Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Aus Sicherheitsgründen wurde ihr Windowssystem blockiert! (https://www.trojaner-board.de/108261-sicherheitsgruenden-wurde-windowssystem-blockiert.html)

cosinus 23.01.2012 12:36
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

karo703 23.01.2012 14:38
Wie schon befürchtet ist GMER 2 mal abgestürzt, danach habe ich es bleiben lassen. OSAM lieferte folgendes Ergebnis:

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 14:35:21 on 23.01.2012

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit
Default Browser: Mozilla Corporation Firefox 9.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[AppInit DLLs]
-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----
"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore1cc513834782040.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"iproset.cpl" - "Intel(R) Corporation" - C:\Windows\system32\iproset.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"PROSet Tools" - "Intel(R) Corporation" - C:\Windows\System32\iPROSet.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\Karo\AppData\Local\Temp\catchme.sys  (File not found)
"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\Windows\system32\Drivers\CVPNDRVA.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"kxldqpog" (kxldqpog) - ? - C:\Users\Karo\AppData\Local\Temp\kxldqpog.sys  (Hidden registry entry, rootkit activity | File not found)
"regi" (regi) - "InterVideo" - C:\Windows\System32\drivers\regi.sys
"Sony DMI Call service" (DMICall) - "Sony Corporation" - C:\Windows\System32\DRIVERS\DMICall.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\wimfltr.sys

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Users\Karo\Desktop\7-Zip\7-zip.dll
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} "Java Plug-in 1.6.0_06" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{0B4350D1-055F-47A3-B112-5F2F2B0D6F08} "ClsidExtension" - "Google Inc." - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} "Google Gears Helper" - "Google Inc." - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Karo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"OpenOffice.org 3.0.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"BTTray.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)
"VPN Client.lnk" - "Cisco Systems, Inc." - C:\Program Files\Cisco Systems\VPN Client\vpngui.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"NSUFloatingUI" - "Sony Corporation" - "C:\Program Files\Sony\Network Utility\LANUtil.exe"
"Sony Ericsson PC Companion" - ? - "C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" /Background
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Acrobat Assistant 8.0" - "Adobe Systems Inc." - "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"MarketingTools" - "Sony Corporation" - C:\Program Files\Sony\Marketing Tools\MarketingTools.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Adobe PDF Port" - "Adobe Systems Incorporated." - C:\Windows\system32\AdobePDF.dll
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Program Files\Nero\Update\NASvc.exe,-200" (NAUpdate) - "Nero AG" - C:\Program Files\Nero\Update\NASvc.exe
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Adobe Active File Monitor V6" (AdobeActiveFileMonitor6.0) - ? - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe  (File found, but it contains no detailed information)
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Scheduler" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"VAIO Power Management" (VAIO Power Management) - "Sony Corporation" - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Google Desktop Manager 5.9.1005.12335" (GoogleDesktopManager-051210-111108) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
"Google Update Service (gupdate1c9e1531b03aa50)" (gupdate1c9e1531b03aa50) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Intel® PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel® PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"IviRegMgr" (IviRegMgr) - "InterVideo" - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"MSCSPTISRV" (MSCSPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
"NSUService" (NSUService) - "Sony Corporation" - C:\Program Files\Sony\Network Utility\NSUService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PACSPTISVR" (PACSPTISVR) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
"Sony Ericsson PCCompanion" (Sony Ericsson PCCompanion) - "Avanquest Software" - C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe
"Sony SPTI Service" (SPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
"VAIO Content Folder Watcher" (VCFw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
"VAIO Content Metadata Intelligent Analyzing Manager" (VcmIAlzMgr) - "Sony Corporation" - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
"VAIO Content Metadata XML Interface" (VcmXmlIfHelper) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
"VAIO Entertainment Database Service" (VzCdbSvc) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
"VAIO Entertainment TV Device Arbitration Service" (VAIO Entertainment TV Device Arbitration Service) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
"VAIO Entertainment UPnP Client Adapter" (Vcsw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
"VAIO Event Service" (VAIO Event Service) - "Sony Corporation" - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
"VAIO Media plus Content Importer" (SOHCImp) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe
"VAIO Media plus Device Searcher" (SOHDs) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHDs.exe
"VAIO Media plus Digital Media Server" (SOHDms) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHDms.exe

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"VESWinlogon" - "Sony Corporation" - C:\Windows\system32\VESWinlogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru [/code]

cosinus 23.01.2012 14:47
ok, was ist mit aswMBR?

karo703 23.01.2012 15:00
und hier von aswMBR:

Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-23 14:39:21
-----------------------------
14:39:21.637    OS Version: Windows 6.0.6001 Service Pack 1
14:39:21.637    Number of processors: 2 586 0x1706
14:39:21.644    ComputerName: KARO-PC  UserName: Karo
14:39:22.757    Initialize success
14:40:35.892    AVAST engine defs: 12012300
14:40:39.823    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:40:39.839    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
14:40:39.839    Disk 1  \Device\Harddisk1\DR1 -> \Device\00000076
14:40:39.854    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
14:40:39.854    Disk 2  \Device\Harddisk2\DR2 -> \Device\00000077
14:40:39.870    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
14:40:39.917    Disk 0 MBR read successfully
14:40:39.917    Disk 0 MBR scan
14:40:39.948    Disk 0 Windows VISTA default MBR code
14:40:39.964    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        9082 MB offset 2048
14:40:39.979    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      296162 MB offset 18601984
14:40:40.010    Disk 0 scanning sectors +625141760
14:40:40.151    Disk 0 scanning C:\Windows\system32\drivers
14:40:54.830    Service scanning
14:40:56.328    Modules scanning
14:41:04.284    Disk 0 trace - called modules:
14:41:04.331    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
14:41:04.346    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8621aac8]
14:41:04.346    3 CLASSPNP.SYS[8a7a2745] -> nt!IofCallDriver -> [0x85720700]
14:41:04.362    5 acpi.sys[806a06a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85741028]
14:41:05.969    AVAST engine scan C:\Windows
14:41:10.711    AVAST engine scan C:\Windows\system32
14:44:56.958    AVAST engine scan C:\Windows\system32\drivers
14:45:10.171    AVAST engine scan C:\Users\Karo
14:58:24.064    Disk 0 MBR has been saved successfully to "C:\Users\Karo\Desktop\MBR.dat"
14:58:24.080    The log file has been saved successfully to "C:\Users\Karo\Desktop\aswMBR.txt"

cosinus 23.01.2012 15:04
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


karo703 23.01.2012 15:15
Alles klar, da bin ich erleichtert! Schonmal vielen Dank.
Die Vollscans werden ja wohl jetzt erstmal einige Zeit dauern ;-)

karo703 23.01.2012 19:12
also hier die Logs von Malwarebytes und SuperAntiSpyware:

Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.23.03

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Karo :: KARO-PC [Administrator]

23.01.2012 15:10:07
mbam-log-2012-01-23 (15-10-07).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 400837
Laufzeit: 2 Stunde(n), 47 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/23/2012 at 06:39 PM

Application Version : 5.0.1142

Core Rules Database Version : 8155
Trace Rules Database Version: 5967

Scan type      : Quick Scan
Total Scan Time : 00:09:06

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 1 (Build 6.00.6001)
UAC On - Limited User (Administrator User)

Memory items scanned      : 876
Memory threats detected  : 0
Registry items scanned    : 16045
Registry threats detected : 0
File items scanned        : 10237
File threats detected    : 357

Adware.Tracking Cookie
        C:\Users\Karo\AppData\Roaming\Microsoft\Windows\Cookies\karo@ad.yieldmanager[2].txt [ /ad.yieldmanager ]
        C:\Users\Karo\AppData\Roaming\Microsoft\Windows\Cookies\karo@atdmt[2].txt [ /atdmt ]
        .tradedoubler.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\Users\Karo\AppData\Roaming\Microsoft\Windows\Cookies\karo@content.yieldmanager[1].txt [ /content.yieldmanager ]
        .tradedoubler.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\Users\Karo\AppData\Roaming\Microsoft\Windows\Cookies\karo@doubleclick[1].txt [ /doubleclick ]
        .tradedoubler.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        studivz.adfarm1.adition.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        adserver.doccheck.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@specificclick[2].txt [ Cookie:karo@specificclick.net/ ]
        statse.webtrendslive.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@ad.zanox[2].txt [ Cookie:karo@ad.zanox.com/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@apmebf[2].txt [ Cookie:karo@apmebf.com/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@cdn5.specificclick[2].txt [ Cookie:karo@cdn5.specificclick.net/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@tvtv.122.2o7[1].txt [ Cookie:karo@tvtv.122.2o7.net/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@content.yieldmanager[1].txt [ Cookie:karo@content.yieldmanager.com/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@statcounter[2].txt [ Cookie:karo@statcounter.com/ ]
        studivz.adfarm1.adition.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@paypal.112.2o7[1].txt [ Cookie:karo@paypal.112.2o7.net/ ]
        .adcentriconline.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@sonyeurope.112.2o7[1].txt [ Cookie:karo@sonyeurope.112.2o7.net/ ]
        .112.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@adviva[1].txt [ Cookie:karo@adviva.net/ ]
        .specificclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        tracking.tchibo.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@track.webgains[1].txt [ Cookie:karo@track.webgains.com/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@ad.yieldmanager[1].txt [ Cookie:karo@ad.yieldmanager.com/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@atdmt[2].txt [ Cookie:karo@atdmt.com/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@bs.serving-sys[1].txt [ Cookie:karo@bs.serving-sys.com/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@tracking.mindshare[2].txt [ Cookie:karo@tracking.mindshare.de/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@ad.adnet[1].txt [ Cookie:karo@ad.adnet.biz/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@zanox-affiliate[2].txt [ Cookie:karo@zanox-affiliate.de/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@traffictrack[1].txt [ Cookie:karo@traffictrack.de/ ]
        .tradedoubler.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@stat.dealtime[1].txt [ Cookie:karo@stat.dealtime.com/ ]
        .im.banner.t-online.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@tradedoubler[2].txt [ Cookie:karo@tradedoubler.com/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@doubleclick[2].txt [ Cookie:karo@doubleclick.net/ ]
        .ad.adnet.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@www.zanox-affiliate[2].txt [ Cookie:karo@www.zanox-affiliate.de/ ]
        .smartadserver.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@fastclick[1].txt [ Cookie:karo@fastclick.net/ ]
        C:\USERS\KARO\AppData\Roaming\Microsoft\Windows\Cookies\Low\karo@www.etracker[2].txt [ Cookie:karo@www.etracker.de/ ]
        ad.adserver01.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\Cookies\karo@content.yieldmanager[1].txt [ Cookie:karo@content.yieldmanager.com/ ]
        .doubleclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .wissende.122.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        banner.testberichte.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\Cookies\karo@ad.yieldmanager[2].txt [ Cookie:karo@ad.yieldmanager.com/ ]
        C:\USERS\KARO\Cookies\karo@atdmt[2].txt [ Cookie:karo@atdmt.com/ ]
        .hyatt.112.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\KARO\Cookies\karo@doubleclick[1].txt [ Cookie:karo@doubleclick.net/ ]
        .roiservice.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .cheaptickets.122.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adserv.quality-channel.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        in.getclicky.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        delivery.atkmedia.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .paypal.112.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .komtrack.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        de.partypoker.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .1tracking.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        wstat.wibiya.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .opodo.122.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .gostats.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        s.megaclick.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        de.partypoker.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .rambler.ru [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        tracking.statravel.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wflooidjwgp.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .komtrack.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .apodiscounter.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .apodiscounter.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .secmedia.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wfkyqldpocp.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        adserver.yopi.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tto2.traffictrack.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wfloulazsep.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wnkoemcjwlq.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .googleads.g.doubleclick.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .3pagen.112.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adxpose.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .azjmp.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        adservercentral.info [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .trafficmp.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .trafficmp.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .getclicky.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .static.getclicky.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .track.webgains.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        clicks.pangora.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        clicks.pangora.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        eas4.emediate.eu [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .conrad.122.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.biz [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .trafficmp.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        zbox.zanox.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .bshg.122.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .interclick.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .collective-media.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .bizrate.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .cewecolor.112.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .myhammer.122.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .stats.paypal.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .xm.xtendmedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ad.velmedia.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ad.velmedia.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .velmedia.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .pro-market.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ads.247activemedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .f.megaclick.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .f.megaclick.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .megaclick.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ads.adxvalue.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ads.adxvalue.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ads.adxvalue.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ads.adxvalue.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        wmedia.rotator.hadj7.adjuggler.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        wmedia.rotator.hadj7.adjuggler.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .amazon-adsystem.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ww251.smartadserver.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wfkygkc5cdo.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wnliogczcho.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aek4kkczcko.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wgkospczwfq.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wmkyaoczakq.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wgmikkcpoko.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        www.ad-track.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aelishcjikp.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .www.traffictrack.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .mmotraffic.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .mmotraffic.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .advertising.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .partypoker.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .questionmarket.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .komtrack.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wdk4ggczgep.stats.esomniture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .weborama.fr [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .weborama.fr [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .loccitane.solution.weborama.fr [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .dealtime.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        stat.dealtime.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .deutschepostag.112.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        www.matracking.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .usairways.112.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        forexyard.advertserve.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        adserver.webmasterbond.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        edates.traffective-tracking.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        www.traffective-tracking.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .ostatserverld.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .microsoftsto.112.2o7.net [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\KARO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UYO04I39.DEFAULT\COOKIES.SQLITE ]
bei SuperAntiSpyware konnte ich nicht ganz genau der Anleitung folgen, da dort noch eine ältere Version beschrieben war. Kann also sein, dass ich da irgendwas falsch gemacht hab!?
Soll ich die gefundenen Threats nun löschen?

cosinus 23.01.2012 21:45
Nein das ist ok, das sind auch nur Cookies, die können weg.

Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

mach bitte noch ESET und bitte einen VOLLSCAN mit SASW denn du hast nur einen Quickscan gemacht

karo703 24.01.2012 13:54
Also habe den Vollscan mit SuperAntispyware gemacht und die gefundenen Cookies gelöscht. Hier der Report von Superantispyware und von ESET:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/24/2012 at 09:14 AM

Application Version : 5.0.1142

Core Rules Database Version : 8159
Trace Rules Database Version: 5971

Scan type      : Complete Scan
Total Scan Time : 01:58:06

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 1 (Build 6.00.6001)
UAC On - Limited User (Administrator User)

Memory items scanned      : 832
Memory threats detected  : 0
Registry items scanned    : 23408
Registry threats detected : 0
File items scanned        : 193843
File threats detected    : 12

Adware.Tracking Cookie
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@A6.ADSERVER01[2].TXT [ /A6.ADSERVER01 ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@AD.AD-SRV[2].TXT [ /AD.AD-SRV ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@ADFARM1.ADITION[2].TXT [ /ADFARM1.ADITION ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@ADS.HEIAS[1].TXT [ /ADS.HEIAS ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@ADTECH[1].TXT [ /ADTECH ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@EAS.APM.EMEDIATE[2].TXT [ /EAS.APM.EMEDIATE ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@ROTATOR.ADJUGGLER[1].TXT [ /ROTATOR.ADJUGGLER ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@SERVING-SYS[2].TXT [ /SERVING-SYS ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@TRACK.WEBTREKK[1].TXT [ /TRACK.WEBTREKK ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@TRACKING.QUISMA[2].TXT [ /TRACKING.QUISMA ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@WEBMASTERPLAN[2].TXT [ /WEBMASTERPLAN ]
        C:\USERS\KARO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\KARO@ZANOX[1].TXT [ /ZANOX ]

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=48c55bf3bd78374daa4df78e682293f6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-19 02:46:02
# local_time=2012-01-19 03:46:02 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 1455 99634053 0 0
# compatibility_mode=5892 16776573 100 100 24361 164508666 0 0
# compatibility_mode=8192 67108863 100 0 3793 3793 0 0
# scanned=324882
# found=19
# cleaned=0
# scan_time=8445
C:\Program Files\Uniblue\RegistryBooster\Launcher.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files\Uniblue\RegistryBooster\rbnotifier.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files\Uniblue\RegistryBooster\rb_move_serial.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files\Uniblue\RegistryBooster\rb_ubm.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files\Uniblue\RegistryBooster\registrybooster.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\AppData\Local\Mozilla\Firefox\Profiles\uyo04i39.default\Cache\38D89D24d01        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\AppData\Local\Temp\mia80C3.tmp\data\OFFLINE\9AB3D468\F6AF8A1D\Launcher.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\AppData\Local\Temp\mia80C3.tmp\data\OFFLINE\9AB3D468\F6AF8A1D\rbmonitor.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\AppData\Local\Temp\mia80C3.tmp\data\OFFLINE\9AB3D468\F6AF8A1D\rbnotifier.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\AppData\Local\Temp\mia80C3.tmp\data\OFFLINE\9AB3D468\F6AF8A1D\rb_move_serial.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\AppData\Local\Temp\mia80C3.tmp\data\OFFLINE\9AB3D468\F6AF8A1D\rb_ubm.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\AppData\Local\Temp\mia80C3.tmp\data\OFFLINE\9AB3D468\F6AF8A1D\registrybooster.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\48e4250c-501f7eee        Java/Exploit.CVE-2011-3544.AA trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\64545913-3078f186        Java/Exploit.CVE-2011-3544.AA trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\Desktop\registrybooster.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Karo\Downloads\SoftonicDownloader_fuer_englisch-trainer.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I
G:\Karo\Downloads\SoftonicDownloader_fuer_englisch-trainer.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I
${Memory}        Win32/RegistryBooster application        00000000000000000000000000000000        I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=48c55bf3bd78374daa4df78e682293f6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-24 12:38:35
# local_time=2012-01-24 01:38:35 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 339701 100059408 4530 0
# compatibility_mode=5892 16776573 100 100 19578 164934021 0 0
# compatibility_mode=8192 67108863 100 0 429148 429148 0 0
# scanned=239716
# found=2
# cleaned=0
# scan_time=7443
C:\Users\Karo\Downloads\SoftonicDownloader_fuer_englisch-trainer.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I
G:\Karo\Downloads\SoftonicDownloader_fuer_englisch-trainer.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I
ESETSmartInstaller@High as downloader log:
all ok
über diese Softonic-Geschichten hatten wir ja schon geredet. Kann ich den Scan einfach nochmal ausführen und dann "remove found threats" anklicken, um diese loszuwerden? oder sind da noch weitere Schritte notwendig?

cosinus 24.01.2012 14:16
Das kannst du auch manuell löschen! Um Dateien zu löschen braucht man keinen Virenscanner oder extra Tool!

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

karo703 24.01.2012 14:22
Sonst passt wieder alles :-). Nochmals tausend Dank, wäre allein wirklich komplett aufgeschmissen gewesen.
Da wäre jetzt nur noch die Sache mit den Updates. Wo finde ich denn die Updates zum Service Pack 2 und Internet Explorer 9?

cosinus 24.01.2012 14:38
SP2/IE9 für Windows Vista (32-Bit)
  1. Das SP2 von hier downloaden => Detail Seite Windows Vista SP2 (348.3MB)
  2. Alle Programme beenden, Internetverbindung trennen, Virenscanner abstellen!
  3. SP2 installieren, Anweisungen folgen - Installation kann eine gute Stunde dauern!!
  4. IE9-Setup laden und ausführen => Windows Internet Explorer 9 für Windows Vista und Windows Server 2008
(Der IE9 erfordert ein installiertes SP2)

Achte beim Setup des IE wieder darauf, dass vorher möglichst alle Programme beendet und der Virenscanner deaktiviert wurde. Im Setup selbst bitte nicht an dem Verbesserungsprogramm teilnehmen (oder wie MS das nennt) und auch KEINE Updates über das Setup installieren. Die installieren wir später, ich sag dir dann wie. Melde dich wenn SP2/IE9 drauf sind.

karo703 24.01.2012 16:28
So alles installiert. Ob man Updates installieren oder an Verbesserungsprogrammen teilnehmen möchte wurde jetzt nichts gefragt. Nach der Lizenzvereinbarung ging alles automatisch.

cosinus 24.01.2012 16:50
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

karo703 24.01.2012 18:01
Ok, Combofix ist deinstalliert, ging problemlos. Wie siehts denn mit den anderen Programmen? In der Liste, die ich über Systemsteuerung -> Programme -> Programme deinstallieren bekomme tauchen einige gar nicht auf. Kann ich diese dann einfach in den Papierkorb schmeißen oder wie deinstalliere ich diese?

Beim Versuch das aktuellen JAVA SE Runtime Environment runterzuladen sind auch noch ein paar Fragen aufgekommen:
wenn ich das erste JRE in der Liste downloaden möchte, bekomme ich eine Liste für die verschiedenen Betriebssysteme

Windows x86 Online 0.85 MB jre-7u2-windows-i586-iftw.exe
Windows x86 Offline 19.35 MB jre-7u2-windows-i586.exe
Windows x64 20.46 MB jre-7u2-windows-x64.exe

welches sollte ich hier denn auswählen? Zumal ich dachte, dass ich irgendeine Version für 32-bit brauchen? oder für was stehen hier 64 und 86?
Fragen über Fragen. Tut mir leid, ist echt nicht mein Fachgebiet hier ;-)


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:22 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131