| |
| |||||||
Log-Analyse und Auswertung: Entfernen von Live Security Platinum erfolgreich?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
22.07.2012, 23:01
| #1 |
| |  Entfernen von Live Security Platinum erfolgreich? Hallo, ich hatte mir den Live Security Platinum Trojaner eingefangen. Ich habe im abgesicherten Modus mit Malwarebytes alles entfernt was er gefunden hatte  . Jetzt wollt ich mal nachfragen ob alles restlos entfernt wurde. Code:
ATTFilter OTL logfile created on: 22.07.2012 23:22:54 - Run 1 OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Anne\Downloads 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,91 Gb Total Physical Memory | 2,84 Gb Available Physical Memory | 72,64% Memory free 7,81 Gb Paging File | 6,69 Gb Available in Paging File | 85,63% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 285,62 Gb Total Space | 33,18 Gb Free Space | 11,62% Space Free | Partition Type: NTFS Drive D: | 12,47 Gb Total Space | 1,98 Gb Free Space | 15,85% Space Free | Partition Type: NTFS Computer Name: ANNE-LAPTOP | User Name: Anne | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.07.22 23:22:26 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Anne\Downloads\OTL.exe PRC - [2012.07.18 16:29:07 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012.05.08 22:30:29 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.05.08 22:30:29 | 000,182,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avrestart.exe PRC - [2012.05.08 22:30:29 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012.04.16 17:49:06 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\SeaPort.exe PRC - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.11.10 11:17:04 | 003,514,176 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe PRC - [2011.09.29 16:19:26 | 000,020,880 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe PRC - [2011.09.29 16:19:16 | 003,508,112 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe ========== Modules (No Company Name) ========== MOD - [2012.07.18 16:29:07 | 002,003,424 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2012.05.09 17:31:33 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0c2b0d52156447592f33edf4116b7e7d\System.Management.ni.dll MOD - [2012.05.09 17:29:50 | 000,762,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\65f0d70169a0e73b45307dddbd86f92b\System.Runtime.Remoting.ni.dll MOD - [2012.05.09 17:29:41 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll MOD - [2012.05.09 09:17:42 | 018,000,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\041b1bcf6ae9ab58925791d8198c37e2\PresentationFramework.ni.dll MOD - [2012.05.09 09:17:25 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\a1de74c8d0dfd15e3246e5dd394013bf\PresentationCore.ni.dll MOD - [2012.05.09 09:17:14 | 003,858,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4b7adff986a085bb562222d0c5fdf5aa\WindowsBase.ni.dll MOD - [2012.05.09 09:17:14 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a5fa2a1cfc6e9fdc39d9a8f2baa57bc9\PresentationFramework.Aero.ni.dll MOD - [2012.05.09 09:14:50 | 013,197,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\9ee9841d9e33fe5dceba4cd7d90f2ae0\System.Windows.Forms.ni.dll MOD - [2012.05.09 09:14:40 | 001,665,536 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\03b5233f1511f5fdb39eb681b04e5506\System.Drawing.ni.dll MOD - [2012.05.09 09:14:37 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll MOD - [2012.05.09 09:14:34 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll MOD - [2012.05.09 09:14:28 | 009,091,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll MOD - [2012.05.09 09:14:21 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll MOD - [2012.04.21 14:49:06 | 000,121,856 | ---- | M] () -- C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox\components\CitaviPickerCommunication.dll MOD - [2011.10.08 18:33:05 | 000,115,137 | ---- | M] () -- C:\Users\Anne\AppData\Local\Temp\ae201572-4813-4010-9ed2-ee29ddec066a\CliSecureRT.dll MOD - [2011.09.29 16:19:26 | 000,020,880 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ========== Win32 Services (SafeList) ========== SRV:64bit: - [2012.05.25 08:01:52 | 000,078,792 | ---- | M] () [Unknown (-1) | Unknown] -- C:\Windows\SysNative\drivers\2868c25982c9991f.sys -- (2868c25982c9991f) SRV:64bit: - [2011.05.13 18:58:10 | 000,030,520 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv) SRV:64bit: - [2009.07.21 17:33:32 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe -- (STacSV) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV:64bit: - [2009.03.02 13:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe -- (AESTFilters) SRV - [2012.07.18 16:29:07 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.05.16 21:11:42 | 000,216,080 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Programme\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe -- (NitroReaderDriverReadSpool2) SRV - [2012.05.08 22:30:29 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.05.08 22:30:29 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.04.16 17:49:06 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\SeaPort.exe -- (BBUpdate) SRV - [2012.04.16 17:49:06 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\BBSvc.exe -- (BBSvc) SRV - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.07.21 17:33:32 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe -- (STacSV) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.03.02 13:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe -- (AESTFilters) SRV - [2008.09.18 22:17:16 | 000,093,848 | ---- | M] (SiSoftware) [On_Demand | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2011.SP5\RpcAgentSrv.exe -- (SandraAgentSrv) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.07.21 22:24:47 | 000,132,832 | ---- | M] () [Kernel | System | Stopped] -- C:\Windows\SysNative\DRIVERS\avipbb.sys -- (avipbb) DRV:64bit: - [2012.07.21 22:24:47 | 000,027,760 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avkmgr.sys -- (avkmgr) DRV:64bit: - [2012.05.25 08:01:52 | 000,078,792 | ---- | M] () [Unknown (-1) | Unknown (-1) | Unknown] -- C:\Windows\SysNative\drivers\2868c25982c9991f.sys -- (2868c25982c9991f) DRV:64bit: - [2012.05.08 22:30:29 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] () [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.12.15 18:56:57 | 000,279,616 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2011.08.01 16:59:06 | 000,045,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\point64.sys -- (Point64) DRV:64bit: - [2011.07.28 19:37:10 | 000,052,584 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB) DRV:64bit: - [2011.06.02 07:47:22 | 000,177,640 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ssadmdm.sys -- (ssadmdm) DRV:64bit: - [2011.06.02 07:47:22 | 000,157,672 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) DRV:64bit: - [2011.06.02 07:47:22 | 000,146,920 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ssadserd.sys -- (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM) DRV:64bit: - [2011.06.02 07:47:22 | 000,016,872 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter) DRV:64bit: - [2011.05.13 18:58:16 | 000,030,008 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\hpdskflt.sys -- (hpdskflt) DRV:64bit: - [2011.05.13 18:57:58 | 000,043,320 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Accelerometer.sys -- (Accelerometer) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.12.21 07:55:02 | 000,036,328 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\ssadadb.sys -- (androidusb) DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbflt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.21 05:23:48 | 000,071,168 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc) DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2009.07.21 17:33:32 | 000,487,936 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\stwrt64.sys -- (STHDA) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 23:01:06 | 001,146,880 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\agrsm64.sys -- (AgereSoftModem) DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\igdkmd64.sys -- (igfx) DRV:64bit: - [2009.06.10 22:35:42 | 000,187,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009.06.10 22:34:38 | 001,311,232 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\bcmwl664.sys -- (BCM43XX) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2006.11.30 16:17:56 | 000,033,048 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\x10ufx2.sys -- (XUIF) DRV - [2009.08.07 23:46:56 | 000,023,112 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2011.SP5\WNt500x64\sandra.sys -- (SANDRA) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 53 DC 94 CD D8 7E CC 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..network.proxy.ftp: "93.95.66.129" FF - prefs.js..network.proxy.ftp_port: 8080 FF - prefs.js..network.proxy.http: "88.202.124.121" FF - prefs.js..network.proxy.http_port: 9090 FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "93.95.66.129" FF - prefs.js..network.proxy.socks_port: 8080 FF - prefs.js..network.proxy.ssl: "93.95.66.129" FF - prefs.js..network.proxy.ssl_port: 8080 FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro PDF\Reader 2\npnitromozilla.dll ( ) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012.04.21 14:49:06 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 16:29:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 16:29:07 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.09.29 20:58:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Anne\AppData\Roaming\mozilla\Extensions [2012.07.20 09:20:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Anne\AppData\Roaming\mozilla\Firefox\Profiles\ph0hnpmd.default\extensions [2012.07.20 09:20:06 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Anne\AppData\Roaming\mozilla\Firefox\Profiles\ph0hnpmd.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} [2012.05.23 18:08:07 | 000,000,933 | ---- | M] () -- C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\ph0hnpmd.default\searchplugins\11-suche.xml [2012.05.23 18:08:06 | 000,002,419 | ---- | M] () -- C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\ph0hnpmd.default\searchplugins\englische-ergebnisse.xml [2012.05.23 18:08:07 | 000,010,525 | ---- | M] () -- C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\ph0hnpmd.default\searchplugins\gmx-suche.xml [2012.05.23 18:08:07 | 000,002,457 | ---- | M] () -- C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\ph0hnpmd.default\searchplugins\lastminute.xml [2012.05.25 08:00:12 | 000,005,489 | ---- | M] () -- C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\ph0hnpmd.default\searchplugins\webde-suche.xml [2012.01.08 10:32:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.05.22 13:12:02 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.04.21 14:49:06 | 000,000,000 | ---D | M] (Citavi Picker) -- C:\PROGRAMDATA\SWISS ACADEMIC SOFTWARE\CITAVI PICKER\FIREFOX [2012.05.21 23:14:40 | 000,076,798 | ---- | M] () (No name found) -- C:\USERS\ANNE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PH0HNPMD.DEFAULT\EXTENSIONS\{30E08C68-889E-11E0-95EF-DA7E4824019B}.XPI [2012.06.15 12:08:32 | 000,182,698 | ---- | M] () (No name found) -- C:\USERS\ANNE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PH0HNPMD.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI [2012.07.18 16:29:07 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.06.17 10:56:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.06.17 10:56:37 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.06.17 10:56:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.06.17 10:56:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.17 10:56:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.17 10:56:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL (Microsoft Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\BingExt.dll (Microsoft Corporation.) O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung) O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKCU..\Run: [Device Detection] C:\Program Files (x86)\Lidl_Fotos\dd.exe () O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1 O8:64bit: - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FBBB27D7-B785-475E-A76E-6F937462709C}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{2cadddac-eaca-11e0-92b8-00238ba16945}\Shell - "" = AutoRun O33 - MountPoints2\{2cadddac-eaca-11e0-92b8-00238ba16945}\Shell\AutoRun\command - "" = H:\SETUP.EXE O33 - MountPoints2\{2cadddac-eaca-11e0-92b8-00238ba16945}\Shell\configure\command - "" = H:\SETUP.EXE O33 - MountPoints2\{2cadddac-eaca-11e0-92b8-00238ba16945}\Shell\install\command - "" = H:\SETUP.EXE O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.22 22:24:59 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys.fallback [2012.07.22 22:24:58 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys.fallback [2012.07.20 11:31:25 | 000,000,000 | ---D | C] -- C:\ProgramData\0C1CFB130007E17AAB8F885FF875EF60 [2012.07.08 19:35:48 | 000,000,000 | ---D | C] -- C:\Users\Anne\Desktop\Schwalbe [2012.07.02 22:07:13 | 000,000,000 | ---D | C] -- C:\Users\Anne\Desktop\Präsentationen KV [2012.06.23 22:39:04 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\Nitro PDF [2012.06.23 22:39:04 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\FileOpen [2012.06.23 22:39:04 | 000,000,000 | ---D | C] -- C:\ProgramData\FileOpen [2012.06.23 22:38:26 | 000,029,712 | ---- | C] (Nitro PDF Software) -- C:\Windows\SysNative\nitrolocalmon2.dll [2012.06.23 22:38:26 | 000,017,936 | ---- | C] (Nitro PDF Software) -- C:\Windows\SysNative\nitrolocalui2.dll [2012.06.23 22:38:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Nitro PDF [2012.06.23 22:38:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nitro PDF [2012.06.23 22:38:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nitro PDF [2012.06.23 22:38:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nitro PDF [2012.06.23 22:37:36 | 000,000,000 | ---D | C] -- C:\Users\Anne\AppData\Roaming\Downloaded Installations [2012.06.23 22:22:33 | 000,000,000 | ---D | C] -- C:\Users\Anne\Desktop\SEMINARARBEIT DOKUMENTE CD [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.22 23:24:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.07.22 23:21:57 | 000,000,168 | ---- | M] () -- C:\Users\Anne\defogger_reenable [2012.07.22 22:24:47 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys.fallback [2012.07.22 22:24:47 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys.fallback [2012.07.22 16:57:58 | 000,021,808 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.22 16:57:58 | 000,021,808 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.22 16:52:18 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.07.22 16:50:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.22 16:49:56 | 3145,101,312 | -HS- | M] () -- C:\hiberfil.sys [2012.07.21 22:24:47 | 000,132,832 | ---- | M] () -- C:\Windows\SysNative\drivers\avipbb.sys [2012.07.21 22:24:47 | 000,027,760 | ---- | M] () -- C:\Windows\SysNative\drivers\avkmgr.sys [2012.07.20 19:47:37 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.13 16:37:54 | 000,588,337 | ---- | M] () -- C:\Users\Anne\Desktop\IMG_0797.jpg [2012.07.13 16:28:15 | 000,066,718 | ---- | M] () -- C:\Users\Anne\Desktop\hannes.jpg [2012.07.10 21:30:30 | 000,014,777 | ---- | M] () -- C:\Users\Anne\Desktop\196676_1886300047319_7496332_n.jpg [2012.07.10 21:25:13 | 000,042,502 | ---- | M] () -- C:\Users\Anne\Desktop\198554_1886313927666_763187_n.jpg [2012.07.03 23:12:40 | 000,964,773 | ---- | M] () -- C:\Users\Anne\Desktop\Bild (25).jpg [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.06.26 22:51:01 | 000,140,288 | ---- | M] () -- C:\Users\Anne\Desktop\Ablauf des Insolvenzverfahrens.vsd [2012.06.23 22:38:20 | 000,002,035 | ---- | M] () -- C:\Users\Public\Desktop\Nitro Reader.lnk [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.22 23:21:57 | 000,000,168 | ---- | C] () -- C:\Users\Anne\defogger_reenable [2012.07.21 22:25:00 | 000,027,760 | ---- | C] () -- C:\Windows\SysNative\drivers\avkmgr.sys [2012.07.21 22:24:59 | 000,132,832 | ---- | C] () -- C:\Windows\SysNative\drivers\avipbb.sys [2012.07.20 19:47:37 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.13 16:37:54 | 000,588,337 | ---- | C] () -- C:\Users\Anne\Desktop\IMG_0797.jpg [2012.07.13 16:28:15 | 000,066,718 | ---- | C] () -- C:\Users\Anne\Desktop\hannes.jpg [2012.07.10 21:28:13 | 000,014,777 | ---- | C] () -- C:\Users\Anne\Desktop\196676_1886300047319_7496332_n.jpg [2012.07.10 21:23:55 | 000,042,502 | ---- | C] () -- C:\Users\Anne\Desktop\198554_1886313927666_763187_n.jpg [2012.07.03 23:12:40 | 000,964,773 | ---- | C] () -- C:\Users\Anne\Desktop\Bild (25).jpg [2012.06.26 22:15:07 | 000,140,288 | ---- | C] () -- C:\Users\Anne\Desktop\Ablauf des Insolvenzverfahrens.vsd [2012.06.23 22:38:20 | 000,002,035 | ---- | C] () -- C:\Users\Public\Desktop\Nitro Reader.lnk [2012.06.23 22:38:19 | 000,002,507 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nitro Reader 2.lnk [2012.01.11 13:32:15 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\@ [2012.01.11 13:32:15 | 000,002,048 | -HS- | C] () -- C:\Users\Anne\AppData\Local\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\@ [2011.12.20 11:54:32 | 000,001,456 | ---- | C] () -- C:\Users\Anne\gsview32.ini [2011.10.08 18:36:38 | 000,006,144 | ---- | C] () -- C:\Users\Anne\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.10.04 13:03:14 | 011,165,696 | ---- | C] () -- C:\Users\Anne\AppData\Roaming\Sandra.mdb [2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll ========== LOP Check ========== [2012.01.07 20:08:18 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\.anki [2012.01.26 19:14:37 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\DAEMON Tools Lite [2012.06.23 22:37:36 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\Downloaded Installations [2012.07.22 00:37:35 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\Dropbox [2012.06.23 22:39:04 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\FileOpen [2011.11.11 17:56:35 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\FireShot [2012.05.13 15:07:32 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\IrfanView [2012.07.07 10:56:35 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\Nitro PDF [2011.10.08 18:27:31 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\Samsung [2012.06.21 23:43:38 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\Swiss Academic Software [2012.06.03 21:13:13 | 000,000,000 | ---D | M] -- C:\Users\Anne\AppData\Roaming\XBMC [2012.06.12 14:58:31 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 168 bytes -> C:\Users\Anne\Desktop\Bild (25).jpg:3or4kl4x13tuuug3Byamue2s4b < End of report > Code:
ATTFilter OTL Extras logfile created on: 22.07.2012 23:22:54 - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Anne\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,91 Gb Total Physical Memory | 2,84 Gb Available Physical Memory | 72,64% Memory free
7,81 Gb Paging File | 6,69 Gb Available in Paging File | 85,63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 285,62 Gb Total Space | 33,18 Gb Free Space | 11,62% Space Free | Partition Type: NTFS
Drive D: | 12,47 Gb Total Space | 1,98 Gb Free Space | 15,85% Space Free | Partition Type: NTFS
Computer Name: ANNE-LAPTOP | User Name: Anne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.reg[@ = regfile] -- C:\Windows\regedit.exe ()
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.reg [@ = regfile] -- C:\Windows\regedit.exe ()
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [open] -- regedit.exe "%1" ()
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [open] -- regedit.exe "%1" ()
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallDisableNotify" = 0
"FirewallOverride" = 1
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP270_series" = Canon MP270 series MP Drivers
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{8219EDCB-CE5A-4348-B056-AAC0FE4E99D0}" = Microsoft IntelliType Pro 8.2
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A69B08B1-51B4-46CD-82D2-81232BD51F4A}" = Nitro Reader 2
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2296}_is1" = SiSoftware Sandra Lite 2011.SP5
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"GPL Ghostscript 9.04" = GPL Ghostscript
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"Microsoft IntelliType Pro 8.2" = Microsoft IntelliType Pro 8.2
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{8BECF123-B0EF-4E51-B7F3-923EFE15CC4A}" = Battlefield 2(TM) Demo
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{91140000-0057-0000-0000-0000000FF1CE}" = Microsoft Office Visio 2010
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9739666-2235-42F8-85D6-9B4005DC7951}" = Bing Bar
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AF8FEA18-45B9-4DE0-8CA1-A98125423A93}" = Markstrat Team
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{E12C6653-1FF0-4686-ADB8-589C13AE761F}" = Citavi
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"5513-1208-7298-9440" = JDownloader 0.9
"Anki" = Anki
"A-PDF Split_is1" = A-PDF Split
"Avira AntiVir Desktop" = Avira Free Antivirus
"DAEMON Tools Lite" = DAEMON Tools Lite
"ENTERPRISE" = Microsoft Office Enterprise 2007
"GameSpy Arcade" = GameSpy Arcade
"GSview 4.9" = GSview 4.9
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"IrfanView" = IrfanView (remove only)
"Lidl-Fotos_is1" = Lidl-Fotos
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Office14.VISIOR" = Microsoft Visio Professional 2010
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"MyFreeCodec" = MyFreeCodec
"pdfsam" = pdfsam
"XBMC" = XBMC
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 21.07.2012 17:13:00 | Computer Name = Anne-Laptop | Source = System Restore | ID = 8211
Description =
Error - 21.07.2012 18:00:00 | Computer Name = Anne-Laptop | Source = VSS | ID = 8193
Description =
Error - 21.07.2012 18:00:00 | Computer Name = Anne-Laptop | Source = System Restore | ID = 8193
Description =
Error - 21.07.2012 18:00:00 | Computer Name = Anne-Laptop | Source = System Restore | ID = 8211
Description =
Error - 22.07.2012 10:50:16 | Computer Name = Anne-Laptop | Source = WinMgmt | ID = 28
Description =
Error - 22.07.2012 10:50:22 | Computer Name = Anne-Laptop | Source = Avira Antivirus | ID = 4122
Description = Die Datei AVGDLL_Init(avgntflt) konnte nicht geladen werden. Fehlercode:
0xffffffff
Error - 22.07.2012 10:52:23 | Computer Name = Anne-Laptop | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: dd.exe, Version: 1.13.0.1, Zeitstempel:
0x2a425e19 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.17651,
Zeitstempel: 0x4e211319 Ausnahmecode: 0x0eedfade Fehleroffset: 0x0000b9bc ID des fehlerhaften
Prozesses: 0x7ac Startzeit der fehlerhaften Anwendung: 0x01cd681997c12b67 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Lidl_Fotos\dd.exe Pfad des fehlerhaften
Moduls: C:\Windows\syswow64\KERNELBASE.dll Berichtskennung: d7d20858-d40c-11e1-bd9d-00238ba16945
Error - 22.07.2012 11:51:18 | Computer Name = Anne-Laptop | Source = VSS | ID = 8193
Description =
Error - 22.07.2012 11:51:18 | Computer Name = Anne-Laptop | Source = System Restore | ID = 8193
Description =
Error - 22.07.2012 11:51:18 | Computer Name = Anne-Laptop | Source = System Restore | ID = 8211
Description =
[ OSession Events ]
Error - 03.07.2012 09:17:16 | Computer Name = Anne-Laptop | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session
lasted 10125 seconds with 7080 seconds of active time. This session ended with
a crash.
[ System Events ]
Error - 10.01.2012 17:05:44 | Computer Name = Anne-Laptop | Source = bowser | ID = 8003
Description =
Error - 11.01.2012 15:38:41 | Computer Name = Anne-Laptop | Source = NetBT | ID = 4321
Description = Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit
IP-Adresse 192.168.2.6 registriert werden. Der Computer mit IP-Adresse 192.168.2.2
hat nicht zugelassen, dass dieser Computer diesen Namen verwendet.
Error - 11.01.2012 15:49:10 | Computer Name = Anne-Laptop | Source = BROWSER | ID = 8032
Description =
Error - 23.04.2012 13:17:05 | Computer Name = Anne-Laptop | Source = Tcpip | ID = 4199
Description = Das System hat einen Adressenkonflikt der IP-Adresse 192.168.2.3 mit
dem Computer mit der Netzwerkhardwareadresse 8C-77-12-B5-27-CB ermittelt. Netzwerkvorgänge
könnten daher auf diesem System unterbrochen werden.
Error - 24.04.2012 03:11:02 | Computer Name = Anne-Laptop | Source = volsnap | ID = 393241
Description =
Error - 24.04.2012 03:13:41 | Computer Name = Anne-Laptop | Source = WMPNetworkSvc | ID = 866300
Description =
Error - 25.04.2012 07:27:58 | Computer Name = Anne-Laptop | Source = BROWSER | ID = 8032
Description =
Error - 25.04.2012 08:14:20 | Computer Name = Anne-Laptop | Source = bowser | ID = 8003
Description =
< End of report >
Code:
ATTFilter Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.20.07 Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 9.0.8112.16421 Anne :: ANNE-LAPTOP [Administrator] 20.07.2012 19:48:26 mbam-log-2012-07-20 (19-48-26).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 650740 Laufzeit: 2 Stunde(n), 20 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum (Trojan.LameShield) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 3 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|3cel21f1px (Rootkit.Agent) -> Daten: C:\Users\Anne\3cel21f1px.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce|0C1CFB130007E17AAB8F885FF875EF60 (Trojan.LameShield) -> Daten: C:\ProgramData\0C1CFB130007E17AAB8F885FF875EF60\0C1CFB130007E17AAB8F885FF875EF60.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Regedit32 (Trojan.Agent) -> Daten: C:\Windows\system32\regedit.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 3 HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 1 C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum (Rogue.LiveSecurityPlatinum) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 4 C:\Users\Anne\3cel21f1px.exe (Rootkit.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\0C1CFB130007E17AAB8F885FF875EF60\0C1CFB130007E17AAB8F885FF875EF60.exe (Trojan.LameShield) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Anne\Desktop\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Anne |
|
25.07.2012, 13:51
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Entfernen von Live Security Platinum erfolgreich? Bitte erstmal routinemäßig einen neuen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
__________________Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ |
|
26.07.2012, 20:12
| #3 |
| | Entfernen von Live Security Platinum erfolgreich? Malewarebites har nichts mehr gefunden. Bei Eset aber 4 Funde.
__________________Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=6148e4742f43724b9d9e543e929ffab9
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-26 06:59:50
# local_time=2012-07-26 08:59:50 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 8967797 8967797 0 0
# compatibility_mode=5893 16776574 66 94 5415322 94940174 0 0
# compatibility_mode=8192 67108863 100 0 193 193 0 0
# scanned=687490
# found=4
# cleaned=0
# scan_time=18866
C:\Users\Anne\AppData\Local\Temp\is1070216317\MyBabylonTB.exe Win32/Toolbar.Babylon application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Anne\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\2087358f-18452477 a variant of Java/Exploit.CVE-2012-1723.M trojan (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\Documents and Settings\Owner\Downloads\x-dvd-creator6-de.exe Win32/Toolbar.Zugo application (unable to clean) 00000000000000000000000000000000 I
C:\Windows.old\Users\Owner\Downloads\x-dvd-creator6-de.exe Win32/Toolbar.Zugo application (unable to clean) 00000000000000000000000000000000 I
|
|
26.07.2012, 23:01
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Entfernen von Live Security Platinum erfolgreich? Trotzdem bitte alle Logs von Malwarebytes posten Die Logs enthalten ein paar mehr Infos als nur Fund oder kein Fund. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
26.07.2012, 23:26
| #5 |
| | Entfernen von Live Security Platinum erfolgreich? Das ist das aktuelle Log von Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.25.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Anne :: ANNE-LAPTOP [Administrator] 25.07.2012 21:57:50 mbam-log-2012-07-25 (21-57-50).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 642648 Laufzeit: 2 Stunde(n), 13 Minute(n), 38 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
27.07.2012, 08:28
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Entfernen von Live Security Platinum erfolgreich? adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren Downloade Dir bitte AdwCleaner auf deinen Desktop.
__________________ --> Entfernen von Live Security Platinum erfolgreich? |
|
27.07.2012, 10:46
| #7 |
| | Entfernen von Live Security Platinum erfolgreich?Code:
ATTFilter
# AdwCleaner v1.703 - Logfile created 07/27/2012 at 11:44:08
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Anne - ANNE-LAPTOP
# Running from : C:\Users\Anne\Desktop\adwcleaner.exe
# Option [Search]
***** [Services] *****
***** [Files / Folders] *****
***** [Registry] *****
Key Found : HKLM\SOFTWARE\DT Soft
***** [Registre - GUID] *****
Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v14.0.1 (de)
Profile name : default
File : C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\ph0hnpmd.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [1247 octets] - [27/07/2012 11:44:08]
########## EOF - C:\AdwCleaner[R1].txt - [1375 octets] ##########
|
|
27.07.2012, 13:30
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Entfernen von Live Security Platinum erfolgreich? Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.07.2012, 20:34
| #9 |
| | Entfernen von Live Security Platinum erfolgreich? Ok habe beides laufen lassen. Hier die Ergebnisse.. Malewarebytes: Code:
ATTFilter Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.27.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Anne :: ANNE-LAPTOP [Administrator] 27.07.2012 15:49:06 mbam-log-2012-07-27 (15-49-06).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 644824 Laufzeit: 2 Stunde(n), 15 Minute(n), 45 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 07/28/2012 at 09:25 PM
Application Version : 5.5.1012
Core Rules Database Version : 8971
Trace Rules Database Version: 6783
Scan type : Complete Scan
Total Scan Time : 05:11:56
Operating System Information
Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)
UAC Off - Administrator
Memory items scanned : 554
Memory threats detected : 0
Registry items scanned : 66424
Registry threats detected : 0
File items scanned : 401952
File threats detected : 239
Adware.Tracking Cookie
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\NCOX0Y1O.txt [ /serving-sys.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\Z4WYWLTP.txt [ /www.zanox-affiliate.de ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\BIO22TLE.txt [ /track.adform.net ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\7HZ4PDE0.txt [ /adform.net ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\NYTS4BBC.txt [ /c.atdmt.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\04C4076T.txt [ /imrworldwide.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\06X0J8VC.txt [ /doubleclick.net ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\JV3AU331.txt [ /adfarm1.adition.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\JJPKEXBQ.txt [ /ad2.adfarm1.adition.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\24YB143T.txt [ /tracking.quisma.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\T9UME4XA.txt [ /fastclick.net ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\WYGX6DPI.txt [ /zanox-affiliate.de ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\1CJHV2M6.txt [ /apmebf.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\P5YQT1K9.txt [ /atdmt.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\VVZQ54NW.txt [ /ad.zanox.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\ARAZMWUD.txt [ /ad.dyntracker.de ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\O5ZLO0OS.txt [ /zanox.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\FRHQ8K00.txt [ /mediaplex.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\2MTXN1K5.txt [ /ad1.adfarm1.adition.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\I9L1TDYM.txt [ /ad3.adfarm1.adition.com ]
C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Cookies\DZ3T4Z8H.txt [ /smartadserver.com ]
C:\USERS\ANNE\AppData\Roaming\Microsoft\Windows\Cookies\Low\anne@serving-sys[1].txt [ Cookie:anne@serving-sys.com/ ]
C:\USERS\ANNE\AppData\Roaming\Microsoft\Windows\Cookies\Low\anne@2o7[1].txt [ Cookie:anne@2o7.net/ ]
C:\USERS\ANNE\AppData\Roaming\Microsoft\Windows\Cookies\Low\anne@doubleclick[1].txt [ Cookie:anne@doubleclick.net/ ]
C:\USERS\ANNE\AppData\Roaming\Microsoft\Windows\Cookies\Low\anne@apmebf[1].txt [ Cookie:anne@apmebf.com/ ]
C:\USERS\ANNE\AppData\Roaming\Microsoft\Windows\Cookies\Low\WGFEJ812.txt [ Cookie:anne@atdmt.com/ ]
C:\USERS\ANNE\AppData\Roaming\Microsoft\Windows\Cookies\Low\anne@mediaplex[1].txt [ Cookie:anne@mediaplex.com/ ]
C:\USERS\ANNE\Cookies\NCOX0Y1O.txt [ Cookie:anne@serving-sys.com/ ]
C:\USERS\ANNE\Cookies\Z4WYWLTP.txt [ Cookie:anne@www.zanox-affiliate.de/ ]
C:\USERS\ANNE\Cookies\BIO22TLE.txt [ Cookie:anne@track.adform.net/ ]
C:\USERS\ANNE\Cookies\7HZ4PDE0.txt [ Cookie:anne@adform.net/ ]
C:\USERS\ANNE\Cookies\NYTS4BBC.txt [ Cookie:anne@c.atdmt.com/ ]
C:\USERS\ANNE\Cookies\04C4076T.txt [ Cookie:anne@imrworldwide.com/cgi-bin ]
C:\USERS\ANNE\Cookies\06X0J8VC.txt [ Cookie:anne@doubleclick.net/ ]
C:\USERS\ANNE\Cookies\JV3AU331.txt [ Cookie:anne@adfarm1.adition.com/ ]
C:\USERS\ANNE\Cookies\24YB143T.txt [ Cookie:anne@tracking.quisma.com/ ]
C:\USERS\ANNE\Cookies\T9UME4XA.txt [ Cookie:anne@fastclick.net/ ]
C:\USERS\ANNE\Cookies\1CJHV2M6.txt [ Cookie:anne@apmebf.com/ ]
C:\USERS\ANNE\Cookies\P5YQT1K9.txt [ Cookie:anne@atdmt.com/ ]
C:\USERS\ANNE\Cookies\VVZQ54NW.txt [ Cookie:anne@ad.zanox.com/ ]
C:\USERS\ANNE\Cookies\ARAZMWUD.txt [ Cookie:anne@ad.dyntracker.de/ ]
C:\USERS\ANNE\Cookies\O5ZLO0OS.txt [ Cookie:anne@zanox.com/ ]
C:\USERS\ANNE\Cookies\FRHQ8K00.txt [ Cookie:anne@mediaplex.com/ ]
C:\USERS\ANNE\Cookies\2MTXN1K5.txt [ Cookie:anne@ad1.adfarm1.adition.com/ ]
C:\USERS\ANNE\Cookies\I9L1TDYM.txt [ Cookie:anne@ad3.adfarm1.adition.com/ ]
C:\USERS\ANNE\Cookies\DZ3T4Z8H.txt [ Cookie:anne@smartadserver.com/ ]
C:\USERS\ANNE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\ANNE@BS.SERVING-SYS[1].TXT [ /BS.SERVING-SYS ]
C:\USERS\ANNE\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\ANNE@ZANOX-AFFILIATE[1].TXT [ /ZANOX-AFFILIATE ]
.guj.122.2o7.net [ C:\USERS\ANNE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PH0HNPMD.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\ANNE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PH0HNPMD.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\USERS\ANNE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PH0HNPMD.DEFAULT\COOKIES.SQLITE ]
account.nokia.com [ C:\USERS\ANNE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PH0HNPMD.DEFAULT\COOKIES.SQLITE ]
account.nokia.com [ C:\USERS\ANNE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PH0HNPMD.DEFAULT\COOKIES.SQLITE ]
banners.securedataimages.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
cdn4.specificclick.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
cdn5.specificclick.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
content.oddcast.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
html5media.googlecode.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
ia.media-imdb.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
icq.oberon-media.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
imagesrv.adition.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
inwmedia.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
m.doubleclick.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
m1.emea.2mdn.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
macromedia.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
media.mtvnservices.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
media.muchosmedia.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
media.scanscout.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
media01.kyte.tv [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
oddcast.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
s0.2mdn.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
secure-us.imrworldwide.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
serving-sys.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
swrmediathek.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
vfsexb.gmx.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
www.secmedia.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SRBKAU3C ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@TRACKING.QUISMA[2].TXT [ /TRACKING.QUISMA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@INTERCLICK[1].TXT [ /INTERCLICK ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@C7.ZEDO[1].TXT [ /C7.ZEDO ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@SERVING-SYS[2].TXT [ /SERVING-SYS ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@2O7[2].TXT [ /2O7 ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@TRACKING.MINDSHARE[1].TXT [ /TRACKING.MINDSHARE ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@MEDIAPLEX[2].TXT [ /MEDIAPLEX ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@INSIGHTEXPRESSAI[2].TXT [ /INSIGHTEXPRESSAI ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@DOUBLECLICK[2].TXT [ /DOUBLECLICK ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@ADSERVER.71I[1].TXT [ /ADSERVER.71I ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@TRAFFICMP[1].TXT [ /TRAFFICMP ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@ATDMT[2].TXT [ /ATDMT ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@WWW.ETRACKER[1].TXT [ /WWW.ETRACKER ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@ADFARM1.ADITION[1].TXT [ /ADFARM1.ADITION ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@SPECIFICCLICK[2].TXT [ /SPECIFICCLICK ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@AT.ATWOLA[1].TXT [ /AT.ATWOLA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@BS.SERVING-SYS[1].TXT [ /BS.SERVING-SYS ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@SEVENONEINTERMEDIA.112.2O7[1].TXT [ /SEVENONEINTERMEDIA.112.2O7 ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@ADVERTISING[1].TXT [ /ADVERTISING ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@AGOFEV.122.2O7[1].TXT [ /AGOFEV.122.2O7 ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@TRADEDOUBLER[1].TXT [ /TRADEDOUBLER ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@APMEBF[1].TXT [ /APMEBF ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\OWNER@ZEDO[1].TXT [ /ZEDO ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@WWW.ZANOX-AFFILIATE[1].TXT [ /WWW.ZANOX-AFFILIATE ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@TRACK.ADFORM[2].TXT [ /TRACK.ADFORM ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@GAMECENTER.OBERON-MEDIA[2].TXT [ /GAMECENTER.OBERON-MEDIA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@XM.XTENDMEDIA[1].TXT [ /XM.XTENDMEDIA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@OBERON-MEDIA[2].TXT [ /OBERON-MEDIA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@SERVING-SYS[2].TXT [ /SERVING-SYS ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@2O7[2].TXT [ /2O7 ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@TRACKING.MINDSHARE[2].TXT [ /TRACKING.MINDSHARE ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@MEDIAPLEX[2].TXT [ /MEDIAPLEX ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@AD.PERFORMANCE-NETZWERK[2].TXT [ /AD.PERFORMANCE-NETZWERK ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@DOUBLECLICK[2].TXT [ /DOUBLECLICK ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@BLUESTREAK[1].TXT [ /BLUESTREAK ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@AD.71I[1].TXT [ /AD.71I ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@ZBOX.ZANOX[1].TXT [ /ZBOX.ZANOX ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@ZANOX-AFFILIATE[1].TXT [ /ZANOX-AFFILIATE ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@ADSERVER.71I[1].TXT [ /ADSERVER.71I ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@CDN.AT.ATWOLA[1].TXT [ /CDN.AT.ATWOLA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@IMRWORLDWIDE[2].TXT [ /IMRWORLDWIDE ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@ATDMT[1].TXT [ /ATDMT ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@AD.ADNET[1].TXT [ /AD.ADNET ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@AD2.ADFARM1.ADITION[2].TXT [ /AD2.ADFARM1.ADITION ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@ADFARM1.ADITION[1].TXT [ /ADFARM1.ADITION ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@ADSERVER.TRAFFICTRACK[1].TXT [ /ADSERVER.TRAFFICTRACK ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@TACODA[2].TXT [ /TACODA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@APMEBF[2].TXT [ /APMEBF ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@AT.ATWOLA[2].TXT [ /AT.ATWOLA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@AR.ATWOLA[1].TXT [ /AR.ATWOLA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@BS.SERVING-SYS[1].TXT [ /BS.SERVING-SYS ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@SEVENONEINTERMEDIA.112.2O7[1].TXT [ /SEVENONEINTERMEDIA.112.2O7 ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@TACODA.AT.ATWOLA[1].TXT [ /TACODA.AT.ATWOLA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@ADVERTISING[1].TXT [ /ADVERTISING ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@TRADEDOUBLER[1].TXT [ /TRADEDOUBLER ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@ADS.HEIAS[2].TXT [ /ADS.HEIAS ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@TRACKING.HANNOVERSCHE[2].TXT [ /TRACKING.HANNOVERSCHE ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@CONTENT.YIELDMANAGER[1].TXT [ /CONTENT.YIELDMANAGER ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@WEBMASTERPLAN[1].TXT [ /WEBMASTERPLAN ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@UNITYMEDIA[1].TXT [ /UNITYMEDIA ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@ZANOX[1].TXT [ /ZANOX ]
C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\OWNER@ATWOLA[1].TXT [ /ATWOLA ]
.guj.122.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
tracking.tchibo.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.viewablemedia.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.xiti.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.aon.122.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.stepstone.112.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wjkywjdzkkq.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.legolas-media.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.legolas-media.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.mediamarkt.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
in.getclicky.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wjkywoaziap.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wfk4spc5cdq.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6aelyencpadq.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6whk4qoajagq.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.paypal.112.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.mediacollege.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.mediacollege.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.mediacollege.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.zanox-affiliate.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
wstat.wibiya.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.yadro.ru [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
media3.tchibo-content.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
media1.tchibo-content.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.sevenoneintermedia.112.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wfkygidjgdo.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wjkyqhazmhp.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.mediamarkt.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wnl4ahazadq.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.cunda.122.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.vodafonegroup.122.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.discount-travel.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.discount-travel.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.discount-travel.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
ww2.discount-travel.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.discount-travel.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.discount-travel.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.discount-travel.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.discount-travel.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.discount-travel.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.fileuploadx.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.fileuploadx.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.fileuploadx.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6aekykidpcbp.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6aekiehdjekq.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.deutschepostag.112.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wjmyqpajcfo.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.getclicky.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.static.getclicky.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
fr.sitestat.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
fr.sitestat.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.conrad.122.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wjk4uidjkkq.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.autoscout24.112.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.e-2dj6wnlyopajmlp.stats.esomniture.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
accounts.youtube.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
accounts.google.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
tracking.mobile.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\WINDOWS.OLD\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\816070O0.DEFAULT\COOKIES.SQLITE ]
Trojan.Agent/Gen-FakeAV
C:\WINDOWS.OLD\PROGRAM FILES (X86)\WINRAR\DEFAULT.SFX
|
|
29.07.2012, 16:17
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Entfernen von Live Security Platinum erfolgreich? Sieht ok aus, da wurden nur Cookies gefunden und ein Fehlalarm war dabei. Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/ Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.07.2012, 17:00
| #11 |
| | Entfernen von Live Security Platinum erfolgreich? Vielen vielen Dank! Ansonsten passt alles. |
|
29.07.2012, 19:21
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Entfernen von Live Security Platinum erfolgreich? Dann wären wir durch!  Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen: Starte bitte OTL und klicke auf Bereinigung. Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen. Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken. Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden. Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern. Microsoftupdate Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Anleitung Windows-Update PDF-Reader aktualisieren Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast) Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers: Prüfen => Adobe - Flash Player Downloadlinks => Adobe Flash Player Distribution | Adobe Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind. Java-Update Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Entfernen von Live Security Platinum erfolgreich? |
| adobe, antivir, autorun, avg, avira, bho, bingbar, canon, desktop, device driver, document, entfernen, error, firefox, flash player, format, google earth, helper, heuristiks/extra, heuristiks/shuriken, install.exe, ip-adresse, jdownloader, langs, live security platinum, logfile, microsoft office word, mozilla, plug-in, registry, rundll, scan, searchscopes, security, senden, software, temp, trojaner, usb, windows |
Linear-Darstellung
