ---- | C] () -- C:\Windows\SysNative\MRT.INI [2011.12.14 08:37:13 | 000,000,390 | ---- | C] () -- C:\Windows\tasks\At2.job [2011.12.14 08:33:19 | 000,000,408 | ---- | C] () -- C:\Windows\tasks\At1.job [2011.12.02 16:25:10 | 000,001,632 | ---- | C] () -- C:\Users\Public\Desktop\Combat Arms EU.lnk [2011.12.02 15:45:20 | 000,000,235 | ---- | C] () -- C:\Windows\SysWow64\nxEuUninstall.bat [2011.11.24 09:39:41 | 000,002,209 | ---- | C] () -- C:\Users\Public\Desktop\KODAK AiO Home Center.lnk [2011.11.18 13:07:22 | 000,002,265 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk [2011.11.11 07:32:42 | 001,527,140 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.10.29 09:54:07 | 001,019,816 | ---- | C] () -- C:\Program Files\DELL_DELL-DIGITAL-DELIVERY_A05_R313622.exe [2011.10.10 16:51:50 | 000,155,536 | ---- | C] () -- C:\Windows\SysWow64\dllcinx.exe [2011.10.10 16:51:48 | 000,000,600 | ---- | C] () -- C:\Windows\SysWow64\nochook.ini [2011.10.03 13:41:52 | 000,247,053 | ---- | C] () -- C:\Program Files (x86)\mp3DC213.exe [2011.09.29 09:19:37 | 000,001,207 | ---- | C] () -- C:\Windows\SysWow64\excltmp~.dat [2011.09.29 09:18:42 | 000,000,141 | -H-- | C] () -- C:\Windows\SysWow64\ctlsw.ini [2011.09.29 09:18:42 | 000,000,102 | ---- | C] () -- C:\Windows\SysWow64\SWCTL.DLL [2011.09.29 09:18:40 | 000,009,368 | ---- | C] () -- C:\Windows\SysWow64\drivers\mchccinj.sys [2011.09.29 08:11:44 | 000,124,416 | ---- | C] () -- C:\Windows\SysWow64\dXCtrls.dll [2011.09.29 08:11:43 | 000,544,256 | ---- | C] () -- C:\Windows\SysWow64\janGraphics.dll [2011.09.29 07:55:01 | 003,103,511 | ---- | C] () -- C:\Program Files (x86)\kcsetup8.exe [2011.09.23 14:05:53 | 021,073,936 | ---- | C] () -- C:\Program Files (x86)\vlc-1.1.11-win32.exe [2011.09.23 12:51:28 | 000,003,027 | ---- | C] () -- C:\Program Files (x86)\Français.lng [2011.09.23 12:51:28 | 000,002,946 | ---- | C] () -- C:\Program Files (x86)\Español.lng [2011.09.23 12:51:28 | 000,002,920 | ---- | C] () -- C:\Program Files (x86)\Italiano.lng [2011.09.23 12:51:28 | 000,002,699 | ---- | C] () -- C:\Program Files (x86)\Deutsch.lng [2011.09.23 12:51:28 | 000,002,553 | ---- | C] () -- C:\Program Files (x86)\Suomi.lng [2011.09.23 12:40:52 | 023,773,184 | ---- | C] () -- C:\Program Files (x86)\PXCViewer98_x64.msi [2011.09.23 12:27:47 | 001,376,768 | ---- | C] () -- C:\Program Files (x86)\7z920-x64.msi [2011.09.16 06:44:01 | 168,166,968 | ---- | C] () -- C:\Program Files (x86)\OOo_3.3.0_Win_x86_install-wJRE_de.exe [2011.08.28 09:55:59 | 002,466,704 | ---- | C] () -- C:\Program Files (x86)\AdobeDownloadAssistant.exe [2011.08.27 11:27:07 | 1316,066,539 | ---- | C] () -- C:\Program Files (x86)\PremiereElements_9_LS15.7z [2011.08.27 11:23:03 | 008,353,800 | ---- | C] () -- C:\Program Files (x86)\Adobe_Premiere_Elements_9-AkamaiDLM.exe [2011.05.19 14:44:09 | 001,663,693 | ---- | C] () -- C:\Program Files (x86)\winrar-x64-400d.exe [2011.05.19 14:10:20 | 014,166,016 | ---- | C] () -- C:\Program Files (x86)\wz150gev.msi [2011.05.19 14:09:07 | 006,088,218 | ---- | C] () -- C:\Program Files (x86)\flash_player.zip [2011.05.19 13:52:49 | 000,000,056 | ---- | C] () -- C:\Windows\SysWow64\ezsidmv.dat [2011.05.19 12:39:40 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2011.05.19 12:28:56 | 052,718,176 | ---- | C] () -- C:\Program Files (x86)\avira_antivir_personal_de.exe [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_89001461_aa.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_49001461_aa.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_33011461_aa.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_ca.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_aa.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_8a.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A0F1461_ca.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_ca.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_aa.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_8a.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_14001461_61.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_13011461_aa.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_ca.bin [2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_8a.bin [2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_ca.bin [2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_aa.bin [2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_8a.bin [2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_ca.bin [2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_aa.bin [2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_8a.bin [2011.05.15 06:48:49 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_890F1461_ca.bin [2011.05.15 06:48:49 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_2B0f1461_ca.bin [2011.05.15 06:48:49 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_29001461_ca.bin [2011.05.15 06:48:49 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_180F1461_ca.bin [2011.05.15 06:48:49 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_18071461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_8a.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_ca.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_8a.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A0F1461_ca.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_ca.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_8a.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_ca.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_ca.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_09001461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_08071461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_060F1461_ca.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_8a.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_8a.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_8a.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_ca.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_8a.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_aa.bin [2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_8a.bin [2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_07031461_aa.bin [2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_ca.bin [2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_aa.bin [2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_8a.bin [2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03131461_8a.bin [2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03031461_aa.bin [2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_ca.bin [2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_aa.bin [2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_8a.bin [2011.05.15 06:48:48 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_0B0f1461_ca.bin [2011.05.15 06:48:48 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_090F1461_ca.bin [2011.05.15 06:48:48 | 000,000,376 | ---- | C] () -- C:\Windows\11317231_03131461_aa.bin [2011.05.15 06:48:47 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_00000000_aa.bin [2011.05.15 06:48:11 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll [2011.05.15 06:47:21 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2011.05.15 06:47:19 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2011.05.15 06:47:17 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin [2011.01.19 12:34:42 | 003,003,392 | ---- | C] () -- C:\Program Files (x86)\openofficeorg33.msi [2011.01.19 12:33:04 | 000,475,016 | ---- | C] () -- C:\Program Files (x86)\setup.exe [2011.01.19 12:30:10 | 142,700,671 | ---- | C] () -- C:\Program Files (x86)\openofficeorg1.cab [2011.01.19 11:15:26 | 000,000,290 | ---- | C] () -- C:\Program Files (x86)\setup.ini [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [2009.04.16 12:24:14 | 000,921,600 | ---- | C] () -- C:\Windows\SysWow64\vorbisenc.dll [2009.04.16 12:24:14 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\OggDS.dll [2009.04.16 12:24:14 | 000,188,416 | ---- | C] () -- C:\Windows\SysWow64\vorbis.dll [2009.04.16 12:24:14 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\Ogg.dll ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.09.29 10:09:32 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2011.12.15 11:35:27 | 000,000,000 | ---D | M] -- C:\Config.Msi [2011.10.29 09:58:05 | 000,000,000 | ---D | M] -- C:\dell [2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011.05.18 15:28:48 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.12.02 16:22:22 | 000,000,000 | ---D | M] -- C:\Download [2011.05.20 16:39:10 | 000,000,000 | ---D | M] -- C:\Drivers [2011.05.14 21:10:05 | 000,000,000 | ---D | M] -- C:\Intel [2011.06.21 20:48:05 | 000,000,000 | ---D | M] -- C:\Manual-PCProgram [2011.05.19 11:18:55 | 000,000,000 | ---D | M] -- C:\Netgear [2011.12.02 16:22:32 | 000,000,000 | ---D | M] -- C:\Nexon [2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.12.15 11:34:51 | 000,000,000 | R--D | M] -- C:\Program Files [2011.12.15 11:47:46 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2011.12.02 16:28:28 | 000,000,000 | ---D | M] -- C:\ProgramData [2011.05.18 15:28:48 | 000,000,000 | -HSD | M] -- C:\Programme [2011.05.18 15:33:52 | 000,000,000 | -HSD | M] -- C:\System Recovery [2011.12.15 11:54:14 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.12.15 11:25:57 | 000,000,000 | ---D | M] -- C:\Temp [2011.09.29 10:09:30 | 000,000,000 | R--D | M] -- C:\Users [2011.12.02 15:45:19 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > [2011.08.28 09:56:00 | 002,466,704 | ---- | M] () -- C:\Program Files (x86)\AdobeDownloadAssistant.exe [2011.08.27 11:23:09 | 008,353,800 | ---- | M] () -- C:\Program Files (x86)\Adobe_Premiere_Elements_9-AkamaiDLM.exe [2011.11.24 09:23:39 | 012,713,136 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\aio_install.exe [2011.05.19 12:28:56 | 052,718,176 | ---- | M] () -- C:\Program Files (x86)\avira_antivir_personal_de.exe [2011.12.15 10:39:52 | 003,552,208 | ---- | M] (Piriform Ltd) -- C:\Program Files (x86)\ccsetup313.exe [2011.05.19 12:25:09 | 012,362,480 | ---- | M] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 4.0.1.exe [2011.07.18 15:59:52 | 013,522,064 | ---- | M] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 5.0.1.exe [2011.10.17 08:05:48 | 013,885,360 | ---- | M] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 7.0.1.exe [2011.08.30 15:04:45 | 014,212,584 | ---- | M] (DVDVideoSoft Ltd. ) -- C:\Program Files (x86)\FreeYouTubeToiPodConverter.exe [2011.08.30 15:06:04 | 014,563,768 | ---- | M] (DVDVideoSoft Ltd. ) -- C:\Program Files (x86)\FreeYouTubeToMP3Converter.exe [2011.05.19 14:18:22 | 020,240,744 | ---- | M] (The GIMP Team ) -- C:\Program Files (x86)\gimp-2.6.11-i686-setup.exe [2011.05.19 14:17:51 | 019,735,256 | ---- | M] ( ) -- C:\Program Files (x86)\gimp-2.6.8-x64-setup.exe [2011.05.19 12:34:45 | 000,568,648 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\GoogleEarthSetup.exe [2011.09.23 12:31:50 | 003,089,056 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files (x86)\install_flash_player.exe [2011.05.19 14:39:47 | 081,797,928 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iTunes64Setup.exe [2011.10.29 10:17:09 | 000,910,624 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\jxpiinstall.exe [2011.09.29 07:55:01 | 003,103,511 | ---- | M] () -- C:\Program Files (x86)\kcsetup8.exe [2011.09.29 09:12:13 | 022,482,384 | ---- | M] (Salfeld Computer GmbH ) -- C:\Program Files (x86)\kisi2011.exe [2011.12.15 11:14:56 | 009,852,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Program Files (x86)\mbam-setup-1.51.2.1300.exe [2011.10.03 13:40:45 | 000,247,053 | ---- | M] () -- C:\Program Files (x86)\mp3DC213.exe [2011.09.16 06:47:25 | 168,166,968 | ---- | M] () -- C:\Program Files (x86)\OOo_3.3.0_Win_x86_install-wJRE_de.exe [2011.05.19 12:27:00 | 009,559,320 | ---- | M] (Opera Software ASA) -- C:\Program Files (x86)\Opera_1111_int_Setup.exe [2011.10.29 11:04:38 | 010,311,496 | ---- | M] (Opera Software ASA) -- C:\Program Files (x86)\Opera_1152_int_Setup.exe [2011.08.27 11:56:06 | 001,228,384 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\PremiereElements_9_LS15.exe [2011.10.17 08:29:10 | 001,739,400 | ---- | M] (Secunia) -- C:\Program Files (x86)\PSISetup2003.exe [2011.10.29 11:50:28 | 039,401,336 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\QuickTimeInstaller.exe [2011.12.15 11:25:23 | 000,713,472 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer.exe [2011.09.23 14:09:00 | 000,676,624 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer_1406666_de.exe [2011.01.19 12:33:04 | 000,475,016 | ---- | M] () -- C:\Program Files (x86)\setup.exe [2011.05.22 09:35:19 | 021,255,560 | ---- | M] (Skype Technologies S.A.) -- C:\Program Files (x86)\SkypeSetupFull.exe [2011.08.25 17:58:22 | 006,716,353 | ---- | M] (Mozilla) -- C:\Program Files (x86)\Sunbird_Setup_1.0_Beta_1.exe [2011.05.19 12:26:19 | 009,326,056 | ---- | M] (Mozilla) -- C:\Program Files (x86)\Thunderbird Setup 3.1.10.exe [2011.09.23 14:06:06 | 021,073,936 | ---- | M] () -- C:\Program Files (x86)\vlc-1.1.11-win32.exe [2011.05.19 14:44:11 | 001,663,693 | ---- | M] () -- C:\Program Files (x86)\winrar-x64-400d.exe [2011.05.19 14:06:01 | 000,767,064 | ---- | M] (NCH Software) -- C:\Program Files (x86)\wpsetup4.57.exe < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > [10 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < MD5 for: AFD.SYS > [2011.04.25 03:44:02 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=6EF20DDF3172E97D69F596FB90602F29 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16802_none_3430bc3977dfec2d\afd.sys [2009.07.14 00:21:42 | 000,500,224 | ---- | M] (Microsoft Corporation) MD5=B9384E03479D2506BC924C16A3DB87BC -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_33dd3439781e25f7\afd.sys [2010.11.20 10:23:34 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=D31DC7A16DEA4A9BAF179F3D6FBDB38C -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys [2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\SysNative\drivers\afd.sys [2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys [2011.04.25 04:09:35 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=F4AD06143EAC303F55D0E86C40802976 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys [2011.04.25 03:44:27 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=FBFF8B7C9D116229E9208A0D1CAEB49B -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.20951_none_3483491e9126fe55\afd.sys < MD5 for: EXPLORER.EXE > [2011.05.15 07:01:23 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe [2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe [2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe [2011.05.15 07:01:33 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\ERDNT\cache86\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2011.05.15 07:01:23 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe [2011.05.15 07:01:29 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2011.05.15 07:01:33 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2011.05.15 07:01:29 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2011.05.15 07:01:33 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2011.05.15 07:01:29 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2011.05.15 07:01:33 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2011.05.15 07:01:23 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe [2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe [2011.05.15 07:01:29 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe [2011.05.15 07:01:23 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\ERDNT\cache86\regedit.exe [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\ERDNT\cache86\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\ERDNT\cache64\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\ERDNT\cache64\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\ERDNT\cache86\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\ERDNT\cache64\winlogon.exe [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2011.05.15 07:01:33 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2011.05.15 07:01:33 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < End of report > |
|
16.12.2011, 09:43
| #7 |
| | Backdoorprogramm BDS/Cycbot.176128.56Code:
ATTFilter OTL Extras logfile created on: 15.12.2011 19:58:30 - Run 8
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Administrator\Desktop\Virus\OTL
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,90 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 52,57% Memory free
7,79 Gb Paging File | 5,89 Gb Available in Paging File | 75,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 235,24 Gb Total Space | 112,40 Gb Free Space | 47,78% Space Free | Partition Type: NTFS
Drive D: | 215,77 Gb Total Space | 206,35 Gb Free Space | 95,63% Space Free | Partition Type: NTFS
Computer Name: DELL-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
[HKEY_USERS\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== System Restore Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
"DisableConfig" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
"DisableConfig" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe -- (Nexon)
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe -- (Nexon)
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe -- (Nexon)
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe -- (Nexon)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = [String data over 1000 bytes]
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe -- (Nexon)
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe -- (Nexon)
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = [String data over 1000 bytes]
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe -- (Nexon)
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe -- (Nexon)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{290D4DB2-F1B4-4B8E-918D-D71EF29A001B}" = Intel(R) PROSet/Wireless WiFi-Software
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}" = Roxio File Backup
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D6DFAD6-09E5-445E-A4B5-A388FEEBD90D}" = RBVirtualFolder64Inst
"{9ED333F8-3E6C-4A38-BAFA-728454121CDA}" = PDF-XChange Viewer
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 265.94
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 265.94
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 265.94
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.0.9
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}" = Überwachungstool für die Intel® Turbo-Boost-Technik 2.0
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{BE930E38-7BB3-45B6-85B2-5251F374F844}" = 64 Bit HP CIO Components Installer
"{C7B40C35-85AE-4303-9EEA-1A1EA779664D}" = Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D600D357-5CB9-4DE9-8FD4-14E208BD1970}" = Nero Backup Drivers
"{D66F0C3C-24F2-4463-9E2F-4381E5C40A26}" = iTunes
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"CCleaner" = CCleaner
"Dell Support Center" = Dell Support Center
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR 4.00 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01E9B2FF-DAF4-4529-9CC9-2101625517C7}" = nero.prerequisites.msi
"{034DCAF9-96E7-4936-9A07-712F80B5181E}" = Nero RescueAgent 11
"{0713D1F9-DD77-42C1-8C7D-54D479E2E743}" = Nero SoundTrax 11
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D7A4289-99CF-4B8D-B812-86BE50A54552}" = Nero Video 11
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{11D3EF85-63E1-4AE4-A7C1-9241BDB16B51}" = Nero ControlCenter 11
"{1D4EE8FE-F31C-4258-9360-5B8B8309B14B}" = Adobe Premiere Elements 9 Content
"{1D7CE340-70C3-4848-BCCF-215950328A4C}" = Facebook Video Calling 1.0.0.8953
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{25175695-4B20-4298-9F34-C2C57CD277B3}" = Elements STI Installer
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{27107EAA-34E0-43BF-B537-7F8EF6880F5A}" = Facebook Video Calling 1.0.0.8177
"{289AC7E0-0AEE-4a7b-913C-709D9803D23E}" = Nexon Game Manager
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2CA7225D-CB12-462A-9DD1-50319E158BA5}" = Nero 11 PiP Effects Basic
"{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}" = SmartSound Quicktracks 5
"{3250260C-7A95-4632-893B-89657EB5545B}" = PhotoShowExpress
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{3443D416-9DAD-4362-BEB1-C213AD9062CD}" = Dell MusicStage
"{376348C2-E372-48BC-A138-E896757BD86A}" = aioscnnr
"{37AB0223-AF54-49C5-92AA-BFC9648CD323}" = Adobe Premiere Elements 9 HD Content 3
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{390757AA-8830-43DC-AEE0-4E5B6F8439EB}" = Nero SoundTrax 11 Help (CHM)
"{3CBBE028-978B-4876-ABC1-EF9ED6C20C4E}" = Adobe Premiere Elements 9 Content 2
"{3EE2F527-F306-49E9-0086-662C337ADD3B}" = FUSSBALL MANAGER 07
"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50D90C59-4F5C-48BC-AFB2-38475412F0CA}" = Adobe Premiere Elements 9 Content 1
"{53F7746A-96AA-49A5-86B8-59989680DAC5}" = Nero Burning ROM 11 Help (CHM)
"{55C2143E-FBA5-442F-9AFA-726FF068F39D}" = Nero CoverDesigner 11 Help (CHM)
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{57F80ECF-E27C-4EEE-AB58-E971BACE2639}" = Nero Recode 11 Help (CHM)
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{5A212B2D-140D-46F4-B625-2D1CA5A00594}" = Nero 11 Kwik Themes Basic
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5F9AAF4A-B9B0-489D-AE67-73470A4714FE}" = Adobe Premiere Elements 9 HD Content 1
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6748E773-5DA0-4D19-8AA5-273B4133A09B}" = SmartSound Quicktracks for Premiere Elements 9.0
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AB2427E-A18F-4809-9A12-29F5EBABBB3A}" = Nero BackItUp 11 Help (CHM)
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}" = Roxio Creator Starter
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7746BFAA-2B5D-4FFD-A0E8-4558F4668105}" = Roxio Burn
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{7DDC3624-C631-49D1-B281-82EC3A27AA7C}" = Adobe Premiere Elements 9 Content 3
"{7EC66A95-AC2D-4127-940B-0445A526AB2F}" = Dell DataSafe Online
"{8014FACB-1D1D-48C2-94AA-E29EE2E6B9CE}" = Nero WaveEditor 11
"{81DD0597-29EB-4FA0-8223-4F41362B2E72}" = NBA 2K11
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{87434D51-51DB-4109-B68F-A829ECDCF380}" = AccelerometerP11
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{9193490D-5229-4FC4-9BB9-A6D63C09574A}" = High-Definition Video Playback
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A00EC4E-27E1-42C4-98DD-662F32AC8870}" = Sonic CinePlayer Decoder Pack
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A121EEDE-C68F-461D-91AA-D48BA226AF1C}" = Roxio Activation Module
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7A0BF2E-31CC-49E3-9913-52C503EB969D}" = Nero Audio Pack 1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AB2BBC64-8AC8-4E66-BBF3-E22D5EACEECA}" = Nero BackItUp 11
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B1846721-A8E6-46C7-83B6-0DCF7ADB4267}" = Nero Burning ROM 11
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7E01095-8BAA-456E-8AED-504C3CCADBA0}" = Nero 11
"{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}" = SmartSound Common Data
"{B9B1BA7F-7E07-49DD-A713-5B397A5BB66B}" = Nero Kwik Media Help (CHM)
"{BE814218-3919-4EA3-868A-2F60BC135CB4}" = Nero Kwik Media
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components 11
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C19BE821-89B1-4A96-AC7C-873810C0CB5F}" = ContentSAFER for Wizmax
"{C20CE592-B0F8-4D20-BF31-0151CA6331A6}" = EmoDio
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CCE210DF-7EEF-4A76-A63C-3EB091FDB992}" = welcome
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D01CE99A-8802-483C-A79F-298B691EB432}" = Nero RescueAgent 11 Help (CHM)
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D2CBEFA4-F2D3-4E97-A171-8BFD6A31A5EC}" = Nero Express 11 Help (CHM)
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4D66270-9147-4BDF-9946-FCA2B303AA8F}" = Nero ControlCenter 11 Help (CHM)
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DC0C5A78-6DBF-3444-0120-0FE8F0134FCD}" = Adobe Download Assistant
"{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Software
"{E10AAE4A-98B8-420A-BD93-E0520C23D624}" = Nero Express 11
"{E240C78D-8F35-456A-8876-15FF6901B7E0}" = Adobe Premiere Elements 9 HD Content 2
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E4335E82-17B3-460F-9E70-39D9BC269DB3}" = Dell PhotoStage
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E51BC4B0-EA5E-49CC-AF3B-93B5C627EC22}" = Nero 11 Effects Basic
"{E9F59205-F128-49A7-9039-4BDFB60EE4A3}" = Dell Stage
"{EB8DED20-A887-4A9C-BB5A-F3E7523DFB44}" = Nero WaveEditor 11 Help (CHM)
"{EB9955F8-467C-47FC-90F8-12CD5DF684C3}" = Adobe Premiere Elements 9
"{EC7FE03D-239A-4E36-9907-0E327922D2A2}" = bpd_scan
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{EF56258E-0326-48C5-A86C-3BAC26FC15DF}" = Roxio Creator Starter
"{F06B5C4C-8D2E-4B24-9D43-7A45EEC6C878}" = Roxio Creator Starter
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F302F4F0-588D-6501-1ACF-BE3FDCC9135D}" = Adobe Community Help
"{F3743A2C-5D5F-4456-8F98-5DF36A954C50}" = Nero 11 Image Samples
"{F49EF443-B2BD-4F10-8A46-87AFCDB90EDD}" = Nero 11 Disc Menus Basic
"{F69FB940-5031-4FE8-AFAD-085802D0BF63}" = Nero Recode 11
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FAC3C37E-EDAB-4F3A-A173-A7C70CC88F09}" = Nero Video 11 Help (CHM)
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF44BCE5-5A18-4051-85F0-BC172D7B4695}" = Nero CoverDesigner 11
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Premiere Elements 9 Content" = Adobe Premiere Elements 9 Content
"Adobe Premiere Elements 9 Content 1" = Adobe Premiere Elements 9 Content 1
"Adobe Premiere Elements 9 Content 2" = Adobe Premiere Elements 9 Content 2
"Adobe Premiere Elements 9 Content 3" = Adobe Premiere Elements 9 Content 3
"Adobe Premiere Elements 9 HD Content 1" = Adobe Premiere Elements 9 HD Content 1
"Adobe Premiere Elements 9 HD Content 2" = Adobe Premiere Elements 9 HD Content 2
"Adobe Premiere Elements 9 HD Content 3" = Adobe Premiere Elements 9 HD Content 3
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Akamai" = Akamai NetSession Interface Service
"AVerMedia H339 Hybrid TV Tuner" = AVerMedia H339 Hybrid TV Tuner 2.2.64.64
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BewerbungsGenie 7_is1" = DATA BECKER BewerbungsGenie 7
"BurningWheels" = Cobra 11 - Burning Wheels (remove only)
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"Combat Arms EU" = Combat Arms EU
"Dell Webcam Central" = Dell Webcam Central
"ExpressBurn" = Express Burn Disc Burning Software
"ExpressRip" = Express Rip
"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.10.8.815
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.8.815
"InstallShield_{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}" = SmartSound Quicktracks 5
"InstallShield_{6748E773-5DA0-4D19-8AA5-273B4133A09B}" = SmartSound Quicktracks for Premiere Elements 9.0
"InstallShield_{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}" = SmartSound Common Data
"InstallShield_{C20CE592-B0F8-4D20-BF31-0151CA6331A6}" = EmoDio
"InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"Kindersicherung_is1" = Kindersicherung 2011
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"MixPad" = MixPad Audio Mixer
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"Mozilla Thunderbird (8.0)" = Mozilla Thunderbird (8.0)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"Opera 11.52.1100" = Opera 11.52
"PremElem90" = Adobe Premiere Elements 9
"Prism" = Prism Video File Converter
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"RealPlayer 15.0" = RealPlayer
"Secunia PSI" = Secunia PSI (2.0.0.3003)
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.11
"WavePad" = WavePad Sound Editor
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinLiveSuite" = Windows Live Essentials
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== Last 10 Event Log Errors ==========
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
< End of report >
|
|
16.12.2011, 09:45
| #8 |
| | Backdoorprogramm BDS/Cycbot.176128.56 Hier nun die Ergebnisse von CCleaner: 7-Zip 9.20 (x64 edition) Igor Pavlov 22.09.2011 4,53MB 9.20.00.0 AccelerometerP11 STMicroelectronics 13.05.2011 2.00.11.22 Adobe AIR Adobe Systems Incorporated 11.11.2011 3.1.0.4880 Adobe Community Help Adobe Systems Incorporated 11.09.2011 3.2.1.650 Adobe Download Assistant Adobe Systems Incorporated 30.09.2011 1.0.5 Adobe Flash Player 11 ActiveX Adobe Systems Incorporated 13.12.2011 6,00MB 11.1.102.55 Adobe Flash Player 11 Plugin 64-bit Adobe Systems Incorporated 11.11.2011 6,00MB 11.1.102.55 Adobe Premiere Elements 9 Adobe Systems Incorporated 28.10.2011 1.264MB 9.0 Adobe Premiere Elements 9 Content Adobe Systems Incorporated 28.10.2011 1.264MB 9.0 Advanced Audio FX Engine Creative Technology Ltd 11.09.2011 1.12.05 Akamai NetSession Interface 09.11.2011 Akamai NetSession Interface Service 09.11.2011 Apple Application Support Apple Inc. 17.10.2011 61,1MB 2.1.5 Apple Mobile Device Support Apple Inc. 17.10.2011 24,4MB 4.0.0.96 Apple Software Update Apple Inc. 22.09.2011 2,38MB 2.1.3.127 AVerMedia H339 Hybrid TV Tuner 2.2.64.64 AVerMedia TECHNOLOGIES, Inc. 11.09.2011 2.2.64.64 Avira AntiVir Personal - Free Antivirus Avira GmbH 13.10.2011 70,6MB 10.2.0.704 Bonjour Apple Inc. 17.10.2011 2,00MB 3.0.0.10 CCleaner Piriform 14.12.2011 3.13 Cobra 11 - Burning Wheels (remove only) 11.09.2011 Combat Arms EU 01.12.2011 ContentSAFER for Wizmax 13.05.2011 DATA BECKER BewerbungsGenie 7 DATA BECKER GmbH & Co. KG 30.05.2011 1.130MB 6.0.10.49 Dell DataSafe Local Backup Dell 13.05.2011 9.4.47 Dell DataSafe Local Backup - Support Software Dell 13.05.2011 Dell DataSafe Online Dell 13.05.2011 6,46MB 2.1.19634 Dell Getting Started Guide Dell Inc. 13.05.2011 1.00.0000 Dell MusicStage Fingertapps 11.07.2011 88,7MB 1.5.402.0 Dell PhotoStage ArcSoft 13.05.2011 101,8MB 1.5.0.30 Dell Stage Fingertapps 29.06.2011 82,6MB 1.5.420.0 Dell Support Center Dell Inc. 14.05.2011 3.0.5621.01 Dell VideoStage CyberLink Corp. 13.05.2011 1.1.1.1408 Dell Webcam Central Creative Technology Ltd 11.09.2011 2.00.35 EmoDio SAMSUNG 20.06.2011 7,69MB 1.0 Express Burn Disc Burning Software NCH Software 11.09.2011 Express Rip NCH Software 11.09.2011 Facebook Video Calling 1.0.0.8953 Skype Limited 14.11.2011 7,86MB 1.0.8953 FIFA 11 Electronic Arts 06.11.2011 6.262MB 1.0.0.0 Free YouTube to iPod Converter version 3.10.8.815 DVDVideoSoft Ltd. 30.09.2011 42,9MB Free YouTube to MP3 Converter version 3.10.8.815 DVDVideoSoft Ltd. 30.09.2011 45,4MB FUSSBALL MANAGER 07 11.09.2011 GIMP 2.6.8 18.05.2011 Google Earth Google 17.11.2011 92,7MB 6.1.0.5001 Intel(R) Management Engine Components Intel Corporation 15.05.2011 7.0.0.1144 Intel(R) Processor Graphics Intel Corporation 11.09.2011 74,2MB 8.15.10.2291 Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology Intel Corporation 13.05.2011 88,6MB 1.0.2.0511 Intel(R) PROSet/Wireless WiFi-Software Intel Corporation 13.05.2011 142,9MB 14.00.1000 Internet-TV für Windows Media Center Microsoft Corporation 02.06.2011 13,7MB 4.2.2.0 iTunes Apple Inc. 17.10.2011 169,9MB 10.5.0.142 Java(TM) 6 Update 22 13.05.2011 Java(TM) 6 Update 29 Oracle 28.10.2011 95,0MB 6.0.290 Kindersicherung 2011 Salfeld Computer GmbH 09.10.2011 64,6MB KODAK All-in-One Software Eastman Kodak Company 23.11.2011 7.1.6.30 Malwarebytes' Anti-Malware Version 1.51.2.1300 Malwarebytes Corporation 28.10.2011 13,8MB 1.51.2.1300 Microsoft .NET Framework 4 Client Profile Microsoft Corporation 19.05.2011 38,8MB 4.0.30319 Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 19.05.2011 2,94MB 4.0.30319 Microsoft Office 2010 Microsoft Corporation 13.05.2011 6,31MB 14.0.4763.1000 Microsoft Office Klick-und-Los 2010 Microsoft Corporation 10.11.2011 14.0.4763.1000 Microsoft Office Starter 2010 - Deutsch Microsoft Corporation 10.11.2011 14.0.4763.1000 Microsoft Silverlight Microsoft Corporation 13.10.2011 80,3MB 4.0.60831.0 Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 13.05.2011 1,70MB 3.1.0000 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 23.05.2011 0,25MB 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 15.06.2011 0,29MB 8.0.59193 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 18.05.2011 0,77MB 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 18.05.2011 0,77MB 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 15.06.2011 0,77MB 9.0.30729.6161 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Corporation 06.11.2011 0,23MB 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 18.05.2011 0,58MB 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 18.05.2011 0,57MB 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 15.06.2011 0,59MB 9.0.30729.6161 Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 08.10.2011 13,8MB 10.0.40219 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 08.10.2011 15,0MB 10.0.40219 MixPad Audio Mixer NCH Software 11.09.2011 Mozilla Firefox 8.0 (x86 de) Mozilla 10.11.2011 41,3MB 8.0 Mozilla Thunderbird (8.0) Mozilla 10.11.2011 8.0 (de) MSXML 4.0 SP2 (KB954430) Microsoft Corporation 18.05.2011 1,28MB 4.20.9870.0 MSXML 4.0 SP2 (KB973688) Microsoft Corporation 18.05.2011 1,33MB 4.20.9876.0 NBA 2K11 2K Sports 17.09.2011 1.0.0 Nero 11 Nero AG 06.10.2011 1.760MB 11.0.10700 Nero Backup Drivers Nero AG 06.10.2011 94,00KB 1.0.10000.1.0 Nexon Game Manager 01.12.2011 NVIDIA 3D Vision Treiber 265.94 NVIDIA Corporation 13.05.2011 265.94 NVIDIA Grafiktreiber 265.94 NVIDIA Corporation 13.05.2011 265.94 OpenOffice.org 3.3 OpenOffice.org 15.09.2011 415MB 3.3.9567 Opera 11.52 Opera Software ASA 28.10.2011 11.52.1100 PDF-XChange Viewer Tracker Software Products Ltd. 22.09.2011 44,7MB 2.5.198.0 PlayReady PC Runtime amd64 Microsoft Corporation 20.05.2011 2,06MB 1.3.0 Prism Video File Converter NCH Software 13.09.2011 Protect Disc License Helper 1.0.125 (IE) Protect Disc 30.05.2011 1.0.125 ProtectDisc Driver, Version 11 ProtectDisc Software GmbH 11.09.2011 11.0.0.14 Quickset64 Dell Inc. 13.05.2011 11.0.10 QuickTime Apple Inc. 28.10.2011 73,3MB 7.71.80.42 RealPlayer RealNetworks 20.10.2011 Realtek High Definition Audio Driver Realtek Semiconductor Corp. 11.09.2011 6.0.1.6267 Roxio Creator Starter Roxio 11.09.2011 1.673MB 12.1.77.0 Secunia PSI (2.0.0.3003) 16.10.2011 Skype Click to Call Skype Technologies S.A. 30.09.2011 14,5MB 5.6.8312 Skype™ 5.5 Skype Technologies S.A. 28.10.2011 17,1MB 5.5.124 SmartSound Common Data SmartSound Software Inc. 16.06.2011 13,5MB 1.1.0 SmartSound Quicktracks 5 SmartSound Software Inc. 16.06.2011 49,2MB 5.1.6 SmartSound Quicktracks for Premiere Elements 9.0 SmartSound Software Inc 26.08.2011 20,1MB 3.12.3090 Synaptics Pointing Device Driver Synaptics Incorporated 14.05.2011 46,4MB 15.2.6.0 Uninstall 1.0.0.1 27.05.2011 11,2MB VLC media player 1.1.11 VideoLAN 22.09.2011 1.1.11 WavePad Sound Editor NCH Software 11.09.2011 Windows Live Essentials Microsoft Corporation 06.08.2011 15.4.3538.0513 Windows Live Mesh ActiveX control for remote connections Microsoft Corporation 13.05.2011 5,58MB 15.4.5722.2 Windows Media Encoder 9 Series 11.09.2011 WinRAR 4.00 (64-Bit) win.rar GmbH 18.05.2011 4.00.0 Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 Intel 13.05.2011 2.1.23.0 |
|
16.12.2011, 10:05
| #9 |
| | Backdoorprogramm BDS/Cycbot.176128.56 Hier die Ereignisse von Avira: Exportierte Ereignisse: 15.12.2011 18:46 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 18:46 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 11:25 [Scanner] Malware gefunden Die Datei '#PARAM2#' enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#]. Durchgeführte Aktion(en): #PARAM4# 15.12.2011 11:25 [Scanner] Malware gefunden Die Datei '#PARAM2#' enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#]. Durchgeführte Aktion(en): #PARAM4# 15.12.2011 11:22 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 11:22 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 11:22 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 11:22 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 11:22 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 11:19 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 11:19 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 11:19 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 08:35 [Scanner] Malware gefunden Die Datei '#PARAM2#' enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#]. Durchgeführte Aktion(en): #PARAM4# 15.12.2011 08:35 [Scanner] Malware gefunden Die Datei '#PARAM2#' enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#]. Durchgeführte Aktion(en): #PARAM4# 15.12.2011 08:35 [Scanner] Malware gefunden Die Datei '#PARAM2#' enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#]. Durchgeführte Aktion(en): #PARAM4# 15.12.2011 08:31 [Scanner] Malware gefunden Die Datei '#PARAM2#' enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#]. Durchgeführte Aktion(en): #PARAM4# 15.12.2011 08:31 [Scanner] Malware gefunden Die Datei '#PARAM2#' enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#]. Durchgeführte Aktion(en): #PARAM4# 15.12.2011 08:28 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 08:28 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 08:28 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 08:28 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 08:28 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 08:04 [Scanner] Malware gefunden Die Datei '#PARAM2#' enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#]. Durchgeführte Aktion(en): #PARAM4# 15.12.2011 08:02 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 08:00 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 08:00 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 15.12.2011 08:00 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 14.12.2011 08:41 [Scanner] Malware gefunden Die Datei '#PARAM2#' enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#]. Durchgeführte Aktion(en): #PARAM4# 14.12.2011 08:38 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 14.12.2011 08:38 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 14.12.2011 08:38 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 13.12.2011 20:20 [Scanner] Malware gefunden Die Datei '#PARAM2#' enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#]. Durchgeführte Aktion(en): #PARAM4# 13.12.2011 20:17 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 13.12.2011 20:17 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# 13.12.2011 20:17 [Guard] Malware gefunden In der Datei '#PARAM2#' wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden. Ausgeführte Aktion: #PARAM4# |
|
16.12.2011, 10:08
| #10 |
| | Backdoorprogramm BDS/Cycbot.176128.56 P.s.: Heute früh ha avira auch noch was gefunden, ist aber nicht unter Ereignisse dokumentiert, aber in der Quarantäne. Die Quarantänte.txt, stelle ich mal mit rein. Viele Grüße, Jasmina Typ: Datei Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\temp\jar_cache2940790001441072158.tmp Status: Infiziert Quarantäne-Objekt: 659a9f32.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows 2000/XP/VISTA Workstation Suchengine: 8.02.08.02 Virendefinitionsdatei: 7.11.19.128 Meldung: Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.GK Datum/Uhrzeit: 16.12.2011, 09:57 Typ: Datei Quelle: C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\A7CB\737u.exe Status: Infiziert Quarantäne-Objekt: 491aa5ed.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows 2000/XP/VISTA Workstation Suchengine: 8.02.08.02 Virendefinitionsdatei: 7.11.19.128 Meldung: Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Cycbot.G.196 Datum/Uhrzeit: 16.12.2011, 09:57 Typ: Datei Quelle: C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\A7CB\10F2.tmp Status: Infiziert Quarantäne-Objekt: 519e8a57.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows 2000/XP/VISTA Workstation Suchengine: 8.02.08.02 Virendefinitionsdatei: 7.11.19.128 Meldung: Ist das Trojanische Pferd TR/Drop.Agent.104448.2 Datum/Uhrzeit: 16.12.2011, 09:57 Typ: Datei Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9P12EUMN\bleh[1].exe Status: Infiziert Quarantäne-Objekt: 5f088066.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows 2000/XP/VISTA Workstation Suchengine: 8.02.08.02 Virendefinitionsdatei: 7.11.19.128 Meldung: Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Cycbot.G.196 Datum/Uhrzeit: 16.12.2011, 09:57 Typ: Datei Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\temp\jar_cache3335764138695990157.tmp Status: Infiziert Quarantäne-Objekt: 03add0f0.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows 2000/XP/VISTA Workstation Suchengine: 8.02.08.02 Virendefinitionsdatei: 7.11.19.128 Meldung: Enthält Erkennungsmuster des Exploits EXP/2010-0840.AW Datum/Uhrzeit: 16.12.2011, 09:57 Typ: Datei Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\4d0d2e25\X Status: Infiziert Quarantäne-Objekt: 6fd8ec26.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows 2000/XP/VISTA Workstation Suchengine: 8.02.08.02 Virendefinitionsdatei: 7.11.19.128 Meldung: Ist das Trojanische Pferd TR/Downloader.Gen Datum/Uhrzeit: 16.12.2011, 09:57 Typ: Datei Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1WHIKJDB\b[1].exe Status: Infiziert Quarantäne-Objekt: 13fcac1d.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows 2000/XP/VISTA Workstation Suchengine: 8.02.08.02 Virendefinitionsdatei: 7.11.19.128 Meldung: Ist das Trojanische Pferd TR/Offend.KD.474345 Datum/Uhrzeit: 16.12.2011, 09:57 Typ: Datei Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9P12EUMN\f[1].exe Status: Infiziert Quarantäne-Objekt: 205fb236.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows 2000/XP/VISTA Workstation Suchengine: 8.02.08.02 Virendefinitionsdatei: 7.11.19.128 Meldung: Ist das Trojanische Pferd TR/Kazy.48489 Datum/Uhrzeit: 16.12.2011, 09:57 Typ: Datei Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\temp\1951057.exe Status: Infiziert Quarantäne-Objekt: 4ada5911.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows 2000/XP/VISTA Workstation Suchengine: 8.02.08.02 Virendefinitionsdatei: 7.11.19.128 Meldung: Ist das Trojanische Pferd TR/Kazy.48489 Datum/Uhrzeit: 16.12.2011, 09:49 Typ: Datei Quelle: C:\Program Files (x86)\LP\A7CB\F180.tmp Status: Infiziert Quarantäne-Objekt: 499a5915.qua Wiederhergestellt: NEIN Zu Avira hochgeladen: NEIN Betriebssystem: Windows 2000/XP/VISTA Workstation Suchengine: 8.02.08.02 Virendefinitionsdatei: 7.11.19.128 Meldung: Ist das Trojanische Pferd TR/Spy.Favic.A Datum/Uhrzeit: 16.12.2011, 09:49 |
|
17.12.2011, 06:59
| #11 | |||||
| /// Helfer-Team | Backdoorprogramm BDS/Cycbot.176128.56 1. Hast Du absichtlich die IP 127.0.0.1:50263 als Proxy eingestellt? Wenn ja, warum? Wenn nein: wenn du keinen Proxyserver lokal installiert hast, nimm die Proxyeinstellungen aus den Interneteinstellungen raus im Internet Explorer: Extras => Internetoptionen => Verbindungen => Lan-Einstellungen Haken bei Proxyserver für LAN verwenden und Proxyserver für lokale Adressen umgehen entfernen. Zitat:
Extras => Einstellungen => Erweitert => Netzwerk => Einstellungen. Dort unter Verbindungs-Einstellungen => Kein Proxy anhaken. Zitat:
Dir bekannte Einträge? (ggf unter "Eigenschaften" nachsehen): Zitat:
Zitat:
Code:
ATTFilter :OTL
PRC - C:\Program Files (x86)\57168\lvvm.exe ()
PRC - C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe ()
PRC - C:\Program Files (x86)\LP\A7CB\737.exe ()
MOD - C:\Program Files (x86)\57168\lvvm.exe ()
MOD - C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe ()
MOD - C:\Program Files (x86)\LP\A7CB\737.exe ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O4 - HKLM..\Run: [737.exe] C:\Program Files (x86)\LP\A7CB\737.exe ()
O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" File not found
O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe File not found
O4 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
[2011.12.15 11:19:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\57168
[2011.12.15 11:19:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\B8457
[2011.12.15 19:57:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004UA.job
[2011.12.15 19:30:16 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.15 19:06:12 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.15 11:18:00 | 000,000,936 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003UA.job
[2011.12.14 20:28:00 | 000,000,926 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1025Core.job
[2011.12.14 20:18:00 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003Core.job
[2011.12.14 08:38:00 | 000,000,390 | ---- | M] () -- C:\Windows\tasks\At2.job
[2011.12.14 08:34:00 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\At1.job
[2011.12.12 16:57:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004Core.job
:Commands
[purity]
[emptytemp]
4. reinige dein System mit CCleaner:
5.
6. Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware ("Worm.Win32.Autorun") verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen. Schließe jetzt alle externe Datenträgeran (USB Sticks etc) Deinen Rechner an, dabei die Hochstell-Taste [Shift-Taste] gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. (So verhindest Du die Ausführung der AUTORUN-Funktion) - Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung 7. -> Führe dann einen Komplett-Systemcheck mit Eset Online Scanner (NOD32)Kostenlose Online Scanner durch Achtung!: >>Du sollst nicht die Antivirus-Sicherheitssoftware installieren, sondern dein System nur online scannen<< 8. erneut einen Scan mit OTL:
Zitat:
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! |
|
18.12.2011, 08:03
| #12 |
| | Backdoorprogramm BDS/Cycbot.176128.56 Hallo Kira, 1. die IP 127.0.0.1:50263 habe ich nicht als Proxy eingestellt.? Ist mir aber aufgefallen und ich habe die Einstellung schon rausgenommen. 2. Dir bekannte Einträge? (ggf unter "Eigenschaften" nachsehen): Zitat: [2011.12.15 08:29:11 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\Virus Das ist ein Ordner, den ich angelegt habe. [2011.12.15 11:22:52 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\4d0d2e25 Diesen Eintrag kenne ich nicht. Den Rest stelle ich dann später rein. Vielen, vielen Dank!  |
|
18.12.2011, 08:25
| #13 |
| | Backdoorprogramm BDS/Cycbot.176128.56 : Code:
ATTFilter All processes killed
========== OTL ==========
No active process named Program Files was found!
No active process named 6D1A7.exe was found!
No active process named Program Files was found!
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll not found.
C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml moved successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\737.exe not found.
File C:\Program Files (x86)\LP\A7CB\737.exe not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AccuWeatherWidget deleted successfully.
C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Conime deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\EKIJ5000StatusMonitor deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3230886925-126132133-2629391164-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Privacy\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-3230886925-126132133-2629391164-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-3230886925-126132133-2629391164-500\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
C:\Program Files (x86)\57168 folder moved successfully.
C:\Users\Administrator\AppData\Roaming\B8457 folder moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004UA.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003UA.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1025Core.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003Core.job moved successfully.
C:\Windows\Tasks\At2.job moved successfully.
C:\Windows\Tasks\At1.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004Core.job moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 27038607 bytes
->Temporary Internet Files folder emptied: 49440123 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 73987108 bytes
->Opera cache emptied: 1191820 bytes
->Flash cache emptied: 58352 bytes
User: All Users
User: AppData
->Temp folder emptied: 0 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Jasmina
->Temp folder emptied: 444971 bytes
->Temporary Internet Files folder emptied: 1508823 bytes
->Java cache emptied: 11680 bytes
->FireFox cache emptied: 37421722 bytes
->Flash cache emptied: 57120 bytes
User: Jasmina 2
User: Nico
User: Nico Spiele
User: Nico.dell-PC
User: Nico.dell-PC.000
->Temp folder emptied: 167157564 bytes
->Temporary Internet Files folder emptied: 16506810 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 43839688 bytes
->Flash cache emptied: 9097 bytes
User: Public
->Temp folder emptied: 0 bytes
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50635 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 668 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 399,00 mb
OTL by OldTimer - Version 3.2.31.0 log created on 12182011_081200
Files\Folders moved on Reboot...
C:\Users\Administrator\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...
:
|
|
18.12.2011, 13:36
| #14 |
| | Backdoorprogramm BDS/Cycbot.176128.56 : Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 12/17/2011 at 12:25 PM
Application Version : 5.0.1142
Core Rules Database Version : 8064
Trace Rules Database Version: 5876
Scan type : Complete Scan
Total Scan Time : 02:31:32
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC Off - Administrator
Memory items scanned : 719
Memory threats detected : 0
Registry items scanned : 76927
Registry threats detected : 0
File items scanned : 257414
File threats detected : 220
Adware.Tracking Cookie
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\QM1OTRD9.txt [ /atdmt.com ]
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\F988I3Z6.txt [ /media6degrees.com ]
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\O1FN8N2S.txt [ /webmasterplan.com ]
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\EU6URGFJ.txt [ /perf.overture.com ]
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\5DJIVMO1.txt [ /www.usenext.de ]
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\NET4DBKT.txt [ /2o7.net ]
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\KKIFEF7R.txt [ /account.live.com ]
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\D3IYFCK0.txt [ /invitemedia.com ]
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\08H9M60T.txt [ /lucidmedia.com ]
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\8F6RXOS9.txt [ /doubleclick.net ]
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\MFYXIJ15.txt [ /ad.yieldmanager.com ]
C:\USERS\ADMINISTRATOR\Cookies\QM1OTRD9.txt [ Cookie:administrator@atdmt.com/ ]
C:\USERS\ADMINISTRATOR\Cookies\F988I3Z6.txt [ Cookie:administrator@media6degrees.com/ ]
C:\USERS\ADMINISTRATOR\Cookies\O1FN8N2S.txt [ Cookie:administrator@webmasterplan.com/ ]
C:\USERS\ADMINISTRATOR\Cookies\EU6URGFJ.txt [ Cookie:administrator@perf.overture.com/ ]
C:\USERS\ADMINISTRATOR\Cookies\5DJIVMO1.txt [ Cookie:administrator@www.usenext.de/ ]
C:\USERS\ADMINISTRATOR\Cookies\NET4DBKT.txt [ Cookie:administrator@2o7.net/ ]
C:\USERS\ADMINISTRATOR\Cookies\KKIFEF7R.txt [ Cookie:administrator@account.live.com/ ]
C:\USERS\ADMINISTRATOR\Cookies\08H9M60T.txt [ Cookie:administrator@lucidmedia.com/ ]
C:\USERS\ADMINISTRATOR\Cookies\8F6RXOS9.txt [ Cookie:administrator@doubleclick.net/ ]
C:\USERS\ADMINISTRATOR\Cookies\MFYXIJ15.txt [ Cookie:administrator@ad.yieldmanager.com/ ]
C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\Q24G170D.txt [ Cookie:nico@2o7.net/ ]
C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\XZAXDNQD.txt [ Cookie:nico@mediaplex.com/ ]
C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\APQ3BI3N.txt [ Cookie:nico@adfarm1.adition.com/ ]
C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\MZJHPRKM.txt [ Cookie:nico@imrworldwide.com/cgi-bin ]
C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\BPXHXY40.txt [ Cookie:nico@ad2.adfarm1.adition.com/ ]
C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\NF69XBY1.txt [ Cookie:nico@c.atdmt.com/ ]
C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\LFT0E2C5.txt [ Cookie:nico@fastclick.net/ ]
C:\USERS\NICO.DELL-PC.000\Cookies\Q24G170D.txt [ Cookie:nico@2o7.net/ ]
C:\USERS\NICO.DELL-PC.000\Cookies\XZAXDNQD.txt [ Cookie:nico@mediaplex.com/ ]
C:\USERS\NICO.DELL-PC.000\Cookies\APQ3BI3N.txt [ Cookie:nico@adfarm1.adition.com/ ]
C:\USERS\NICO.DELL-PC.000\Cookies\MZJHPRKM.txt [ Cookie:nico@imrworldwide.com/cgi-bin ]
C:\USERS\NICO.DELL-PC.000\Cookies\BPXHXY40.txt [ Cookie:nico@ad2.adfarm1.adition.com/ ]
C:\USERS\NICO.DELL-PC.000\Cookies\NF69XBY1.txt [ Cookie:nico@c.atdmt.com/ ]
C:\USERS\NICO.DELL-PC.000\Cookies\LFT0E2C5.txt [ Cookie:nico@fastclick.net/ ]
.invitemedia.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
accounts.youtube.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.accounts.google.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.accounts.google.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.accounts.google.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
ad1.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
ad4.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
ad2.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.ads.quartermedia.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
ad3.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
adserver.trojaner-info.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
media.mtvnservices.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ZDEJBDAE ]
secure-uk.imrworldwide.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ZDEJBDAE ]
secure-us.imrworldwide.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ZDEJBDAE ]
www.pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ZDEJBDAE ]
.questionmarket.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.findextrawork.co.uk [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.findextrawork.co.uk [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.findextrawork.co.uk [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.xiti.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
tracking.dc-storm.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
data.coremetrics.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
tracking.dc-storm.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.olympiaverlag.122.2o7.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.clickaider.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.eaeacom.112.2o7.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
www.webcountdown.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
www.webcountdown.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
www.webcountdown.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
wstat.wibiya.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.www.tubsex.info [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.overture.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.overture.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.overture.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.yadro.ru [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.lfstmedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.lfstmedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.lfstmedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.lfstmedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.lucidmedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adxvalue.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adxvalue.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adxvalue.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adxvalue.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.traffictrack.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
e2.emediate.se [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad1.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.im.banner.t-online.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.bs.serving-sys.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.im.banner.t-online.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adviva.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
tracking.mlsat02.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.zanox.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
eas.apm.emediate.eu [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad3.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
www.zanox-affiliate.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad.zanox.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.webmasterplan.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
accounts.youtube.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
e2.emediate.se [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
statse.webtrendslive.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad4.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.tracking.quisma.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
ad2.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
.tracking.3gnet.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]:
|
|
18.12.2011, 13:39
| #15 |
| | Backdoorprogramm BDS/Cycbot.176128.56 Hi Kira, Antivir kann ich nicht mehr updaten, Windows update kann ich auch nicht ausführen und die Windows Firewall kann ich nicht mehr einstellen, angezeigt wird, dass sie nicht aktiv ist. Okay, jetzt führe ich die restlichen Scans durch. Viele Grüße Jasmina |
|
| Themen zu Backdoorprogramm BDS/Cycbot.176128.56 |
| andere, backdoorprogramm, folge, folgen, gefunde, gestern, google, heute, klicke, link, problem, seite, virus, windows, windows 7 |
.
Linear-Darstellung
