| CivicSi907 | 13.11.2012 15:55 |
Ok sorry,
hier die Logfiles als Code angehängt.
Die Avast weiss ich nicht wie ich sie als anderes Format posten soll. Ich kann jede einzelne txt file hier auch als Code einfügen wenn du willst.
Malwarebytes: Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org
Datenbank Version: v2012.08.12.03
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Tull :: TULL-PC [Administrator]
12.08.2012 11:33:13
mbam-log-2012-08-12 (11-33-13).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 180619
Laufzeit: 5 Minute(n), 7 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\CLASSES\CLSID\{42AEDC87-2188-41FD-B9A3-0C966FEABEC1}\INPROCSERVER32 (Trojan.Zaccess) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32| (Trojan.Zaccess) -> Daten: C:\Users\Tull\AppData\Local\{29243544-8a98-d44a-3626-30239398ecb2}\n. -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 6
C:\Users\Tull\AppData\Local\Temp\ggqwo.exe (Trojan.Inject) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Tull\AppData\Local\Temp\~!#8191.tmp (Trojan.LameShield) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Tull\AppData\Local\Temp\~!#EA9A.tmp (Trojan.Phex.THAGen4) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Tull\AppData\Local\Temp\~!#F04A.tmp (Spyware.Password) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{29243544-8a98-d44a-3626-30239398ecb2}\n (Trojan.Dropper.PE4) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{29243544-8a98-d44a-3626-30239398ecb2}\U\800000cb.@ (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende)
Hijackthis: Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:48:26, on 13.11.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe
C:\Program Files\CyberLink\Shared Files\brs.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Tull\Desktop\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yahoo.com/?ilc=8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/?ilc=8
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl9] "C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe"
O4 - HKLM\..\Run: [PDVD9LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
--
End of file - 4741 bytes
OTL Code:
OTL logfile created on: 12.11.2012 13:58:37 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\******\Desktop
Enterprise Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,50 Gb Total Physical Memory | 1,33 Gb Available Physical Memory | 53,24% Memory free
5,00 Gb Paging File | 3,71 Gb Available in Paging File | 74,34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111,79 Gb Total Space | 80,23 Gb Free Space | 71,77% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 126,01 Gb Free Space | 84,55% Space Free | Partition Type: NTFS
Computer Name: ******-PC | User Name: ****** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\******\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\CyberLink\Shared Files\brs.exe (cyberlink)
PRC - C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)
========== Modules (No Company Name) ==========
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
========== Services (SafeList) ==========
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (NAUpdate) -- C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (VGPU) -- System32\drivers\rdvgkmd.sys File not found
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr2.sys (AVAST Software)
DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (tsusbhub) -- C:\Windows\System32\drivers\tsusbhub.sys (Microsoft Corporation)
DRV - (Synth3dVsc) -- C:\Windows\System32\drivers\Synth3dVsc.sys (Microsoft Corporation)
DRV - (dmvsc) -- C:\Windows\System32\drivers\dmvsc.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV - (terminpt) -- C:\Windows\System32\drivers\terminpt.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (HCW88TSE) -- C:\Windows\System32\drivers\hcw88tse.sys (Hauppauge Computer Works, Inc)
DRV - (hcw88bda) -- C:\Windows\System32\drivers\hcw88bda.sys (Hauppauge Computer Works, Inc)
DRV - (HCW88AUD) -- C:\Windows\System32\drivers\hcw88aud.sys (Hauppauge Computer Works, Inc)
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (Serial) -- C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ALCXWDM) -- C:\Windows\System32\drivers\RTKVAC.SYS (Realtek Semiconductor Corp.)
DRV - ({B154377D-700F-42cc-9474-23858FBDF4BD}) -- C:\Program Files\CyberLink\PowerDVD9\000.fcl (CyberLink Corp.)
DRV - (nvmpu401) -- C:\Windows\System32\drivers\nvmpu401.sys (NVIDIA Corporation)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys ()
DRV - (QCDonner) -- C:\Windows\System32\drivers\lvcd.sys (Logitech Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yahoo.com/?ilc=8
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/?ilc=8
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\..\SearchScopes,DefaultScope = {DECA3892-BA8F-44b8-A993-A466AD694AE4}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&fr=mkg028
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.yahoo.com/search?fr=mkg030&p="
FF - prefs.js..browser.startup.homepage: "hxxp://www.jtull.com/"
FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}:6.0.33
FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}:6.0.37
FF - prefs.js..keyword.URL: "hxxp://search.yahoo.com/search?fr=mkg030&p="
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.2.72: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.2.72: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.2.72: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.2.72: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.2.72: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.10.26 17:40:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.01 07:12:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.01 07:12:46 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.01 07:12:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.01 07:12:46 | 000,000,000 | ---D | M]
[2012.04.15 15:00:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\******\AppData\Roaming\mozilla\Extensions
[2012.10.30 06:11:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\eocgc70j.default\extensions
[2012.11.01 07:12:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.11.01 07:12:43 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.11.01 07:12:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012.11.01 07:12:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2012.11.01 07:12:53 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.06.28 07:47:43 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.06 05:29:47 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.28 07:47:43 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.28 07:47:43 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.28 07:47:43 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.28 07:47:43 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [PDVD9LanguageShortcut] C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl9] C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{687CB05E-693F-416E-B7CA-3D9FCE086476}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2003.01.01 01:49:38 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012.11.12 13:57:30 | 000,000,000 | ---D | C] -- C:\Users\******\Desktop\backups
[2012.11.12 13:54:16 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\******\Desktop\HijackThis.exe
[2012.11.12 13:43:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\******\Desktop\OTL.exe
[2012.11.12 13:38:18 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.11.12 13:37:14 | 010,524,080 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\******\Desktop\mbam-setup-1.65.0.1400.exe
[2012.11.12 13:27:59 | 000,000,000 | R--D | C] -- C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 9
[2012.11.01 07:12:42 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.10.29 14:27:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.10.29 14:26:39 | 000,157,680 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2012.10.29 14:26:39 | 000,149,488 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2012.10.29 14:26:39 | 000,149,488 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2012.10.26 17:41:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2012.10.26 17:40:59 | 000,021,256 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2012.10.26 17:40:58 | 000,360,392 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2012.10.26 17:40:54 | 000,044,784 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr2.sys
[2012.10.26 17:40:53 | 000,054,232 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2012.10.26 17:40:52 | 000,738,504 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2012.10.26 17:40:42 | 000,058,680 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2012.10.26 17:40:18 | 000,041,224 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.10.26 17:40:17 | 000,227,648 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2012.10.26 17:40:03 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2012.10.26 17:40:03 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012.10.26 17:25:09 | 000,000,000 | ---D | C] -- C:\Users\******\AppData\Local\Diagnostics
[1 C:\Users\******\Documents\*.tmp files -> C:\Users\******\Documents\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.11.12 13:54:57 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\******\Desktop\HijackThis.exe
[2012.11.12 13:43:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\******\Desktop\OTL.exe
[2012.11.12 13:40:00 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.11.12 13:39:42 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.11.12 13:38:35 | 000,023,840 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.12 13:38:35 | 000,023,840 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.12 13:37:19 | 010,524,080 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\******\Desktop\mbam-setup-1.65.0.1400.exe
[2012.11.12 13:32:19 | 000,651,768 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.12 13:32:19 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.12 13:32:19 | 000,129,468 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.12 13:32:19 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.12 13:27:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.12 13:27:42 | 2012,913,664 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.12 08:20:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.10 09:43:33 | 000,108,946 | ---- | M] () -- C:\Users\******\Documents\Volkswagen Passat Variant 1.6 ca Break în München.htm
[2012.11.10 09:38:11 | 000,100,375 | ---- | M] () -- C:\Users\******\Documents\Citroën Berlingo 1.6 HDI -EURO4 ca Furgonetă Microbuz în München.htm
[2012.11.10 09:33:20 | 000,103,160 | ---- | M] () -- C:\Users\******\Documents\Opel Meriva 1.7 DTI Enjoy ca Furgonetă Microbuz în Olching.htm
[2012.10.26 17:40:42 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012.10.23 11:18:34 | 000,738,504 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2012.10.23 11:18:34 | 000,360,392 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2012.10.23 11:18:34 | 000,054,232 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2012.10.23 11:18:33 | 000,058,680 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2012.10.23 11:18:32 | 000,021,256 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2012.10.23 11:17:48 | 000,041,224 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.10.23 11:17:38 | 000,227,648 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2012.10.15 17:59:28 | 000,044,784 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr2.sys
[1 C:\Users\******\Documents\*.tmp files -> C:\Users\******\Documents\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.11.12 13:38:10 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.11.10 09:42:56 | 000,108,946 | ---- | C] () -- C:\Users\******\Documents\Volkswagen Passat Variant 1.6 ca Break în München.htm
[2012.11.10 09:37:34 | 000,100,375 | ---- | C] () -- C:\Users\******\Documents\Citroën Berlingo 1.6 HDI -EURO4 ca Furgonetă Microbuz în München.htm
[2012.11.10 09:32:41 | 000,103,160 | ---- | C] () -- C:\Users\******\Documents\Opel Meriva 1.7 DTI Enjoy ca Furgonetă Microbuz în Olching.htm
[2012.08.12 10:47:09 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.04.15 15:05:13 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2012.04.15 15:05:12 | 000,651,768 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2012.04.15 15:05:12 | 000,129,468 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2012.04.15 15:05:12 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2012.04.15 14:49:15 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.04.15 14:49:15 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2010.11.20 22:29:34 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2010.11.20 22:29:26 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
========== ZeroAccess Check ==========
[2011.11.17 06:38:39 | 000,002,048 | -HS- | M] () -- C:\Windows\Installer\{29243544-8a98-d44a-3626-30239398ecb2}\@
[2011.11.17 06:38:39 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\{29243544-8a98-d44a-3626-30239398ecb2}\L
[2012.11.09 17:31:07 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\{29243544-8a98-d44a-3626-30239398ecb2}\U
[2012.11.09 17:31:07 | 000,000,928 | ---- | M] () -- C:\Windows\Installer\{29243544-8a98-d44a-3626-30239398ecb2}\U\00000001.@
[2012.10.28 17:44:17 | 000,011,776 | ---- | M] () -- C:\Windows\Installer\{29243544-8a98-d44a-3626-30239398ecb2}\U\80000000.@
[2012.09.24 05:13:55 | 000,021,504 | ---- | M] () -- C:\Windows\Installer\{29243544-8a98-d44a-3626-30239398ecb2}\U\800000cb.@
[2012.08.09 08:38:08 | 000,002,048 | -HS- | M] () -- C:\Users\******\AppData\Local\{29243544-8a98-d44a-3626-30239398ecb2}\@
[2011.11.17 06:38:39 | 000,000,000 | -HSD | M] -- C:\Users\******\AppData\Local\{29243544-8a98-d44a-3626-30239398ecb2}\L
[2011.11.17 06:38:39 | 000,000,000 | -HSD | M] -- C:\Users\******\AppData\Local\{29243544-8a98-d44a-3626-30239398ecb2}\U
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.01.04 09:59:38 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 22:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
< End of report >
Extras Code:
OTL Extras logfile created on: 12.11.2012 13:58:37 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\******\Desktop
Enterprise Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,50 Gb Total Physical Memory | 1,33 Gb Available Physical Memory | 53,24% Memory free
5,00 Gb Paging File | 3,71 Gb Available in Paging File | 74,34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111,79 Gb Total Space | 80,23 Gb Free Space | 71,77% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 126,01 Gb Free Space | 84,55% Space Free | Partition Type: NTFS
Computer Name: ******-PC | User Name: ****** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
========== Firewall Settings ==========
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01E9B2FF-DAF4-4529-9CC9-2101625517C7}" = nero.prerequisites.msi
"{034DCAF9-96E7-4936-9A07-712F80B5181E}" = Nero RescueAgent 11
"{11D3EF85-63E1-4AE4-A7C1-9241BDB16B51}" = Nero ControlCenter 11
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 37
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53F7746A-96AA-49A5-86B8-59989680DAC5}" = Nero Burning ROM 11 Help (CHM)
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{B1846721-A8E6-46C7-83B6-0DCF7ADB4267}" = Nero Burning ROM 11
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components 11
"{C38D079C-950D-4F18-BF7B-CE58DE86D3BD}" = Image Resizer Powertoy Clone for Windows
"{D01CE99A-8802-483C-A79F-298B691EB432}" = Nero RescueAgent 11 Help (CHM)
"{D4D66270-9147-4BDF-9946-FCA2B303AA8F}" = Nero ControlCenter 11 Help (CHM)
"{E656D89A-8CBB-497F-918F-8361A4071C26}" = Nero Burning ROM 11
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"5513-1208-7298-9440" = JDownloader 0.9
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Any DVD Shrink_is1" = Any DVD Shrink 1.2.8
"AnyDVD" = AnyDVD
"avast" = avast! Free Antivirus
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"RealPlayer 15.0" = RealPlayer
"The KMPlayer" = The KMPlayer (remove only)
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 29.08.2012 13:44:35 | Computer Name = ******-PC | Source = WinMgmt | ID = 10
Description =
Error - 29.08.2012 14:24:15 | Computer Name = ******-PC | Source = WinMgmt | ID = 10
Description =
Error - 30.08.2012 00:09:20 | Computer Name = ******-PC | Source = WinMgmt | ID = 10
Description =
Error - 30.08.2012 23:53:14 | Computer Name = ******-PC | Source = WinMgmt | ID = 10
Description =
Error - 01.09.2012 00:11:49 | Computer Name = ******-PC | Source = WinMgmt | ID = 10
Description =
Error - 01.09.2012 05:42:33 | Computer Name = ******-PC | Source = WinMgmt | ID = 10
Description =
Error - 02.09.2012 07:11:28 | Computer Name = ******-PC | Source = WinMgmt | ID = 10
Description =
Error - 02.09.2012 11:30:09 | Computer Name = ******-PC | Source = WinMgmt | ID = 10
Description =
Error - 03.09.2012 00:00:47 | Computer Name = ******-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.09.2012 00:14:56 | Computer Name = ******-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 02.11.2012 01:16:45 | Computer Name = ******-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Function Discovery Resource Publication" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 02.11.2012 09:01:39 | Computer Name = ******-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Function Discovery Resource Publication" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 03.11.2012 01:14:18 | Computer Name = ******-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Function Discovery Resource Publication" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 03.11.2012 01:59:25 | Computer Name = ******-PC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "avast! Antivirus" wurde unerwartet beendet. Dies ist bereits
1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt:
Restart the service.
Error - 04.11.2012 08:00:19 | Computer Name = ******-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Function Discovery Resource Publication" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 05.11.2012 10:21:33 | Computer Name = ******-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Function Discovery Resource Publication" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 05.11.2012 14:34:46 | Computer Name = ******-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Function Discovery Resource Publication" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 06.11.2012 11:51:02 | Computer Name = ******-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Function Discovery Resource Publication" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 06.11.2012 14:18:59 | Computer Name = ******-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Function Discovery Resource Publication" wurde mit folgendem
Fehler beendet: %%-2147024891
Error - 06.11.2012 16:15:06 | Computer Name = ******-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Function Discovery Resource Publication" wurde mit folgendem
Fehler beendet: %%-2147024891
< End of report >
Auszug aus Avast (NetzwerkShield.txt): Code:
10.11.2012 09:30:35 hxxp://30992.quickfindtoday.com/fly?q=kichler+fixtures&enk=RsGGmY+hj4mPmQbJJ5GPiWapRqlmsUaJxuMm46Y= [L] URL:Mal (0)
10.11.2012 09:31:31 hxxp://gfuhijqp.cm/XlFHXVhHW1laR1hbWUYKRxkBGVYBVFhcXFxRWlFfXltdUU8aVAwoLy8DG1kiHgMoMCgvRAUCXRw4IxgHXCxdBg42BCgvLAwFOFonJVkaEAUYWDo4PAU9EFEmGwcMCiEKWwE5Glk9PVgtP1sOXxs7GjkLDiohEyZbCEQAXigTJzhcEDsBBS4IDCwKEFwuJCwoD1EfC1EFIjwcJSssMRxaG147XlE2PQYzPiUKGBgEIFBaDQhRWyseXx9QClwcBV0+GQAfDQEcUR4DPzwRLwMbJyAZLDsiBghROyo7BTkbOV5YIAIwMDBfGSwnKwtZOT0hHAwRODoGWFs9JitaKDtRIDACXAcCDgJcAjYvNlBEKA0hAD1bEQ== [L] URL:Mal (0)
10.11.2012 09:33:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdYUEZWCgUADVQaXVlYGQMHGl8GE1k= [L] URL:Mal (0)
10.11.2012 09:33:40 hxxp://46056.suggesttool.com/result/?affiliate=46056&subid=1297603&subsid=0&terms=td%20asset%20management&clickid=NzI2NjFlZTIwMWRlNTI0YTMzMzU2Y2E3YmRlZWNjMmM6c1RPNlI0ZDoxNTMyNS4yMDY1MTI6MTUzMjguNTE0NzQ3Nw== [L] URL:Mal (0)
10.11.2012 09:34:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdaX0ZWCgUADVRdHQZYGQMHGl8GE1k= [L] URL:Mal (0)
10.11.2012 09:34:40 hxxp://46056.onsitemarketplace.net/result/?affiliate=46056&subid=1298603&subsid=0&terms=military%20rugged%20computer&clickid=NzI2NjFlZTIwMWRlNTI0YTMzMzU2Y2E3YmRlZWNjMmM6c1RPNlI0ZDoxNTMyNS4yMDY1MTI6MTUzMjguNTE0NzQ3Nw== [L] URL:Mal (0)
10.11.2012 09:35:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdbWkZWCgUADVRZAQdYGQMHGl8ZE1k= [L] URL:Mal (0)
10.11.2012 09:35:40 hxxp://46056.suggesttool.com/result/?affiliate=46056&subid=1296603&subsid=0&terms=nevada%20business%20insurance&clickid=NzI2NjFlZTIwMWRlNTI0YTMzMzU2Y2E3YmRlZWNjMmM6c1RPNlI0ZDoxNTMyNS4yMDY1MTI6MTUzMjguNTE0NzQ3Nw== [L] URL:Mal (0)
10.11.2012 09:36:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdbWkZWCgUADVRZAQdYGQMHGl8ZE1g= [L] URL:Mal (0)
10.11.2012 09:36:40 hxxp://46056.suggesttool.com/result/?affiliate=46056&subid=1296603&subsid=0&terms=nevada%20business%20insurance&clickid=MmNiYTM4YjM0YzBmM2FjYWI2YWNjODMxYzVjMTg1M2E6c1RPNlI0ZDoxNTMyNS4wOTE1ODk1OjE1MzI4LjUxNDc0Nzc= [L] URL:Mal (0)
10.11.2012 09:37:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdaX0ZWCgUADVRdHQZYGQMHGl8GE1g= [L] URL:Mal (0)
10.11.2012 09:37:40 hxxp://46056.onsitemarketplace.net/result/?affiliate=46056&subid=1298603&subsid=0&terms=military%20rugged%20computer&clickid=MmNiYTM4YjM0YzBmM2FjYWI2YWNjODMxYzVjMTg1M2E6c1RPNlI0ZDoxNTMyNS4wOTE1ODk1OjE1MzI4LjUxNDc0Nzc= [L] URL:Mal (0)
10.11.2012 09:38:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdYUEZWCgUADVQaXVlYGQMHGl8GE1g= [L] URL:Mal (0)
10.11.2012 09:39:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdbWkZWCgUADVRZAQdYGQMHGl8ZE1s= [L] URL:Mal (0)
10.11.2012 09:39:40 hxxp://46056.suggesttool.com/result/?affiliate=46056&subid=1296603&subsid=0&terms=nevada%20business%20insurance&clickid=ZGU5OWZmYjE3NWVkZjE5MWYxOTdiYWU3N2MxZjk4MjE6c1RPNlI0ZDoxNTMyNC45ODI3OTYyOjE1MzI4LjUxNDc0Nzc= [L] URL:Mal (0)
10.11.2012 09:40:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdYUEZWCgUADVQaXVlYGQMHGl8GE1s= [L] URL:Mal (0)
10.11.2012 09:41:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdaX0ZWCgUADVRdHQZYGQMHGl8GE1s= [L] URL:Mal (0)
10.11.2012 09:41:40 hxxp://46056.onsitemarketplace.net/result/?affiliate=46056&subid=1298603&subsid=0&terms=military%20rugged%20computer&clickid=ZGU5OWZmYjE3NWVkZjE5MWYxOTdiYWU3N2MxZjk4MjE6c1RPNlI0ZDoxNTMyNC45ODI3OTYyOjE1MzI4LjUxNDc0Nzc= [L] URL:Mal (0)
10.11.2012 09:42:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdbWkZWCgUADVRZAQdYGQMHGl8ZE1o= [L] URL:Mal (0)
10.11.2012 09:42:40 hxxp://46056.suggesttool.com/result/?affiliate=46056&subid=1296603&subsid=0&terms=nevada%20business%20insurance&clickid=NDAzN2IxNTU2NTNjNTk1NDQ0ZWNkZmI4ODYyZTVjMzc6c1RPNlI0ZDoxNTMyNC44Nzg1OTk4OjE1MzI4LjUxNDc0Nzc= [L] URL:Mal (0)
10.11.2012 09:43:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdYUEZWCgUADVQaXVlYGQMHGl8GE1o= [L] URL:Mal (0)
10.11.2012 09:44:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdaX0ZWCgUADVRdHQZYGQMHGl8GE1o= [L] URL:Mal (0)
10.11.2012 09:44:40 hxxp://46056.onsitemarketplace.net/result/?affiliate=46056&subid=1298603&subsid=0&terms=military%20rugged%20computer&clickid=NDAzN2IxNTU2NTNjNTk1NDQ0ZWNkZmI4ODYyZTVjMzc6c1RPNlI0ZDoxNTMyNC44Nzg1OTk4OjE1MzI4LjUxNDc0Nzc= [L] URL:Mal (0)
10.11.2012 09:45:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdaX0ZWCgUADVRdHQZYGQMHGl8GE10= [L] URL:Mal (0)
10.11.2012 09:45:40 hxxp://46056.onsitemarketplace.net/result/?affiliate=46056&subid=1298603&subsid=0&terms=military%20rugged%20computer&clickid=MzZkNzJiMTIwZDcxNDU4MThjMTAzYzk0MTU1MTEzY2I6c1RPNlI0ZDoxNTMyNC43ODIwNjQ5OjE1MzI4LjUxNDc0Nzc= [L] URL:Mal (0)
10.11.2012 09:46:39 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdbWkZWCgUADVRZAQdYGQMHGl8ZE10= [L] URL:Mal (0)
10.11.2012 09:46:40 hxxp://46056.suggesttool.com/result/?affiliate=46056&subid=1296603&subsid=0&terms=nevada%20business%20insurance&clickid=MzZkNzJiMTIwZDcxNDU4MThjMTAzYzk0MTU1MTEzY2I6c1RPNlI0ZDoxNTMyNC43ODIwNjQ5OjE1MzI4LjUxNDc0Nzc= [L] URL:Mal (0)
10.11.2012 09:47:40 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdYUEZWCgUADVQaXVlYGQMHGl8GE10= [L] URL:Mal (0)
10.11.2012 09:49:50 hxxp://46.19.137.19/WFBQR1hYXEdYWFxHWFpfU1haWl5GCgUACgJWHBsFVAghO1kKLQYfJRM8HCQ9OFwlAyBZJipdESQ9OB8wEFweCCEoRggtWRAkLThaJD04WiQ9PFgkAywEChNYBTg8Mz4IEy8uDQRQXzNYPwYzBVAlDQINXzM+WFkLEysmO1gnGjA8DT86LAoeM1kRLwwhOF09PiNaCy8vLThZMwYLMQUHOD0wEww9OFgzBycBOi4kHgpbDlwmISBbDCEGWgoEXD0/BVAwJj0/AzFZAV0xWzM4Oi0zBSYuLyQNLTwRJDpYJDFbM1s7LQE+C1g/LCU/UFkIAy84PAUrAD8uXVgLBS9YJz4RHCdYUBwzWjtYCxBYHSdaDloxWj9YDDEzDzAEWVkLBzMjJDEBHw08MFw/IRkAPiECWD8vBTwMLiMZJD5dEzBbMxkkWjARC1gZEyY8XBoIBSQRCgczGgoCXCwzBwpdPi0vEQwDDTgnMSNYMAUvJzATLwEwEFkdDQRcOQgDAhE/WzNZDC0NWyYhCh49WQEBJDEnPiQ+PxsMLw0bJiwNHjA9Dh0MBzBaDT0vPg0TKwUKPycsCCwNGDxaOyskPQUjMz5QLQgsIycLBA0RDQI/GQ0sOy4kWVgfOj0/Hj8/Kyo8WRkiDQQdAwo9OyMnWVAzOAUBWDgEAQU/WApbPBMNLwg+LwgLLQIdCi8nIzwCBTMmPT8jJFkNMCRZEQILBxknCz4/LT4vMzk9PgEIP1gOECc8DSo6WCMlPQI8EwouDTokLAEzPy8vGz0DL10/PAUxOAcZEww+Ixk/PAUvJTE7HQw9KyY6MTsrPC4jWggtMwg/LAEtPy0gWQw8OwQ+BRkgCC4jCDAEWR47Wi8vPgIzJyYhIwI+PQEeJj0zMzs/BhAkWCM7PFoBET1aPwU9PTgePyEjMDA8HR0IAg0kJD0nGD8uLwcLWwIQP1gvDycFUCAmLydZDARQCAgDKxgLMQEvM1gNETtbWC4zLFwePwRYMD8 [L] URL:Mal (0)
10.11.2012 09:50:50 hxxp://gfuhijqp.cm/Xl5HUFxHW1pZR15eRgpHGQEZVgFUWFxcWFtYWFhQUVxcXE8aVAwoLFADGywiHgMoPCghNi8QPD8gUVgjDwQeAS8sIh0wODw4ChEqWCcwEScaGF8IARgmPQNYPD8cHAxaJgwhRA87Py45GSc+PwULJRgdOxxZIEQbPjsbWlgMGF4iLS4jAi4iDQ8wGhsuDB0qDRNEGxsCEVAFMDorHRMmGw05XhtQDD0bPDAHAlEvMB8jGxwTLFwZLQZYWhkHHQcEAT0aMV4aJFsTHig6IgInKF0oJg0sKiQgDiA6AjkLMFs2MRgqLDwaGSwuGTo7Ex8bMTovXwo/MSICAy5ZGBleGigAJCgoOCErLC05RB0bECNEKCBfGTkAHkU= [L] URL:Mal (0)
10.11.2012 09:51:50 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdYXkZWCgUADVQMDlgZAwcdUFoTWQ== [L] URL:Mal (0)
10.11.2012 09:51:50 hxxp://108.59.13.103/check.php?p=sce6ea482617bd0792bcf2af3fa79458e5&subid=1296603&affid=269 [L] URL:Mal (0)
10.11.2012 09:52:50 hxxp://gfuhijqp.cm/UFxHW1hYR1hQWkdYXkZWCgUADVQMDlgZAwcdUFoTWA== [L] URL:Mal (0)
10.11.2012 09:52:50 hxxp://108.59.13.103/check.php?p=sc230b1bf3f4026193c9002dfdfacf46fc&subid=1296603&affid=269 [L] URL:Mal (0)
10.11.2012 09:54:59 hxxp://81.17.18.18/WFBQR1hYXEdYWFxHWFpfU1haWl5GCgUACgJWHBsFVAghO1kKLQYfJRMKWiUDAlglAyATJCpdWicQUAMlBysGCi1QBjk9LFwkAwoRJy0KESc9PBAkOjMTOT4/KzsFMxskPQVbCjEZBzwxAQAxWR0EMy5ZXT0EIz4KLSsTOAIaHjBbUDk9BysrP1o7EDAxASc+LhEkJTwZWD0sClo9LC8kMz8vETotJFg6Bzs9MRMNJjoHIzonAg0YPVkNBCRaLzMwBAYdJT4zXyYuPwQKEzBYJC8BAD0vUFgILBpZJwQzPCQFMzA7AjwdMwMNAjM9PFs6BVABCDEZGjMEBR0+Lw0ECAM8EzwEMw89LDs4JFoZMCY+Oxg9Ay9cOhMNHgwhMyM/BwVZPSwRBycvAREmMRkzJxMnAQo9KzAxEzMPPD0FAgwhARAwWyBYDT5QMSQhMyA/WzseDVs7BAshARonPh0YJwMnJgwhIwEwWCMwOz8ZWA0hMBAlMSswJj8FMzohJBA9WDNfDT8BAAsHAhE4AysZJFhRWzAFMy08LC8BCi8zPQoFAT0NPAUbJTE/JzxbXAg6Wg0/OgMzED8uJy0/BCchPCwnJz1bHQU7BCM5PwUzKzwuEQU/Lw4TDQU/LTwCPxo+LBknOgcZETsEWB49EwIQOwUBHwgEPyY8BysdPgIFOTAxARg+PlA/PgcvWToxJxoNIQEPJwIzKg0+UCcNPjs9OgJQBSc/LxA7WhkmM1oBJgoHARsLPAEsDDwNOiRZP1k8LlFaDVsjGD8sGRs6AichCgINEAsFGQcNW1lbMwUsWDgxGRgzWQEGOyEvBTwAWF8kPCMCMD5QKyctOwQ8BFxaCD4RGTwHJFgnAzBcCCE7PD08DR46WAE+PQQkWz0uATswWicfJD8NECcHIzoNPTsvDCwdPAgsPwUnPFFYOwczOD4EMy0zKlglCgUvHzoDBT08WAU7PFg7JwsxOywwPS8iOi0jITtbJxsMBCQeM1gFAzsh [L] URL:Mal (0)
10.11.2012 09:55:59 hxxp://gfuhijqp.cm/XFFZWkcEBxodG1pHCgYERlYZVFE7XBwqOwEhI18TPREYBh8cXy0HLiUxLVk/Pz0KOgUzMF0hBDAuWiBbC1scWwwTE18GOCoxAyYNCzsYByQsGw8FADMcIwwGHwItBV89OzkLPg06MDg7MExbKxo/BAhQPTgPJy4uIRk/Kz0DBSsvAVFfHBBMWy9MWysvEw85DCUCJ14PDQITD0xbLzoNGSVaEyMYEDEtORMCWTsKWR1dWA4hXBM7PDEhJhkILQQGByUjHDpQCDEhPDoeAx0iH10/OSgTCBEtDSsaPF5RM1kPMzAuHzkiLiA7B1g6JisMBF4iPDwGBCNeDjs+HgRQXVwrKloKAi4zHiEhHicbAR0hHQcBUTtYI18gI0xbLyE4LQ49HRxaASo8WF4YDz4hKAQMIlkGMRFaOCIOLzpbIBFaUCUxHSgaPw8hXhpcJR8MGz1bIxwoJDMcCCYHXjsxGT8oEwEuGSpMWysfIFghIw8cTFsvC1A7Ow88BlsFLQwIGyo5L1oGLBgLOTAlWiQ7Hw0NHVglGSoAP1E5LQ9aBQ9fCC8NJyMAAFhYBlE5WS0YJ0xbLzEIKFACURwoHiIzJAU7HT49AAQ6X1kqBghcEAcnLzgEGlwFDQ4nLiETHj4RKg0+Ci5eMExbL15MWy8qOjkmLT8IJCUvLExbKwc7HAEOChFfXTs7PQAmWSBbPCgNDyE/LSheJT4aIQE4Aig7IAsrPRwfDQgjCA8oOVovIjoxDSorIj0uWjE6PTgTAwsaPThQPVAIEAECOQAQWy8kISdfBihZJQohLBAEHS9eHkxbL18vOAJMWy8nOT8cOBkaJioKMQYPKExbLyojDwQiOCURXlwTBA0KGAEMKxpZMAEiCh0iWQtbOzFYXzkmECQMOiAeHDkDX1pMWy86TFsvPhlQJRouDz0bBjADHV8YEwtbGVA4UDguPz4NBy45Xlg/ER8cW1gxIBMsJCYMIwoOTFsvJExbL1tYOhEzHAwELQ8j [L] URL:Mal (0)
10.11.2012 09:55:59 hxxp://5803.mnstr3.com/?p=8R5uCRhHJ6zTxqovu6DnGLXD0VVTcSlZY4HmYG3I2b2u2ezz6oQCXjOdbRqnMErfliZuJeovkDl6TRPbWdSYQRY%2BsVma9TQfNGGHpVBTjlBFh86uy%2F%2BFzfPeLkN7fdkzf%2FSdpL3zJqyXDPzk0Rc0t41gH5zRUXHOpaDmonLJuS9aXHUSwjtKv4VPAzaxDdBsU78Z0fZYGvPKGIRn1SOBem7KUUomJ7gRWwm945BC3ckGZwHHwNrhtHtnh8R1J6IJ%2FHQDgTtu3hCU17qfWHAmeK0oXx3QKgFS2Ix39LXtAsVfH7s5LverT2JuAMZuaOn7RXpVAzhGpC%2BvI1HJfu%2Fb9RRfUo2lDearCPF3oEqbPYL3MRvddt1LpCiV8PDf3lf6aFdNJii11o8P0DqN%2FXaA9k8uAwKZMlRtWTimS60Coa5ynNFQms5ldgNGHzwWxCdWcG7Y%2F7%2FCSPODVaMLFE%2BnRuhgcx64RRTiO0I2UAdfHVDA7LWsHhQkARIbBTuvdaJafAP3FKSXdCBKTG3XSTQzjbsTQ9T9ayhkPiy2FMHN6oA0LcHEymtF7w%2F6FQk%2FNPVuQpsOCcXofA%2FCJfmKQLx75zmdcqheBs0YhKctK0b2RX16POyMeSIwuPj63%2FS%2FWp9LsGfTroYjt6qzb2p9Q9QGVWdnGP71Vxvu21XIzEMOeJcg%2FM%2F21SxZuemDfJNgA%2Fw52GowDP2dye98WlbYR0jT2tKjF1SnNmOxhX7jVuW0KktMd%2BswrguDPKN4m7jBiK4eOG1kQx8i5OV%2FYLEtuHj%2BYdIgihe0XSdYGu88TTTYu%2BTUIHeTAP6G8cAphYnVwVa%2BNpjuq1XW6Znr94ZCs6uP%2BQiy7yA46%2FyIGCL%2F0ryBzE%2FZOHHaw5vWB9KP8dhNdprNdVak7jVW8l6cnL3%2BoInpd3SoJn5xf78S2XkZHhMnsqb [L] URL:Mal (0)
10.11.2012 09:58:10 hxxp://81.17.26.187 [L] URL:Mal (0)
10.11.2012 09:58:15 hxxp://82200.blinksearchesite.com/fly?q=corporate+training+videos&enk=JqFGiWaBj6GPiY/BRpEGgY+JZqlGqWa5B7mG4ybjhg== [L] URL:Mal (0)
10.11.2012 09:59:10 hxxp://gfuhijqp.cm/XEdYXVBHW11RR1hYXUYKRxkBGVYBVFhcXFhbW11QUVtaUF1PGlQMKCxQEwIsJQ4DKDAOJi42XRgFJSQlDxlaJVwoDhoOAA5dAwYsJ1oERAQYOhsHIAQvDx8RWQgxEwxaAQxbNg9aOjsRXjg/BlFYPxgPOSEwLQ0aPQpbHQMxOTxcJwULJywKIy8gIz8kBVg4DiENIVhEHAtePDEZDD4QCjAcOR9eAR0aDVkcJCtRDxABB11ZWgUwJTElUSVaClshPzsEAjlcWwhbJTkhKDgsLSIIKyIwPCg6KgozPDoYWSYGMTZdLissAgYZKxEEJDsxWzkDJl8AWx8FBxlcWitfJx4sIw49AzkoMS8sWQMtD1kfRB4BDD4lPV0m [L] URL:Mal (0)
*
* avast! Echtzeit-Schutz-Bericht
* Diese Berichtdatei wurde automatisch erstellt
*
* Start: Samstag, 10. November 2012 15:50:33
*
10.11.2012 15:53:38 hxxp://gfuhijqp.cm/XFFZWkcEBxodG1pHCgYERlYZVFE7XBwqOwEhI18TPREYBh8cXy0HLiUxLVk/Pz0KOgUzMF0hBDAuWiBbC1scWwwTE18GOCoxAyYNCzsYByQsGw8FADMcIwwGHwItBV89OzkLPg06MDg7MExbKxo/BAhQPTgPJy4uIRk/Kz0DBSsvAVFfHBBMWy9MWysvEw85DCUCJ14PDQITD0xbLzoNGSVaEyMYEDEtORMCWTsKWR1dWA4hXBM7PDEhJlkeICQ9Gj8KCl8nHCM5UC4vMwBdPFggGTk/LyYsDzAHIx8MID0rXjA+KloMPRE6PztaWQA4HgITKwA6Hhk6GDsDD1EPDlswJgswJx5dOhAxTFsvOQgfKwAhXR5dPhE4UAgZH1k5IzMMPyBcOQxcHyMQHDsATFsvCAg7Wy8bWjsdIgsqBCotPCoxACxbLAdfWTwOHkxbLzoKKw0mOwhbJwQqPydfPj4oMB0sJCwTBjslUSEfGwofAABdCFosGixMWy9QIlg5XFEQWlxeWiY/AwonGyMiLwoxMAsCLwYxECAMXiUzEx8vLhFQPT8FLS8AHyFaJR8wOQhbBSI6WwAgUQ8APwRRHjwbETk8X1oiUA8zCisFIygeOhsfTFsvBz5YGDlQHScICllZBz1cASUZL1AFJggOCD08AgsEER9ZXhsPCyolMREZEyhbD1gLJzERORwjWAQxEQMzHA8fDRMjL1AnCgtMWy8KPA0CLSo4HjsdLhEfHSwtChk/ICtMWysoDgpMWy8xKh8PWSE+ITACIlwFLAsrBD8BOzgLLQdRHToOAC4bK1gMJQQLJRgjJwYFWQElGQIMJx5bXQYQBSRaKh0bAl9QEC06KF4nPTFaUQA+TFsvDUxbLwNcLSJfO1FYK1oAXUxbKwwLHyUcTFsrWQ8aDBxbLCo+GSwcOgM8WDpZDBkEGzxYGwxeASssDwcRIxoYDV8kEwEEWSciIA4FXVsiHTkAA0xbKxkqXkxbKwwPEQwuWR06 [L] URL:Mal (0)
10.11.2012 15:53:38 hxxp://5803.mnstr3.com/?p=8R5uCRhHJ6zTxqovu6DnGLXD0VVTcSlZY4HmYG3I2b2u2ezz6oQCXjOdbRqnMErfliZuJeovkDl6TRPbWdSYQRY%2BsVma9TQfNGGHpVBTjlBFh86uy%2F%2BFzfPeLkN7fdkzf%2FSdpL3zJqyXDPzk0Rc0t41gH5zRUXHO0wIMTsVcc6NuJP9GFZi4U1IpPVFOEfYnJveITB7YWC3eTxSVR30iQwkzBiSwpSqRjf8fg2YObYNw4SyX%2FPavBiH4w4WxQ9apv0PJZeVI5Pe5vJyuRi%2FaaR2Fr3RtKbCmCDUCXiE2En60Ugw%2FScBdORa2NmCVN6WWAYtEMEzoRL8Hvrcvii4a3EsE%2F9K1P58y3573OVjcNrJKFcXYbkFoXyIe7LZzvFGx9TVlDFivH3LvYPa2lKS2iI8fiVm8wUrxPU63K9fZcBlJAwSrv%2FnW1qP9tNac00nT5hLpF9lOagaTUkbmxv07rfbCLXxpzA2f1bNXxPuJ1mXxjZufvdzJF9Ncb%2FcUdkDCQwRtGxvtEDcpVIB%2BAgc%2FXCvf0HWHYkK5lEbBmVhRQbDn8tSgiGrB1eLmbLqJNol0hLpkeNw24oylM3Ctrk69yDSA7NTX38iW%2Fd%2Fj5DK6R81B3i4%2BebvLu%2B0fseu2ECWpEuSjU1S0epmrU1re7hBEfnxJsqd6Mzhm0NKIgl42KtPij%2BpC7%2BefxeG0tSQz0UtplweBcQeq6WGbDYr2zlybONIgihe0XSdYGu88TTTYu%2BTUIHeTAP6G8cAphYnVwVa%2BFqsEm6jL0rEXxajkPYpqIQ9lMZ3gc4QNMoDomNZOtbvH4I3OPuLE6rzcL9tmEBwXNbhoNyb%2FBDA8Nb9DJFnn7v4KpdB4NOruZhNlhq4vZa%2Fi4haopnsepmpSP3Z12%2Bmlrhn5%2FXgU9yR3xZYAQfv%2FFs6RUaLNRf6h1vyf73YrBH5rKJgwRy0 [L] URL:Mal (0)
10.11.2012 15:54:37 hxxp://81.17.18.18/WFBQR1hYXEdYWFxHWFpfU1haWl5GCgUACgJWHBsFVAghO1kKLQYfJVsnGgg+JxszWywcMFtQHSVbJBwKLgEeOVsCUDwtL1w9LFEQJy8nXwouLF0kWis7Olo7Bw0+WCwIPhEwMFs7IjotDSE9OjwQOwIjWjA8Mz09Eys6CD8vGj9aJz0LPSsxMARQBDM/ATE8WBk8CFsFWydZMxgzWi9aCD5YLz0EPFwkPw1ZCgRcGCcCAT08Li9fP1grLiM9Iyo+AhkkCD5cGgwCWDkLLyBcJywGWzsTL1o+PhkxMzEnJggTIzk6BRkuOBM/PScsJwE6PlwYCwUFAws9ARskWyMeJCxQHiM9IyowPFgbMwMNHTsvGVwzBAIFJAIzAAs8ATA4WywePFsvXTwhPzEnPzMwJjEnXDpbOB4NIQUEPi8BIwsCHhE/PzsZIz0jLgsTBQInLjgQClkjOj8EAgUkAiMrPD4/PT1YPyQ+Pz8dMy4FWTshBTgKPxkZMDw7LSYxJwU/Wy8/PC0kXTM+Hl0KMT9cOyEFECM9IyokWxkfCi4/CD8tLyA8PA5aClsvAwsQPBA4BScuJDxcXDgDMBMzWCscPC07WCRZPzsKBCctPgMsXDwEGSU8Ly8zMz0CEww+XCQKBBFfPgJcPDoEWBg4WCdYDT0zCA1bUCoLAz8hMFoFJgoELyo+IQ0GMDo8EDgEXBM/PBkxCCwjEQoEIwYmPgUADQcvHTw8CgUkAiBZCgc7Hj48DVg8PT8QDTwvITAFDSQzPD8aCwRcWQoFBV8IBysaDVtcWj4FGSE+PTMrMz4zJggtJz8nLlAIDQc7MDpZLywkLSNZJj0rKwsEMx8+IS8zJFtQEThYJFgKLllaOxMjJjMDP1knWzszPwINWw0xDTwMPlA7Oi8rWidaCgUkAiNaClsFAwhbWB4wPCNbJAMrEz8hATo6BzstPyxcMT49O1wIWAoFJAIjPDsxASMLLh0hCwUnOSY8BhE4PiMqOzwzIDo8 [L] URL:Mal (0)
*
* avast! Echtzeit-Schutz-Bericht
* Diese Berichtdatei wurde automatisch erstellt
*
* Start: Sonntag, 11. November 2012 07:21:45
*
11.11.2012 07:24:51 hxxp://wmdvhhffix.cm/X11HW1xYR1tcR1haXkYKBQAKAkcZARlWClRfWw8NUVgMXFpcWFlcX19aD1wIDVFRDF1aDAhfUQxQXw1bX1kLXV5RWQ8LX1BbX11ZXAhYUVFZX1BfXF5aXAsPCwgKXV5RCgpfD1tdWl8PC1wKWV8PDQpdUF5cDF5aUVpbC1AKUQhRWA9RWQoNUVBYW1ANCllYUA0MWw8KXFpbWA0LDVFfXF5YD11dUAwIXF8NDFpfCwwNW1xRUApZDQtc [L] URL:Mal (0)
11.11.2012 07:26:00 hxxp://31.184.245.201 [L] URL:Mal (0)
11.11.2012 07:27:00 hxxp://31.184.245.201 [L] URL:Mal (0)
11.11.2012 07:28:00 hxxp://wmdvhhffix.cm/UFxHW1hYR1hQWkdbWkZWCgUADVQKGRlYGQMYGQUEE1k= [L] URL:Mal (0)
11.11.2012 07:28:00 hxxp://199.115.116.230/check.php?p=scb28ff57bf7d620be168bda982cfcbcf4&subid=1297603&affid=269 [L] URL:Mal (0)
11.11.2012 07:29:00 hxxp://31.184.245.201 [L] URL:Mal (0)
11.11.2012 07:30:00 hxxp://31.184.245.201 [L] URL:Mal (0)
11.11.2012 07:32:08 hxxp://wmdvhhffix.cm/X11HW1xYR1tcR1haXkYKBQAKAkcZARlWClRfWw8NUVgMXFpcWFlcX19aD1wIDVFRDF1aDAhfUQxQX10PUVpeDVBdCFhQDVALXAgIDQhYUQgIUApRDwtaXlkMWVsIWlkIWF5dUQhQW1tcXVpRCllfXwtdCAhdD1ELXFBdD1BdXwwMDQpdWg1QD1tbC1FaDVBeXAxeDFhRCFFbW1gNXl8KUFleW1taWAxbCF1fDA9cDV9aC1FcUQoLCwpe [L] URL:Mal (0)
11.11.2012 07:33:08 hxxp://wmdvhhffix.cm/X11HW1xYR1tcR1haXkYKBQAKAkcZARlWClRfWw8NUVgMXFpcWFlcX19aD1wIDVFRDF1aDAhfUQxQXw1aD1sKWlhdD1EIUAhYXF5cCFpbCl5bXFxfDF4LXgtYUVhQWg9QXFldCw9cUV9QXFAPD1gNDV1ZCF8NCFlQXl1ZDQ8IXAtfCw9aDFwMXV4PDV8NXltYC1wPXVxQC1xaWgoMUFhbClwPD1BRUF4KCFkIDQ1fXlsLUVkIDAhcUFla [L] URL:Mal (0)
11.11.2012 07:34:08 hxxp://wmdvhhffix.cm/XFFZWkcEBxodG1pHCgYERlYZVFE7XBwqOwEhI18TPREYBh8cXy0HLiUxLVk/Pz0KOgUzMF0hBDAuWiBbC1scWwwTE18GOCoxAyYNCzsYByQsGw8FADMcIwwGHwItBV89OzkLPg06MDg7MExbKxo/BAhQPTgPJy4uIRk/Kz0DBSsvAVFfHBBMWy9MWysvEw85DCUCJ14PDQITD0xbLzoNGSVaEyMYEDEtORMCWTsKWR1dWA4hXBM7PDEhJiwiWFwTKFogTFsrHhscHCwoHB1aCFkcHFojICBYXS8bPkxbKwhZMz4aWj8jGiQBTFsvG1kLLiJfGiobODMHKAoPKFscLlkMWwwhESE8BwYOB1ENKCYrJlteDCwjPTEcGVAwCiozXRs6AQ8hDSgYKD8jPFAIPRE7BgMDDAc5ECUYDRkwDiYZUApcKg1dByU6HxEbISUDJ14zLSUqHRFMWysbBVEDMzsxEAgZPz8mW1gCIVgwOlEAHjBQWwgrMCIgWjFRBzslDlxaLhNMWytfTFsrWi4hGx4vIjoQPSwHHFEHXUxbL1glLx0eESJZAExbLygrIQBaXAwIL1AZEypQBCwOLw0uXy4HDSQDIgtMWytdPSA6BxkYXTAmKB8aBBA4UCAPXjs/BVwTXAoZKAUjLV4QAC4FBSMfPV4rIV0EGx4CPScbOwIqByIATFsrEQcHOR4QAwcfPDgwHC0oGwxRM18wXR5fOAg+Kg4dJAYNLjEcExAGJgULOz8bBV88WiYOGExbLwEMMQ0kMA8ZA1o7GCgNPzpaCh5MWytRJVs/ID0CIj0AHgQRIzxMWy8/WjAqPBEFLw0THQUAMS5MWy8sDx45WzMqXhEoOz0vTFsrJgxbPBlcUCU8Pl4QBD5MWyszKC4BO1FMWy9MWy8TGCsaBTEiWkxbKwxeWhgvXiMrByYzGThcHiomKDwuMyoqXRtbDDBQJCcYJiYTHFEQIwMlBQ4CMy8tASoqWyhaAx49OFohCwYeLw [L] URL:Mal (0)
11.11.2012 07:34:09 hxxp://5803.mnstr3.com/?p=8R5uCRhHJ6zTxqovu6DnGLXD0VVTcSlZY4HmYG3I2b2u2ezz6oQCXjOdbRqnMErfliZuJeovkDl6TRPbWdSYQRY%2BsVma9TQfNGGHpVBTjlBFh86uy%2F%2BFzfPeLkN7fdkzf%2FSdpL3zJqyXDPzk0Rc0t41gH5zRUXHOEK15zA3I%2BwruuEAut3a0uu3JII14FrW%2Ba0ZWs3VJsMh%2Fr0bGK6sCrQZnAcfA2uG0e2eHxHUnogn8dAOBO27eEJTXup9YcCZ4rShfHdAqAVJU9aTxRojjenPyLqdpYgOp9c5Cd4nLSvxrHLjN7ZDLCtx%2Brl8jZRXyapVVO21kH1YS8iwY92aBYKI3X8nRLg53Gz%2B6%2B3GHrwFKSyTEnu8n4%2F1LFtwxK0i%2FABHi35eaF9pzC9mEgFdG6GndMjKb%2B4TISnpq4YOAvsmyQ9If7RVl5z5cpAlJD7yiGllJvT7BH4mrwkTNrRkCnKi%2BxnnPwyjnvUQYuDAre8Z6Y4w6QaWCgtModGXuzyoOlbRVrl6U3Ogq%2FheXdMYfpj3RqAdVS3cw%2B8L2VITkKTiwmxJU%2FV3YCUxlFdztliXG%2FEfwP2ZC7xARTF%2BOe2Up59LUW7ymW%2BZAGhR8%2F%2FzqBslXK3%2Be73qF7JBnOZpQ5wCOAUGZCC4r2eY9MNqOOzu8yJjLlgkZFDhCC2A3jwTQ3HbowFiarwYsjrimexFP%2FJgQoan2NCTB8Djhx%2BFwWs6je2gHWRDQVTI%2FuKZ7EU%2F8mBDncuJFkXpFIZKc4rx0rapq2PT5a8hsPBc0SQcGsN%2F6%2FLFzehnIQYa97tskHzSdVGoXxajkPYpqIQ9lMZ3gc4QNMoDomNZOtbvH4I3OPuLE6rzcL9tmEBwXNbhoNyb%2FBDA8Nb9DJFnn7vpGxSVj1jnaVEt9AljqdniME8lxMb2%2FJiVTlLvYuVxlAnuuljo [L] URL:Mal (0)
11.11.2012 07:35:08 hxxp://46.19.137.19 [L] URL:Mal (0)
11.11.2012 07:36:08 hxxp://46.19.137.19 [L] URL:Mal (0)
11.11.2012 07:37:08 hxxp://wmdvhhffix.cm/UFxHW1hYR1hQWkdYX0ZWCgUADVQZWFlYGQMYGF1ZE1k= [L] URL:Mal (0)
11.11.2012 07:38:08 hxxp://46.19.137.19 [L] URL:Mal (0)
11.11.2012 07:40:17 /GgwIGwoBBwYeGA1HCgYERgoFAAoCW0cZARlWClQQGC4vGVkdOlEvMyRZPFEiWQBRIwMeAzEqITsHPyRYWjwOOgNaWDkMAVo8WQM/HRs7TFsrPyorCBM4CypcAFA7Aw9cIQctJxEEKjAvEwRMWysjWQQeAioDLh8rDF86AAofMDNaLBMfWgcFTFsrXQQ/ICINERgxORADXDteLDswHxA6EQMtBR8xPzwzUQwBCysQOlgKMyIcLjARBT8nXBwKDlA4IBkYTFsrIR1bEwIGEwUkE0xbLw4HWC8gJQdYBCo/KF8rIQNMWysGKwUlHCAEJysLX1sfIhA5J14IUDgCMSAYLgg+Ly8TEy1eTFsrGApZKExbLw05KgBQMB4nBy8CPgEYKAUGXxAgCyFRXSYqHV0NKAoLXwY8PQYiDSU8IwwoCiYQAlsdOw86Xj44LScoJV0rXwU8IxgKAQ0gJAAjOFldERwbEwgxEDwmBl5cJQ9dCiYtMwAGPTobJAsCBScZUR4FHQ4EPBEEL1grUBEnKjwnBzMvEy0gXCANWh4bPAMLPz4aPg8PDAAcIR1eMxAqXF4BGlgoGCwwBhokWDwRB1kvLz8mP0xbKwRfOTwGAx1YKywZDDACMQMoGC5dMBEcPx0iJFgDHlpRKhgIIFk6OC49CwAiIS4YAiFRAyEBIAQAPVAFOywBWxoAOhENLlpYH1seP1o/WQQmBT9aXyMHGyAIPlg8ISNaKCQoEyICOC9QKx8wCi4rPQEmL0xbKyVfBig7BhEiIRldAwomIipMWysdXB06AD8RAFskACcqJRAQOTkfBgw4IjNePCQdATw5WUxbLwBfTFsvACUbPVkKTFsrD1g6DQ4nE14qWRpaLgIdWDAFUD8nP1wqWB4IPDg+KAolOT0zHxs5XigMMwMeBQokOC4xXzomHRBeC1gaGgdcDzwqDR5dMRo6Hio7WCQkLQIcKA1ZJjo9DCRRXAgKWFw/JC8GBzxQUFA/Oz8lKARaASMvAgQvDzBdLy8mORsrHl [L] URL:Mal (0)
11.11.2012 07:40:17 hxxp://searchnowqd.com/click2.php?c=yqGFp0tS8FZM0U8K0i8JjwjXCHRnVM13UgSj31Peh3U0jVtrR%2BVCBazQbC5i9Rjf5HnDNxmCYFzm%2BJ0mwkCjGvBe6SicvYZ3Ezv3nl%2B4mVIKdxqXPyj5R7ERYvySxjDlvXVUZ8ehbByS1cZKuGYxlVN5ucg9QIpq%2BHt2zkozlMz%2Fgn1FILn1mCVA6BHj%2BoBlLuImNBb62vKyPN7a9QkXIqGaWFFzzD7%2Bqc0A%2FdPCi9YwNnFkWhqAlo6yIbH84OCt4dAcb6oUToKdLUJeAcOyk2tRfS7WQDNAL4B6lUJqchdIMiJQ04xurzaXyUOo75Lf4cODZioTSrMbklNp8wltgmUxmF1B9xNCUNnZFzDI5Id3wrUjbVWsWffeiuHt7ZyC57hs1AqEYosM1Uxn0FFVOV%2Bm6PUojt1BEpeYkXjAqG4YxuVtKM1jw38CqaI0SQGTbiKHGqkH8jHhImiT9lREh2siSxdG31v2wV3V0mOlV36JnrIaW1UHJ3AMAzKkQF9BvYcGBThOF%2BL6oARoxKHp4jcOKC%2Bt5tSiVxi2MiNCLyyPPvoeQKZ7UMthUP0%2Fi6%2FiLrT0c%2Bf1SdgNz7C0s3Gkt1Yl9VNV5C1waUQWAcLPTZvrP7AeZjwlcMQGX6SOty7b1ssn5fUCdw4XsSwCR1MMDkuAd0OSTeM85ac15VMFonU999VRVLAm3hJFkmFfY4FFOPrBw8GC0ML76dhBx9lGw7%2BOAHQJa8pzy598WsN8ZClzDA5gdnnAYdv5AlMNAMCeoJNBnF5RVlbNAjIln6WyrtJTbUhcgNPxm8r0DOu%2F5vcJZhEfizt8bJNM%2FAWLSckAD64RP0JfvfBhwBNJEnAWTCeWaIK6sEgtAgmntSVG2kCUbg3iJbt1owR%2BL1%2Fm0CD56ZL%2B%2FSUOU8K6mB7yCY%2FUnLeoKAx%2Buyrwzr1jfYqvfU0E% [L] URL:Mal (0)
11.11.2012 07:42:26 hxxp://wmdvhhffix.cm/GgwIGwoBBwYeGAhHCgYERgoFAAoCW0cZARlWClQrTFsrC19eWwolASxfDl4rCAwzXFsZC14RDSwQUVsjLScCXFAuIT4uPFwzPT8eXSYRTFsrEwIvDxA6Dwc9L1gwWAxQLF4NWAoATFsvCgQKMCdYLwo6LQIuHV0kDg0cWD4IAl0IOhAdIgUcJjM8GCwdPVwrDzo9AgYZJ0xbLx8NXQ4xAQhQGh0tGRFbXDpMWysRWiNcEF5cLFkxHB84MRpREFwtEFARA1lZXxEBWV07ADstXANMWytQKCQnBxEIJBEsH1sYJBkmHygrJAwsLQIsAlkYPh4uUBoEBD0kXF8vWS0kGSNMWy8dXCErEDEGP14lWw8GOSZZEV4mM14GCBooABgPLCdYDFEmAAI4BQRQMzwnKis6MCEiHT8jEUxbKww4Lw5dGCYsMyEkTFsrCF1fIhALURsNGDwYAx0eHScvIRwKHiQoHQwiK1EnCxg+ADsPDB8dCiI7Dz86BzooKBs8PAIKLz8qCy0dBgoEBhorJTg8GBg6XzAIPSgZHFE7WCMjXjA6IAE/MAFMWyslWycTUCwLLSsTEDhZAA4GOCo+MF0dBh4oBFomIRsRP1E7Gw5bWAwzHAY/LxAxMyoPTFsvMCE8WRADPg0TMz8/BS8OAyMiIwMwLkxbLzxRIAcTKh4LW1E/AwoNPV8+MBk8Iw4IPVEcLggQAwYnABsKCCIOPQs+Xz09PVovCBMzBkxbKxMeJl8nGlwmMAUaAyIGJAcIM0xbLwBbOgozHSZfADlRJhgFAkxbL0xbKwEGHx8YHQ4wKzoMEyguHQ5dJSAPGB4ZPDwtLhsbGExbK1s9AxMEPDleBgMdPwAKESxZWhkxJjtMWy8gLiBbGxMYUQEOECsPEF8YOC1MWy8dWwM+XiYHWQFcDxhYACwcOjhZBT8OIlheGRBRXTkaXw0QHC4NLhlfJS4EWS4xDwBdJVFdDCBRDF4+BwQZLV4aEyMIPwciMRkfIz [L] URL:Mal (0)
11.11.2012 07:42:26 hxxp://searchnowqa.com/click2.php?c=B%2Bb672cLhE6g7BaeZ52pb7xdEy82JDNk59GHWGU5ZTVw4Ox%2BzkFfySfnTF1Y1e9E7d1ci%2FcmcYN1FcSDkGt4Mgdu1Wak4aSytKluOZUqEtT5BfSTkopN%2Fvd4gXha9stDpx25S%2Bx3J5y75E0XuvQXs8y5Dy9xj006xh04RiRD5j%2B9AMNnxaMxEv2qMpOvABMeEDkEk0qWwG9smmTM56F0DMpJ%2Ft5HByXoV7L2foPO0x7OZ7oasAiqfEN1e8OikQlm9ZUNCBSYHKtVJx%2BeQFg4qOEZHM%2Ba46Kyb8rdqUqjtwtNFHucwMAteKB8NbqWiRfevtcKRfVSnSAArUUkcFVCbDtocmosBLQUqqS6YaTApu8R1JJ7YSIhVYh%2BL2Nz9EbDBzyQ0igoQCWY4towAm3OHrxV8Rrg21eZuoVFyXZCf%2FYHU0yjWdzZVVlFgjJKJjYG%2FU8InzCwb28VjcdT6WYpUJgaT8uGayjoNircaKgTbW6TTT3FazZo%2BzwO6Ns5OYlsjKoMnaZ%2Fi2ScZtO6iP8Oqlk%2F%2BhovvqtgYBSezAGtg4LIfqwpUUDGrrq%2B2TjzmUP7ojtVicxE03pXOR%2FIGI2rzq8hgyBfy6qQD%2Ft2jW7On0h5fq1iEuSQ0lVgK17py84Ps6dyuGdGp6LGm0GXfi4L84eI8e7WnmpD7szJaVnKXpvJSpBu6yD46F9U8UiM7Kzhp136Rl2n3sF8TG%2BDxe%2FtbUxTRuw%2B5HEm7n2FhXuOZB9wQ3H35a5kyNMLit2tdu%2BXJFqf%2FJUhPAKA95oIepEcwWt3PHn59Tsd890J20i8jKT7X7C6JIeUrXw4QEjy%2FKgNSvZYEiePnhSfk5D2DH9ATiFj%2F4KbMvFvGM1L5O3DxoJgsqZ2kOwszcGkxlfLYHU9zL2D7yQnNJ4W4zToSp%2BZniHv9GqZ24Savbdj1 [L] URL:Mal (0)
11.11.2012 07:43:26 hxxp://wmdvhhffix.cm/UFxHW1hYR1hQWkdaWEZWCgUADVRdCAVYGQMYGAYBE1k= [L] URL:Mal (0)
11.11.2012 07:43:26 hxxp://199.115.116.231/check.php?p=sca703157c7d77fa82d46c93de4a2f573e&subid=1298603&affid=269 [L] URL:Mal (0)
11.11.2012 07:44:26 hxxp://wmdvhhffix.cm/UFxHW1hYR1hQWkdaWEZWCgUADVRdCAVYGQMYGAYBE1s= [L] URL:Mal (0)
11.11.2012 07:44:26 hxxp://199.115.116.231/check.php?p=sc4529a609d97fd01ff47e130acd796783&subid=1298603&affid=269 [L] URL:Mal (0)
11.11.2012 07:45:26 hxxp://wmdvhhffix.cm/UFxHW1hYR1hQWkdaWEZWCgUADVRdCAVYGQMYGAYBE1g= [L] URL:Mal (0)
11.11.2012 07:45:26 hxxp://199.115.116.231/check.php?p=scb1201de5b431737e9165eba92dfd59c0&subid=1298603&affid=269 [L] URL:Mal (0)
11.11.2012 07:46:26 hxxp://wmdvhhffix.cm/UFxHW1hYR1hQWkdaWEZWCgUADVRdCAVYGQMYGAYBE1o= [L] URL:Mal (0)
11.11.2012 07:46:26 hxxp://199.115.116.231/check.php?p=sc9caed729d502a4196520030deeb665bf&subid=1298603&affid=269 [L] URL:Mal (0)
11.11.2012 07:47:26 hxxp://wmdvhhffix.cm/UFxHW1hYR1hQWkdYX0ZWCgUADVQBB1tYGQMYGAYAE1k= [L] URL:Mal (0)
11.11.2012 07:49:34 hxxp://31.184.245.120/GgwIGwoBBwYeGAhHCgYERgoFAAoCW0cZARlWClQxAw4NJ1FeXV0GCxEhCDEOOyJRIg8LEVoRAi8CADsiWSAZOgo7UQJMWysDHgEhJyUGHwQsLjETUAcHGSIMOS88AxouABwTHSEGIlEYGS8TLkxbKzlfKioeCygCXCBZDiYwGiUzGExbLxMnLiQdUT4oAFonMwUOABE9WA4iUBEhGT9MWy8wX1s4HQsAJSMlKi8KAQghATMYGwsYITwOJiQcAh1ZJh5cWC9MWysNO19fTFsrPxwGUS0xMQgaMB1RJDA5DF1ROiIaWCMxIzMsLysbDyQ5Az86HiY+PxsgBQ4NET8uUSYzMy4dWgtcDAo4JgswAAABIx0vGx45Ey4uBxAkIgE+J1kcIExbK1xMWy8CGjskDScKTFsrAC0MGhMGIgUQHRNYHjkGACAoLlBYUREDOExbKwMIOFwgGQMuXCAGEV1QM1gnAgo5H1sNWTgbLS0DKh8TTFsrXR4TXBsmW148TFsrPl4tJV4jH18+ECdaMBlbACEAOTATPyEBEx8oED8vBxxdD14/GzAAAx8gTFsvMw1YCBMnCAEzXicaCxwLHyU5HCcRJgEhMx8MPSscKysAXiUgEBonJj8CDhkNJloeG18aKDs/HFEzGRAxBB8iEExbLyMjXQwvGBxbBAwTHDtaXBwtHAc8TFsrAxEBPR8rHyRcJyULKgJYKj9ZJA8eBR0xAgoxI1pZXBg8JwUBCiYmHiMBWVw9ECAzBxs4DDgPGxMaBjE8AhtdBxAnUAouWVgDTFsvPjMHETkuM0xbL0xbK10PUQFQTFsrBzEsGDAEJhA+GRg9UFwvM1sgUVxYUBBYM1AnDghbAFgdBAIFKCEhOA04EVksLgMOCjMlD1wrHStYDBMQKg4zGyAZWCc8UAEAPRpdBSowLCEMGDwiDDMCCgYrJy4hKjg6DxpeAR8QPV8OETwtTFsrDD8xIwURJCQIIiMHIiJYLUxbKyIYDgNeD [L] URL:Mal (0)
11.11.2012 07:49:35 hxxp://searchnowqa.com/click2.php?c=XjgdN8744obxHaXgRK8Kfbx3xkFkiRK0IpScR8k%2BjwhHNLovmEGXz9nnpKePFUjsGiuztHoK8qpFzG%2BP6CCwbAk5I0gOYsLZq%2FzNGMt8WAi3NZlgixT1gK9xHpV%2FY62QtbiLJLCFchaHhZqrbqHUgOMukt0Ow51F%2BdR66%2BVuo8DXXasYt8MYPe48SKs1JXJZEFBrfMPjVSwOWVrIlgdxVG8OZZGt3b5ecQObYiihJtFrwPzGGnyMKhWN0uI%2B5%2FksRMdNc%2BiDeszoKlytz1wPoiIAG918xjQ%2BjaQ5IpjG5Iox49Z1NkcPv2d0QrDDjCvz%2B4wz5rO27U%2BW7DL7Jv6WyN3Yp2iHiPYzVHhzvAyVFnu4f7VrYijvI%2FZd1azNahZ7NsbubvLPuNxOhHZveTBuBBi7LIysNOVkgpdO3wr6sARVu8ZpyXmvKy%2FJJ4eFqu2mezuR35uDunU%2BjxhTvBvM5NLbCk1CV0MfwltXkcXJ305qUNlhcOOwJh05TyIZnrQeQfrzsoXUkr4nyN9cG01j%2FWZnxPGZ%2F%2B4f8h9%2BnXEqYmOyWpqT95FZ2I8519y1Z9Nga2i1tmklAHHQdQx0EGjgcZLf5BtB1ezyCgZrIp1NU9hiTs4lCYEHeqUKeZkcoBNGHCQSfs7hvyT6gxUD%2BeVXJlxMMaKJnKK1D%2BKqgj7gwFBH4%2BoXZHwwHMvST2a%2FdUjC2L%2BuOd%2BeVydvCYqfi%2B7zAsopCeg%2FsiTg%2F1slX1CpmDB9R5cfaJ8gXrWsZjveAs2OzgFpU41exgiIsaSq%2FoY%2FNiMFOCJq%2FbeZ0ZoUAhpW%2F56nxJpmKPXhwYo09RpVbgZxkeRscqoA0heRMQffo%2BtfK7vmCIDS5kbAUW9XzwiWOfzvqo3%2BOEUcnBWl3C5Iy5JLdC1OEtcM2Rk2vh%2BsTOaco [L] URL:Mal (0)
11.11.2012 07:51:43 hxxp://wmdvhhffix.cm/XFFZWkcEBxodG1pHCgYERlYZVFE7XBwqOwEhI18TPREYBh8cXy0HLiUxLVk/Pz0KOgUzMF0hBDAuWiBbC1scWwwTE18GOCoxAiwsKwpeW1E7JA9fTFsvDC44GyYbA0xbLwcxO1wKJS8+EwxcETBMWysaPwQIUD04DycuLiEZPys9AwUrLwFRXxwQTFsvTFsrLxMPOQwlAideDw0CEw9MWy86DRklWhMjGBALHwUdLSwhCAEzIhMFKjAALTk9HCgKJgIPKiEtHg5cAF0fGT5YXgg6HwhZGzAHAwsZGC1QPyguXCQAWlofTFsrTFsrMywoTFsrGi0/TFsrXiYKDExbKw4nBCIRGjsaIQZdCxtMWy8/LC5MWyslEyQvPCQLDAonG1wDJwMsGD4YCxtYGzgHX1ERXFtYL1ADCh4OPj8EXwYCXgEqHVsIK1olXygOCBkuAzhYDi8OID1RXT0oXRxeXExbKw0lMBgHDyVZBVoADSUdTFsvGjlQExAmUBtMWysmGzFMWy8CLDkaDBk4Piw6OiQqKy0ELlonACU+KCweHR0jUF8QLQggGiwBH14vLA9YLAsrOyUNHzwzLzoIBQQOP10tXl4PMFwbGiFMWy8kGls/W10DCF8QLiAcEAAIDh1eOQAGMB5bClAPA0xbLwcaTFsvOi9MWys9PDoADTNMWy9ZMy9MWys4WA85H1tQXRhZUC84IlshHisRO1kQGjA7IRBQGFpeJTkDHl4PIQ8MEwA/OQVYLQFeLSVfCxEBGxs7XDkEGz8mIAoEGzADLExbKw9YJS0aLzw/CxBQLj4bXDwLPxlRIAwFGCc8LwY5TFsrXS0zEA8uOwNYExMeTFsvGy1ePjsEUA0jADEIOC5MWysBXFEZXw8OIQUhDDMPIChcHTBMWysuWBAgKwgNLAYlWUxbKyUkAVwqPhMdO1E9Mz4nLTwrWg4vIkxbLzhRKAgeDxwlEB4OAR8jAwsDWxozLiQDDDANPDM+CBAbOR0MXi [L] URL:Mal (0)
11.11.2012 07:51:43 hxxp://5803.mnstr3.com/?p=8R5uCRhHJ6zTxqovu6DnGLXD0VVTcSlZY4HmYG3I2b2u2ezz6oQCXkEEBc728RMf6%2FeGQrOrj%2FnXR5cLFWze5xY%2BsVma9TQfNGGHpVBTjlBFh86uy%2F%2BFzfPeLkN7fdkzf%2FSdpL3zJqybvltDEHahZKzlCYiDPTuAcOkfCHDwg5i4vpW17aSva0rYnjbpqD9VAG5Mi33v%2B%2BZEA%2BsDV%2B7Oce%2BgNmKxsRsHo4br%2FVEG%2BLzMFUMbecNr5jNjEqWqbr1rQn68x521F9jcwgWVm6ok7hCt2aB3L6AgapGjQ1gFgIT84TA4u75%2BdLYqnfL0l3idLt%2FsP9zyO9r%2BOrX%2FkEPsepQWESSMCBDmG3NiLWAEwttJ96yDaIsEhv7FEf1EbBRLdvUZFSalmgV4D77fY5rsH%2FMs2V24ja6yGIuyiagt7PioYw2c9fj%2Fns%2FSF%2BTUSidZ%2F0ZF%2BQ1fPv294q09FQK2HwBxR0ysYRHy9q37LPjw7fHfeziVPl1Dh7DL6bxhrrR5PmrVOIcmrYjE%2Bf1LDsFUVby9GWr5UbVp8IelqNUFoP%2B4DZyfGRj1zzw%2FrD7WRm9dJiXaQG%2Bh58p6fgHlHeZfIA5tY%2BG1yIBadEoL0%2BLMh5CWztR8TZWNDUB3gFK%2FQ8AawfuLywghvJjbj2sZGMjeYdUZWayrPte7DE8zgBcKmOCL2c%2FVQxMY74qcqiFJbIJEDigK3Suyj2dTRZzGR62y2dnCkPKkYfnHd8RXen%2Bk7EUvBueAXEK%2B7WDiuV10iZobcENdyemx4LYWJevRNd0TBTzJCaGaWDUQvFlqD0beepLJCQAa%2BATkkQkqWfVURQTQ25o675QrFO40gOzU19%2FIljLxZD2%2FhlGCodVI6aCES3eEZQxK9xO6a%2BrGKARliIzhq1Na3u4QRH58SbKnejM4ZtDSiIJ [L] URL:Mal (0)
11.11.2012 07:52:43 hxxp://wmdvhhffix.cm/XFFZWkcEBxodG1pHCgYERlYZVFE7XBwqOwEhI18TPREYBh8cXy0HLiUxLVk/Pz0KOgUzGAwgBVAbIVpfJCocWwwTE18GOCoxAyYNCzsYByQsGw8FADMcIwwGHwItBV89OzkLPg06MDg7MExbKxo/BAhQPTgPJy4uIRk/Kz0DBSsvAVFfHBBMWy9MWysvEw85DCUCJ14PDQITD0xbLzoNGSVaEyMYEDEtORMCWTsKWR1dWA4hXBM7PDEhJlsdGy4QKA8aIAMcIRFYHgciIiEKLQQnAT8wO10IODAwCx8ALCQDCl1YOh4LKxgNJh87GF4mCzgNTFsrKiIaUFhMWyszEDNYBhowLxoPTFsrTFsrMSoxDkxbK1snDiokB1o5CwVQLiRMWysEDgYuX18zPgAfEBsAACAZXC0kGhlcCjAbAlsmDR4QJyEvXi0/CC8AWiccGwUtHRBbWSEeJlEmXSYBUAhZAAAZBSY+WBoePS8nJCReKzsnBFoFLiocEwBfXS9YKgo4CitZOjMuHw1REywYAyAZTFsvWh1bKlkNLi4qEC8TDlFMWyscWFoaChE5BD4RGlwKUApeARsoJToqID8FXRgOKllQUVA7CwMZJVk7CDgwPRwxXFxfIhgCUV1ZBFATXyFMWys8MUxbKxolIT0tIA8NIQoLBQgeKAUEPTE6HS4RG1A9JwcRADlaBjMaIQwxO1AOUScNPx9bJgMdGDAzHwwaEy47HwEbTFsvASAODydcPC4HHDwOKCgQEzwHAFg8IFEsJToCJiUNIFseH0xbKy0dBQdMWy9QASQlKjoMCyYkXjFaDwpcJiMYUAVMWy9fB1gYMFgvTFsrJB4TLxAbEBFbXF4BLTgZWycnXz9MWy8BBV4xJC8qXgcuAhw7XwsnDAUvIj0bMRggIwYrBh9eAjwDDT4FGlFaICUjBiwkUQclUF0uMA8eChwqJRwAXSMwJh0cHCY7DSZcTFsrCjEqAws9HggaPQY5Wx8jGCwFTF [L] URL:Mal (0)
11.11.2012 07:52:43 hxxp://5803.mnstr3.com/?p=8R5uCRhHJ6zTxqovu6DnGLXD0VVTcSlZqeIl9rH36MCu2ezz6oQCXjOdbRqnMErfliZuJeovkDl6TRPbWdSYQRY%2BsVma9TQfNGGHpVBTjlBFh86uy%2F%2BFzfPeLkN7fdkzf%2FSdpL3zJqyXDPzk0Rc0t41gH5zRUXHO2trGyAfsIjuHx1wnKKHcDmNhVYR4aQYYbviEMjc41SwbBqdOvRq7ObQd%2BCKs91%2BZyZ1osYFsf%2B%2BXCXg%2B2NgCMn3Pbl9GM%2BmgoG66ZWivyriiIp5DMsp5cYrk2OdwyNHF7DVaFi3NurlDty20HwO8O4Oh9a0iiplOW1swTFNMM7BRNm3lGCuzi64F1CcQcB0SZGvd8zEqjIp%2F3t2C0dGGCyFzg8%2Bu13scxPmWxs5c9c7hrALSCIVl4qgC0989RbjpL0RaQYTuX556Kqk840m9z6H%2BUX%2BsLHTDIfdHcblawAlmTXStGxr9TNnxiP3oZsHeXR9g8NdVv2OjtqYZveszGRvhr%2FhIgfN5UGnuUgAAyzUni1UI8ELSkOLdI2wv%2BDtln%2F9hMLCSebOM7X3fc5OJq9l%2F6n1qY1F%2BMwzFyryx257hDQp2NN6V%2Fhl7XMFC7nGkuR6bNelFKTrXqIJoBov7kUjdWls83ILJoEM8nL94GYfwcuCLui4JYOtuuORdO5%2BcXCjbTwasToP2vJqEl%2FTY2ORYSxUPnwuqNHB7yEwYKYG09bgR1YX5stIgihe0XSdYGu88TTTYu%2BTUIHeTAP6G8cAphYnVwVa%2BsVsMoHJr14yWJm4l6i%2BQOcw3Z7Jbw5QqGCL%2F0ryBzE%2FZOHHaw5vWB9KP8dhNdprNdVak7jVW8l6cnL3%2BoInpd3SoJn5xf78S2XkZHhMnsqZlkigjvIMQrJhtsXoRmiNL2J4HjtOBlBEvTDoHM6XQjaVKqM%2B%2F1HtE%2FJdjVuF [L] URL:Mal (0)
Und hier ein Bild von der Meldung von Avast was die ganze Zeit kommt: http://www.abload.de/img/avastpojdo.png |
