Hallo,
eine Bekannte von mir hat per Email einen Trojaner vesteckt in einer zip-Datei heruntergeladen. Sie hat die zip-Datei entpackt und und die .exe-Datei ausgeführt. Die Mail kam angeblich vom DHL und hatte folgenden Betreff: DHL Delivery Notification Message 9CC46ZLSQM89QVPPM.
In der Mail stand:
PLEASE REFER TO ATTACHED FILE FOR DETAILED INFORMATION.

MSEssentials hat diesen Trojaner entdeckt und gelöscht. Jetzt meine Frage: Ist das System jetzt wieder sicher oder hat sich der Trojaner fest eingenistet?

Defogger gibt folgendes an:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:33 on 26/01/2012 (Administrator)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-

Die anderen Log-Dateien befinden sich im Anhang.
Komischerweise hat OTL keine Extra.txt -Datei erstellt.

Vielen Dank für eure Hilfe!

Hallo und Herzlich Willkommen!

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

• "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
  - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
  - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
• Charakteristische Merkmale/Profilinformationen:
  - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
• Die Systemprüfung und Bereinigung:
  - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
• Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
• Innerhalb der Betreuungszeit:
  - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
• Die Reihenfolge:
  - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
• GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
• Ansonsten unsere Forumsregeln:
  - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
• Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen

► Erster Teil des 3-teiligen Verfahren, werden wir dein System auf Viren untersuchen, bzw nach einem anderen Verursacher suchen:
Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Hast Du absichtlich die IP so als Proxy eingestellt?

"ProxyServer" = 192.168.1.1:8080
         

Wenn ja, warum? Wenn nein:
wenn du keinen Proxyserver lokal installiert hast, nimm die Proxyeinstellungen aus den Interneteinstellungen raus
im Internet Explorer:
Extras => Internetoptionen => Verbindungen => Lan-Einstellungen
Haken bei Proxyserver für LAN verwenden und Proxyserver für lokale Adressen umgehen entfernen.

2.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org

• Installieren und per Doppelklick starten.
• Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
• "Komplett Scan durchführen" wählen (überall Haken setzen)
• wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
• Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
• Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"

eine bebilderte Anleitung findest Du hier: Anleitung

3.
erneut einen Systemscan mit OTL

• Doppelklick auf die OTL.exe
• Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
• Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
• Unter Extra Registry, wähle bitte Use SafeList
• Klicke nun auf Run Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
• Poste die Logfiles in Code-Tags hier in den Thread.

4.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool CCleaner herunter
→ Download
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ Sprache → Deutsch auswählen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

5.
Lade dir von hier -> TrendMicro™ HijackThis™/Version 2.0.4 herunter

Keine offenen Fenster, solang bis HijackThis läuft!!-> HijackThis starten-> "Do a system scan and save a logfile" klicken (kurz warten) -> das erhaltene Logfile "markieren" -> "kopieren"-> hier in deinem Thread (rechte Maustaste) "einfügen" (musst du im Forum eingeloggt sein!)

• HijackThis - bebilderte Anleitung
• HijackThis/Anleitung

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

gruß
kira

Hallo kira,
vielen Dank für deine Hilfe!
Leider kommen ich selten an den Rechenr von meiner Bekannten, deswegen antworte ich erst jetzt.
Von gecrackter Software weiß ich nichts und konnte auf den ersten Blick nichts finden. Sie benutzt eigentlich nur lizenzierte Programme. Hast du gekrackte Software gefunden?
Hier die Ergebnisse der geforderten Punkte.

Zu 1: Die Proxyeinstellung ist raus.

Zu 2: Malewarebytes fand entdeckte keine Schädlinge.

 Malwarebytes Anti-Malware  (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.02.04

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Administrator :: .

Schutz: Aktiviert

02.02.2012 16:21:21
mbam-log-2012-02-02 (16-21-21).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 429963
Laufzeit: 44 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

Zu 3:
OTL.txt
OTL Logfile:

OTL logfile created on: 02.02.2012 17:16:59 - Run 4
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\*\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,93 Gb Total Physical Memory | 1,78 Gb Available Physical Memory | 60,60% Memory free
5,87 Gb Paging File | 4,68 Gb Available in Paging File | 79,72% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465,46 Gb Total Space | 424,89 Gb Free Space | 91,29% Space Free | Partition Type: NTFS
 
Computer Name: * | User Name: * | Logged in as *
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\*\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - c:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
PRC - c:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (NisSrv) -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (MpNWMon) -- C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (vmbus) -- C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (iSSetup) -- C:\Windows\system32\DRIVERS\iSSetup.sys (Intel Corporation)
DRV - (IFCoEVB) -- C:\Windows\system32\DRIVERS\ifP52X32.sys (Intel(R) Corporation)
DRV - (IFCoEMP) -- C:\Windows\system32\DRIVERS\ifM52x32.sys (Intel(R) Corporation)
DRV - (ioatdma2) Intel(R) -- C:\Windows\System32\Drivers\qd26032.sys (Intel Corporation)
DRV - (ioatdma1) Intel(R) -- C:\Windows\System32\Drivers\qd16032.sys (Intel Corporation)
DRV - (ioatdma) -- C:\Windows\System32\Drivers\ioatdma.sys (Intel Corporation)
DRV - (WSDPrintDevice) -- C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)
DRV - (Serial) -- C:\Windows\system32\DRIVERS\serial.sys (Brother Industries Ltd.)
DRV - (adptahci) -- C:\Windows\system32\DRIVERS\adptahci.sys (Adaptec, Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (IAMTV) Treiber für Intel(R) -- C:\Windows\system32\DRIVERS\IAMTV.sys (Intel Corporation)
DRV - (IAMTXP) Treiber für Intel(R) -- C:\Windows\system32\DRIVERS\IAMTXP.sys (Intel Corporation)
DRV - (IAMT03) Treiber für Intel(R) -- C:\Windows\system32\DRIVERS\IAMT03.sys (Intel Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.7896
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20111107
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.02 16:56:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.02 16:56:25 | 000,000,000 | ---D | M]
 
[2012.02.02 16:02:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*\AppData\Roaming\mozilla\Extensions
[2012.02.02 16:03:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*\AppData\Roaming\mozilla\Firefox\Profiles\us0z0l8w.default\extensions
[2012.02.02 16:03:33 | 000,000,000 | ---D | M] (WOT) -- C:\Users\*\AppData\Roaming\mozilla\Firefox\Profiles\us0z0l8w.default\extensions\{*7}
[2012.02.02 16:56:26 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.07.15 13:05:37 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.01.29 17:12:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.01.29 15:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.29 14:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.01.29 15:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.29 15:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.29 15:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.29 15:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://photoservice.fujicolor.eu/ips-opdata/objects/jordan.cab (JordanUploader Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.50.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = brakedc.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6325E6F3-FCF5-4382-98E5-2BD490001FDD}: DhcpNameServer = 192.168.50.10
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.02 16:17:11 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Malwarebytes
[2012.02.02 16:15:19 | 009,502,424 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\*\Desktop\mbam--setup-1.60.1.1000.exe
[2012.02.02 16:01:50 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Mozilla
[2012.02.02 16:01:50 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Local\Mozilla
[2012.01.26 15:02:55 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\*\Desktop\OTL.exe
[2012.01.26 15:02:53 | 000,000,000 | ---D | C] -- C:\Users\*\Desktop\security
[2012.01.26 15:01:54 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Macromedia
[2012.01.26 15:01:51 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Adobe
[2012.01.26 15:01:35 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Google
[2012.01.26 15:01:30 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Local\Google
[2012.01.26 14:50:50 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Apple Computer
[2012.01.26 14:50:48 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Local\Apple Computer
[2012.01.26 14:50:44 | 000,000,000 | R--D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.01.26 14:50:44 | 000,000,000 | R--D | C] -- C:\Users\*\Searches
[2012.01.26 14:50:44 | 000,000,000 | R--D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.01.26 14:50:41 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer
[2012.01.26 14:50:40 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Identities
[2012.01.26 14:50:38 | 000,000,000 | R--D | C] -- C:\Users\*\Contacts
[2012.01.26 14:50:33 | 000,000,000 | --SD | C] -- C:\Users\*\AppData\Roaming\Microsoft
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\Videos
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\Saved Games
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\Pictures
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\Music
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\Links
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\Favorites
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\Downloads
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\Documents
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\Desktop
[2012.01.26 14:50:33 | 000,000,000 | R--D | C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Vorlagen
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\AppData\Local\Verlauf
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\AppData\Local\Temporary Internet Files
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Startmenü
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\SendTo
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Recent
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Netzwerkumgebung
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Lokale Einstellungen
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Documents\Eigene Videos
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Documents\Eigene Musik
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Eigene Dateien
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Documents\Eigene Bilder
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Druckumgebung
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Cookies
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\AppData\Local\Anwendungsdaten
[2012.01.26 14:50:33 | 000,000,000 | -HSD | C] -- C:\Users\*\Anwendungsdaten
[2012.01.26 14:50:33 | 000,000,000 | -H-D | C] -- C:\Users\*\AppData
[2012.01.26 14:50:33 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Local\Temp
[2012.01.26 14:50:33 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Local\Microsoft Help
[2012.01.26 14:50:33 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Local\Microsoft
[2012.01.26 14:50:33 | 000,000,000 | ---D | C] -- C:\Users\*\AppData\Roaming\Media Center Programs
[2012.01.11 18:03:53 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2012.01.11 18:03:48 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2012.01.11 18:03:48 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2012.01.11 18:03:40 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll
[2012.01.11 18:03:40 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sspisrv.dll
[2010.08.25 18:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[5 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.02 17:14:11 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.02 17:12:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.02 17:12:42 | 2362,834,944 | -HS- | M] () -- C:\hiberfil.sys
[2012.02.02 16:56:28 | 000,001,094 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.02.02 16:22:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.02 16:17:05 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.02.02 16:16:10 | 009,502,424 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\*\Desktop\mbam--setup-1.60.1.1000.exe
[2012.02.02 16:01:53 | 000,000,000 | ---- | M] () -- C:\Windows\nsreg.dat
[2012.02.02 08:39:32 | 000,029,328 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.02 08:39:32 | 000,029,328 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.02 08:36:50 | 000,656,196 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.02.02 08:36:50 | 000,617,860 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.02.02 08:36:50 | 000,131,952 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.02.02 08:36:50 | 000,108,396 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.31 13:44:05 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2012.01.26 15:33:24 | 000,000,000 | ---- | M] () -- C:\Users\*\defogger_reenable
[2012.01.26 14:55:18 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\*\Desktop\OTL.exe
[2012.01.16 08:47:39 | 000,723,112 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[5 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.02.02 16:56:27 | 000,001,106 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.02.02 16:17:05 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.02.02 16:01:53 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2012.01.26 15:33:24 | 000,000,000 | ---- | C] () -- C:\Users\*\defogger_reenable
[2012.01.26 14:50:45 | 000,001,415 | ---- | C] () -- C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.04.15 21:07:21 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.04.14 08:00:49 | 000,303,104 | ---- | C] () -- C:\Windows\System32\eST3snm.dll
[2011.02.15 16:20:33 | 000,000,000 | ---- | C] () -- C:\Windows\HPMProp.INI
[2011.02.15 15:06:31 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.02.15 14:13:54 | 000,048,636 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011.02.15 13:28:39 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.02.08 16:57:38 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2011.02.08 16:57:38 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2011.02.08 16:57:38 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2011.02.08 16:57:38 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2011.02.08 16:57:38 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2011.02.08 16:57:37 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2011.02.08 15:17:56 | 000,000,051 | ---- | C] () -- C:\Windows\smsts.ini
[2009.07.14 09:47:43 | 000,656,196 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 09:47:43 | 000,131,952 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 05:33:53 | 000,723,112 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 03:05:48 | 000,617,860 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 03:05:48 | 000,108,396 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.07.13 23:09:19 | 000,139,824 | ---- | C] () -- C:\Windows\System32\igfcg500.bin
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
========== LOP Check ==========
[2011.12.27 11:31:54 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
         

--- --- ---


Extras.txt
OTL Logfile:

OTL Extras logfile created on: 02.02.2012 17:16:59 - Run 4
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\*\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,93 Gb Total Physical Memory | 1,78 Gb Available Physical Memory | 60,60% Memory free
5,87 Gb Paging File | 4,68 Gb Available in Paging File | 79,72% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465,46 Gb Total Space | 424,89 Gb Free Space | 91,29% Space Free | Partition Type: NTFS
 
Computer Name: * | User Name: * | Logged in as *.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
"PolicyVersion" = 512
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\FirewallRules]
"CoreNet-ICMP6-DU-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=1:*|App=System|Name=@FirewallAPI.dll,-25110|Desc=@FirewallAPI.dll,-25112|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP4-DUFRAG-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=1|Profile=Domain|ICMP4=3:4|App=System|Name=@FirewallAPI.dll,-25251|Desc=@FirewallAPI.dll,-25257|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-DHCP-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|LPort=68|RPort=67|App=%SystemRoot%\system32\svchost.exe|Svc=dhcp|Name=@FirewallAPI.dll,-25301|Desc=@FirewallAPI.dll,-25303|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-IGMP-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=2|Profile=Domain|App=System|Name=@FirewallAPI.dll,-25376|Desc=@FirewallAPI.dll,-25382|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-IPv6-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=41|Profile=Domain|App=System|Name=@FirewallAPI.dll,-25351|Desc=@FirewallAPI.dll,-25357|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-LD-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=132:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25082|Desc=@FirewallAPI.dll,-25088|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-LQ-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=130:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25061|Desc=@FirewallAPI.dll,-25067|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-LR-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=131:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25068|Desc=@FirewallAPI.dll,-25074|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-LR2-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=143:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25075|Desc=@FirewallAPI.dll,-25081|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-NDA-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=136:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25026|Desc=@FirewallAPI.dll,-25032|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-NDS-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=135:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25019|Desc=@FirewallAPI.dll,-25025|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-PTB-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=2:*|App=System|Name=@FirewallAPI.dll,-25001|Desc=@FirewallAPI.dll,-25007|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-PP-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=4:*|App=System|Name=@FirewallAPI.dll,-25116|Desc=@FirewallAPI.dll,-25118|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-RA-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=134:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25012|Desc=@FirewallAPI.dll,-25018|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-Teredo-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|LPort=Teredo|App=%SystemRoot%\system32\svchost.exe|Svc=iphlpsvc|Name=@FirewallAPI.dll,-25326|Desc=@FirewallAPI.dll,-25332|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-TE-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=3:*|App=System|Name=@FirewallAPI.dll,-25113|Desc=@FirewallAPI.dll,-25115|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-DU-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=1:*|App=System|Name=@FirewallAPI.dll,-25111|Desc=@FirewallAPI.dll,-25112|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP4-DUFRAG-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=1|Profile=Domain|ICMP4=3:4|App=System|Name=@FirewallAPI.dll,-25252|Desc=@FirewallAPI.dll,-25257|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-DHCP-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=17|Profile=Domain|LPort=68|RPort=67|App=%SystemRoot%\system32\svchost.exe|Svc=dhcp|Name=@FirewallAPI.dll,-25302|Desc=@FirewallAPI.dll,-25303|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-IGMP-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=2|Profile=Domain|App=System|Name=@FirewallAPI.dll,-25377|Desc=@FirewallAPI.dll,-25382|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-IPv6-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=41|Profile=Domain|App=System|Name=@FirewallAPI.dll,-25352|Desc=@FirewallAPI.dll,-25357|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-LD-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=132:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25083|Desc=@FirewallAPI.dll,-25088|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-LQ-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=130:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25062|Desc=@FirewallAPI.dll,-25067|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-LR-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=131:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25069|Desc=@FirewallAPI.dll,-25074|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-LR2-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=143:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25076|Desc=@FirewallAPI.dll,-25081|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-NDA-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=136:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25027|Desc=@FirewallAPI.dll,-25032|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-NDS-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=135:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25020|Desc=@FirewallAPI.dll,-25025|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-PTB-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=2:*|App=System|Name=@FirewallAPI.dll,-25002|Desc=@FirewallAPI.dll,-25007|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-PP-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=4:*|App=System|Name=@FirewallAPI.dll,-25117|Desc=@FirewallAPI.dll,-25118|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-RA-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=134:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25013|Desc=@FirewallAPI.dll,-25018|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-Teredo-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=17|Profile=Domain|App=%SystemRoot%\system32\svchost.exe|Svc=iphlpsvc|Name=@FirewallAPI.dll,-25327|Desc=@FirewallAPI.dll,-25333|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-TE-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=3:*|App=System|Name=@FirewallAPI.dll,-25114|Desc=@FirewallAPI.dll,-25115|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-GP-LSASS-Out-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Domain|App=%SystemRoot%\system32\lsass.exe|Name=@FirewallAPI.dll,-25407|Desc=@FirewallAPI.dll,-25408|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-GP-Out-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Domain|App=%SystemRoot%\system32\svchost.exe|Name=@FirewallAPI.dll,-25403|Desc=@FirewallAPI.dll,-25404|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-GP-NP-Out-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Domain|RPort=445|App=System|Name=@FirewallAPI.dll,-25401|Desc=@FirewallAPI.dll,-25401|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-ICMP6-RS-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=133:*|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-25008|Desc=@FirewallAPI.dll,-25011|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|
"CoreNet-DNS-Out-UDP" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=17|Profile=Domain|RPort=53|App=%SystemRoot%\system32\svchost.exe|Svc=dnscache|Name=@FirewallAPI.dll,-25405|Desc=@FirewallAPI.dll,-25406|EmbedCtxt=@FirewallAPI.dll,-25000|Edge=FALSE|LSM=TRUE|
"FPS-ICMP4-ERQ-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=1|Profile=Domain|ICMP4=8:*|Name=@FirewallAPI.dll,-28543|Desc=@FirewallAPI.dll,-28547|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-ICMP6-ERQ-In" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=58|Profile=Domain|ICMP6=128:*|Name=@FirewallAPI.dll,-28545|Desc=@FirewallAPI.dll,-28547|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-NB_Datagram-In-UDP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|LPort=138|App=System|Name=@FirewallAPI.dll,-28527|Desc=@FirewallAPI.dll,-28530|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-NB_Name-In-UDP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|LPort=137|App=System|Name=@FirewallAPI.dll,-28519|Desc=@FirewallAPI.dll,-28522|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-NB_Session-In-TCP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|LPort=139|App=System|Name=@FirewallAPI.dll,-28503|Desc=@FirewallAPI.dll,-28506|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-SMB-In-TCP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|LPort=445|App=System|Name=@FirewallAPI.dll,-28511|Desc=@FirewallAPI.dll,-28514|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-SpoolSvc-In-TCP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|LPort=RPC|App=%SystemRoot%\system32\spoolsv.exe|Svc=Spooler|Name=@FirewallAPI.dll,-28535|Desc=@FirewallAPI.dll,-28538|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-RPCSS-In-TCP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|LPort=RPC-EPMap|Svc=Rpcss|Name=@FirewallAPI.dll,-28539|Desc=@FirewallAPI.dll,-28542|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-ICMP4-ERQ-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=1|Profile=Domain|ICMP4=8:*|Name=@FirewallAPI.dll,-28544|Desc=@FirewallAPI.dll,-28547|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-ICMP6-ERQ-Out" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=58|Profile=Domain|ICMP6=128:*|Name=@FirewallAPI.dll,-28546|Desc=@FirewallAPI.dll,-28547|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-NB_Datagram-Out-UDP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=17|Profile=Domain|RPort=138|App=System|Name=@FirewallAPI.dll,-28531|Desc=@FirewallAPI.dll,-28534|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-NB_Name-Out-UDP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=17|Profile=Domain|RPort=137|App=System|Name=@FirewallAPI.dll,-28523|Desc=@FirewallAPI.dll,-28526|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-NB_Session-Out-TCP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Domain|RPort=139|App=System|Name=@FirewallAPI.dll,-28507|Desc=@FirewallAPI.dll,-28510|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"FPS-SMB-Out-TCP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Domain|RPort=445|App=System|Name=@FirewallAPI.dll,-28515|Desc=@FirewallAPI.dll,-28518|EmbedCtxt=@FirewallAPI.dll,-28502|Edge=FALSE|
"RemoteAssistance-DCOM-In-TCP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|LPort=RPC-EPMap|App=%SystemRoot%\system32\svchost.exe|Svc=rpcss|Name=@FirewallAPI.dll,-33035|Desc=@FirewallAPI.dll,-33036|EmbedCtxt=@FirewallAPI.dll,-33002|Edge=FALSE|
"RemoteAssistance-UPnPHost-In-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|LPort=2869|RA4=LocalSubnet|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-33027|Desc=@FirewallAPI.dll,-33030|EmbedCtxt=@FirewallAPI.dll,-33002|Edge=FALSE|
"RemoteAssistance-SSDPSrv-In-UDP" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Domain|LPort=1900|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=Ssdpsrv|Name=@FirewallAPI.dll,-33019|Desc=@FirewallAPI.dll,-33022|EmbedCtxt=@FirewallAPI.dll,-33002|Edge=FALSE|
"RemoteAssistance-In-TCP-EdgeScope" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|App=%SystemRoot%\system32\msra.exe|Name=@FirewallAPI.dll,-33003|Desc=@FirewallAPI.dll,-33006|EmbedCtxt=@FirewallAPI.dll,-33002|Edge=FALSE|
"RemoteAssistance-RAServer-In-TCP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|App=%SystemRoot%\system32\raserver.exe|Name=@FirewallAPI.dll,-33011|Desc=@FirewallAPI.dll,-33014|EmbedCtxt=@FirewallAPI.dll,-33002|Edge=FALSE|
"RemoteAssistance-UPnPHost-Out-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Domain|RA4=LocalSubnet|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-33031|Desc=@FirewallAPI.dll,-33034|EmbedCtxt=@FirewallAPI.dll,-33002|Edge=FALSE|
"RemoteAssistance-UPnP-Out-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Domain|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=upnphost|Name=@FirewallAPI.dll,-33037|Desc=@FirewallAPI.dll,-33038|EmbedCtxt=@FirewallAPI.dll,-33002|Edge=FALSE|
"RemoteAssistance-SSDPSrv-Out-UDP" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=17|Profile=Domain|RPort=1900|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=Ssdpsrv|Name=@FirewallAPI.dll,-33023|Desc=@FirewallAPI.dll,-33026|EmbedCtxt=@FirewallAPI.dll,-33002|Edge=FALSE|
"RemoteAssistance-Out-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Domain|App=%SystemRoot%\system32\msra.exe|Name=@FirewallAPI.dll,-33007|Desc=@FirewallAPI.dll,-33010|EmbedCtxt=@FirewallAPI.dll,-33002|Edge=FALSE|
"RemoteAssistance-RAServer-Out-TCP-NoScope" = v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Domain|App=%SystemRoot%\system32\raserver.exe|Name=@FirewallAPI.dll,-33015|Desc=@FirewallAPI.dll,-33018|EmbedCtxt=@FirewallAPI.dll,-33002|Edge=FALSE|
"RemoteDesktop-In-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|LPort=3389|App=System|Name=@FirewallAPI.dll,-28753|Desc=@FirewallAPI.dll,-28756|EmbedCtxt=@FirewallAPI.dll,-28752|Edge=FALSE|
"WMI-ASYNC-In-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|App=%systemroot%\system32\wbem\unsecapp.exe|Name=@FirewallAPI.dll,-34256|Desc=@FirewallAPI.dll,-34257|EmbedCtxt=@FirewallAPI.dll,-34251|Edge=FALSE|
"WMI-RPCSS-In-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|LPort=135|App=%SystemRoot%\system32\svchost.exe|Svc=rpcss|Name=@FirewallAPI.dll,-34252|Desc=@FirewallAPI.dll,-34253|EmbedCtxt=@FirewallAPI.dll,-34251|Edge=FALSE|
"WMI-WINMGMT-In-TCP" = v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Domain|App=%SystemRoot%\system32\svchost.exe|Svc=winmgmt|Name=@FirewallAPI.dll,-34254|Desc=@FirewallAPI.dll,-34255|EmbedCtxt=@FirewallAPI.dll,-34251|Edge=FALSE|
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{3032BC7D-E713-452D-AAF7-F5ED073226C8}" = Windows Small Business Server 2011 Standard ClientAgent
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{901C0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Access 2003 Runtime
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C73CA646-73B3-4AEF-A136-C37505745174}" = iTunes
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D03482C5-9AD8-496D-B388-692AE04C93AF}" = Bonjour
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{D7EC8A27-CDA2-46AE-8A26-4104A04FA5BE}" = 32 Bit HP CIO Components Installer
"{DCF84385-88E3-4472-8144-E95B823FC5DB}" = The Print Shop 21
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7A8377A-3062-43B8-94F4-4E30EA43A9E9}" = Windows Small Business Server 2011 Standard WMI Provider
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"ElsterFormular für Privatanwender 12.2.2.6665p" = ElsterFormular für Privatanwender
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 10.0 (x86 de)" = Mozilla Firefox 10.0 (x86 de)
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"OPTIGEM_is1" = OPTIGEM
"VLC media player" = VLC media player 1.1.7
"WebPost" = Microsoft Web Publishing Wizard 1.52
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 16.12.2011 04:04:50 | Computer Name = * | Source = SideBySide | ID = *
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 17.12.2011 12:22:42 | Computer Name = * | Source = SideBySide | ID = *
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 19.12.2011 03:43:53 | Computer Name = * | Source = SideBySide | ID = *
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 19.12.2011 12:13:29 | Computer Name = * | Source = SideBySide | ID = *
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Users\*\AppData\Local\Temp\Temp1_flash111[4].zip\install_flash_player_64bit.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.12.2011 12:13:58 | Computer Name = * | Source = Application Error | ID = *
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7601.17514,
 Zeitstempel: 0x4ce79912  Name des fehlerhaften Moduls: mshtml.dll, Version: 8.0.7601.17720,
 Zeitstempel: 0x4eb4ba27  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001b78f3  ID des fehlerhaften
 Prozesses: 0xc1c  Startzeit der fehlerhaften Anwendung: 0x01ccbe6761181e12  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Internet Explorer\iexplore.exe  Pfad des
 fehlerhaften Moduls: C:\Windows\System32\mshtml.dll  Berichtskennung: *
 
Error - 20.12.2011 04:31:27 | Computer Name = * | Source = SideBySide | ID = *
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 21.12.2011 03:42:44 | Computer Name = * | Source = SideBySide | ID = *
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 27.12.2011 08:25:05 | Computer Name = * | Source = SideBySide | ID = *
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 28.12.2011 13:24:32 | Computer Name = * | Source = SideBySide | ID = *
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
Error - 29.12.2011 05:34:48 | Computer Name = * | Source = SideBySide | ID = *
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft
 security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program
 files\microsoft security client\MSESysprep.dll" in Zeile 10.  Das imaging-Element
 wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements
 angezeigt, das von dieser Windows-Version nicht unterstützt wird.
 
[ System Events ]
Error - 12.10.2011 09:34:31 | Computer Name = * | Source = Disk | ID = *
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR5 gefunden.
 
Error - 12.10.2011 09:34:32 | Computer Name = * | Source = Disk | ID = *
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR5 gefunden.
 
Error - 12.10.2011 09:34:32 | Computer Name = * | Source = Disk | ID = *
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR5 gefunden.
 
Error - 12.10.2011 09:34:33 | Computer Name = * | Source = Disk | ID = *
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR5 gefunden.
 
Error - 12.10.2011 11:42:31 | Computer Name = *| Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x800f0902 fehlgeschlagen: Sicherheitsupdate für Windows 7 (KB2579686)
 
Error - 21.10.2011 08:36:40 | Computer Name = * | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
 
Error - 21.10.2011 08:36:41 | Computer Name = * | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
 
Error - 21.10.2011 08:36:41 | Computer Name = * | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
 
Error - 21.10.2011 08:36:42 | Computer Name = * | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
 
Error - 21.10.2011 08:36:42 | Computer Name = * | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
 
< End of report >
         

--- --- ---



Zu 4:
Installierte Programme:

7-Zip 9.20		14.02.2011		
Adobe Flash Player 11 ActiveX	Adobe Systems Incorporated	19.12.2011	6,00MB	11.1.102.55
Adobe Reader X (10.1.1) - Deutsch	Adobe Systems Incorporated	14.09.2011	165,7MB	10.1.1
Apple Application Support	Apple Inc.	10.08.2011	60,2MB	2.0.1
Apple Mobile Device Support	Apple Inc.	10.08.2011	22,1MB	3.4.1.2
Apple Software Update	Apple Inc.	10.08.2011	2,38MB	2.1.3.127
Bonjour	Apple Inc.	10.08.2011	0,98MB	3.0.0.2
CCleaner	Piriform	01.02.2012		3.15
CDBurnerXP	CDBurnerXP	14.02.2011	15,8MB	4.3.8.2474
ElsterFormular für Privatanwender	Landesfinanzdirektion Thüringen	27.06.2011		12.2.2.6665p
Google Toolbar for Internet Explorer	Google Inc.	09.01.2012		7.2.2427.2330
Intel(R) Graphics Media Accelerator Driver	Intel Corporation	06.12.2011		8.15.10.2189
iTunes	Apple Inc.	10.08.2011	142,0MB	10.4.0.80
Macromedia Shockwave Player		18.08.2011		
Malwarebytes Anti-Malware Version 1.60.1.1000	Malwarebytes Corporation	01.02.2012	17,3MB	1.60.1.1000
Microsoft .NET Framework 1.1	Microsoft	18.08.2011	34,8MB	1.1.4322
Microsoft Office Access 2003 Runtime	Microsoft Corporation	13.09.2011	318MB	11.0.8173.0
Microsoft Office Professional Plus 2010	Microsoft Corporation	28.06.2011		14.0.6029.1000
Microsoft Security Essentials	Microsoft Corporation	25.10.2011		2.1.1116.0
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161	Microsoft Corporation	27.06.2011	0,59MB	9.0.30729.6161
Microsoft Web Publishing Wizard 1.52		18.08.2011		
MobileMe Control Panel	Apple Inc.	09.05.2011	12,0MB	3.1.6.0
Mozilla Firefox 10.0 (x86 de)	Mozilla	01.02.2012	38,6MB	10.0
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	18.08.2011	1,28MB	4.20.9870.0
MSXML 4.0 SP2 (KB973688)	Microsoft Corporation	21.08.2011	1,33MB	4.20.9876.0
PDFCreator	Frank Heindörfer, Philip Chinery	14.02.2011		1.2.0
QuickTime	Apple Inc.	10.08.2011	73,0MB	7.70.80.34
Realtek High Definition Audio Driver	Realtek Semiconductor Corp.	07.02.2011		6.0.1.6077
Safari	Apple Inc.	09.05.2011	41,3MB	5.33.21.1
Skype Toolbars	Skype Technologies S.A.	14.07.2011	8,35MB	5.5.7896
Skype™ 5.3	Skype Technologies S.A.	14.07.2011	16,6MB	5.3.120
The Print Shop 21	Broderbund Software	18.08.2011	399MB	21.00.0000
VLC media player 1.1.7	VideoLAN	14.02.2011		1.1.7
         

Zu 5:
HijackThis -Logdatei
[/code]HiJackthis Logfile:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:55:50, on 02.02.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - hxxp://photoservice.fujicolor.eu/ips-opdata/objects/jordan.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = *
O17 - HKLM\Software\..\Telephony: DomainName = *
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = *
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = *
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
--
End of file - 6994 bytes
         

--- --- ---


Gruß
hux

1.
Schliesse alle Programme einschliesslich Internet Explorer und fixe mit Hijackthis die Einträge aus der nachfolgenden Codebox (HijackThis starten→ "Do a system scan only"→ Einträge auswählen→ Häckhen setzen→ "Fix checked" klicken→ PC neu aufstarten):
HijackThis erstellt ein Backup, Falls bei "Fixen" etwas schief geht, kann man unter "View the list of backups"- die Objekte wiederherstellen

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
         

2.
poste erneut - nach der vorgenommenen Reinigungsaktion:
TrendMicro™ HijackThis™ -Logfile - Keine offenen Fenster, solang bis HijackThis läuft!!
► Rechtsklick auf HijackThis-> "Als administrator ausführen" wählen...

3.

Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)

Fixen mit OTL

• Starte die OTL.exe.
• Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
• Kopiere folgendes Skript:

:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
[2012.01.29 14:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.01.29 15:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
[2012.02.02 17:14:11 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.02 16:22:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

:Commands
[purity]
[emptytemp]
         

• und füge es hier ein:
• Schließe alle Programme.
• Klicke auf den Fix Button.
• Klick auf .
• OTL verlangt einen Neustart. Bitte zulassen.
• Nach dem Neustart findest Du ein Textdokument.
  Kopiere den Inhalt hier in Code-Tags in Deinen Thread.

4.
reinige dein System mit CCleaner:

• "Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
• "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
• Starte dein System neu auf

5.

• lade Dir SUPERAntiSpyware FREE Edition herunter.
• installiere das Programm und update online.
• starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
• setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
• anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
• auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
• um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
• drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

6.
Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware ("Worm.Win32.Autorun") verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen.
Schließe jetzt alle externe Datenträgeran (USB Sticks etc) Deinen Rechner an, dabei die Hochstell-Taste [Shift-Taste] gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. (So verhindest Du die Ausführung der AUTORUN-Funktion) - Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung

7.
-> Führe dann einen Komplett-Systemcheck mit Eset Online Scanner (NOD32)Kostenlose Online Scanner durch
Achtung!: >>Du sollst nicht die Antivirus-Sicherheitssoftware installieren, sondern dein System nur online scannen<<

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?

Hallo kira,
konnte endlich wieder an den Rechner.
Habe alle Anweisungen befolgt. SUPERAntiSpyware fand viel Adware und einen Trojaner.
Eset fand dagegen nichts.

Der Computer machte bislang keine Probleme und MSEssentials meldete nichts.
Es kamen aber vier dieser DHL Delivery Notification Message -Emails, die meine Bekannte sofort gelöscht hatte.

Gruß
Hux


Zu 2: Hijackthis

HiJackthis Logfile:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:27:08, on 17.02.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - hxxp://photoservice.fujicolor.eu/ips-opdata/objects/jordan.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = X
O17 - HKLM\Software\..\Telephony: DomainName = X
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = X
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = X
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 6545 bytes
         

--- --- ---


Zu 3: OTL

All processes killed
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll not found.
C:\Programme\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: administrator
->Temp folder emptied: 78283576 bytes
->Temporary Internet Files folder emptied: 61808963 bytes
 
User: administrator.X
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Administrator.Jutta-PC
->Temp folder emptied: 317625 bytes
->Temporary Internet Files folder emptied: 2288769 bytes
->FireFox cache emptied: 54774237 bytes
->Flash cache emptied: 562 bytes
 
User: All Users
 
User: X
->Temp folder emptied: 50466 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: X
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: X
->Temp folder emptied: 62483199 bytes
->Temporary Internet Files folder emptied: 356944357 bytes
->FireFox cache emptied: 14753771 bytes
->Apple Safari cache emptied: 15095808 bytes
->Flash cache emptied: 19212 bytes
 
User: X
->Temp folder emptied: 9378437 bytes
->Temporary Internet Files folder emptied: 122886741 bytes
->Flash cache emptied: 4120 bytes
 
User: X
->Temp folder emptied: 5386806 bytes
->Temporary Internet Files folder emptied: 138284837 bytes
->Flash cache emptied: 2991 bytes
 
User: X
->Temp folder emptied: 334189 bytes
->Temporary Internet Files folder emptied: 768023139 bytes
->FireFox cache emptied: 48956300 bytes
->Flash cache emptied: 10565 bytes
 
User: Public
 
User: X
->Temp folder emptied: 51108 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 1548800 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6122180 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1.667,00 mb
 
 
OTL by OldTimer - Version 3.2.31.0 log created on 02172012_153516

Files\Folders moved on Reboot...
File\Folder C:\Users\X\AppData\Local\Temp\OICE_7466207B-18D7-4BD2-9BE6-7B5C1916D0F8.0\F93D0E69. not found!
File\Folder C:\Users\X\AppData\Local\Temp\OICE_0953E54E-B054-4412-9B13-108BD1B6EBC1.0\99AA7B88. not found!

Registry entries deleted on Reboot...
         

Zu 5: AntiSpyware

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 02/17/2012 at 04:13 PM

Application Version : 5.0.1144

Core Rules Database Version : 8257
Trace Rules Database Version: 6069

Scan type       : Complete Scan
Total Scan Time : 00:19:26

Operating System Information
Windows 7 Professional 32-bit, Service Pack 1 (Build 6.01.7601)
UAC Off - Administrator

Memory items scanned      : 615
Memory threats detected   : 0
Registry items scanned    : 34208
Registry threats detected : 0
File items scanned        : 31115
File threats detected     : 345

Adware.Tracking Cookie
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\TKYSNWBN.txt [ Cookie:zimmer1@atdmt.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\B5CLZAFF.txt [ Cookie:zimmer1@c.atdmt.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@tracking.quisma[2].txt [ Cookie:X@tracking.quisma.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@clickfuse[1].txt [ Cookie:zimmer1@clickfuse.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@de.sitestat[1].txt [ Cookie:zimmer1@de.sitestat.com/ndr/ts/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@invitemedia[1].txt [ Cookie:zimmer1@invitemedia.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\WKSOS6MG.txt [ Cookie:zimmer1@zanox.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@sales.liveperson[2].txt [ Cookie:zimmer1@sales.liveperson.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@ads.mikinimedia[1].txt [ Cookie:zimmer1@ads.mikinimedia.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\2SCMCQ2U.txt [ Cookie:zimmer1@unitymedia.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\D2D2534R.txt [ Cookie:zimmer1@ad4.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@ru4[1].txt [ Cookie:zimmer1@ru4.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@specificclick[1].txt [ Cookie:zimmer1@specificclick.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\90NB1H2Y.txt [ Cookie:zimmer1@revsci.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\Q58ATXIK.txt [ Cookie:zimmer1@smartadserver.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adx.chip[2].txt [ Cookie:X@adx.chip.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\O9AADLKB.txt [ Cookie:zimmer1@ww251.smartadserver.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\362E8ABC.txt [ Cookie:zimmer1@mediaplex.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@de.sitestat[2].txt [ Cookie:zimmer1@de.sitestat.com/ndr/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adfarm1.adition[2].txt [ Cookie:X@adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@doubleclick[1].txt [ Cookie:X@doubleclick.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\CE5U90QM.txt [ Cookie:zimmer1@ad3.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@nhl.112.2o7[1].txt [ Cookie:zimmer1@nhl.112.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@nl.sitestat[1].txt [ Cookie:zimmer1@nl.sitestat.com/hallmark/hallmarknl/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@xiti[1].txt [ Cookie:zimmer1@xiti.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@adtech[2].txt [ Cookie:zimmer1@adtech.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@fl01.ct2.comclick[2].txt [ Cookie:zimmer1@fl01.ct2.comclick.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@track.effiliation[1].txt [ Cookie:zimmer1@track.effiliation.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@imrworldwide[2].txt [ Cookie:zimmer1@imrworldwide.com/cgi-bin ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@yadro[2].txt [ Cookie:zimmer1@yadro.ru/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\MP8T755A.txt [ Cookie:zimmer1@doubleclick.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@adserver2.clipkit[2].txt [ Cookie:zimmer1@adserver2.clipkit.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\NQ6XFK54.txt [ Cookie:zimmer1@adserver.yopi.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\E3BQILGJ.txt [ Cookie:zimmer1@statcounter.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\59E8YF12.txt [ Cookie:zimmer1@ad2.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z56VRJ26.txt [ Cookie:zimmer1@eyewonder.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\8MASMYCQ.txt [ Cookie:zimmer1@tracking.klicktel.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@apmebf[1].txt [ Cookie:X@apmebf.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@mediaplex[1].txt [ Cookie:X@mediaplex.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@conrad.122.2o7[1].txt [ Cookie:zimmer1@conrad.122.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@atdmt[1].txt [ Cookie:zimmer1@atdmt.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@www.active-tracking[1].txt [ Cookie:zimmer1@www.active-tracking.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@eas4.emediate[2].txt [ Cookie:zimmer1@eas4.emediate.eu/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\81FRFK14.txt [ Cookie:zimmer1@apmebf.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@collective-media[1].txt [ Cookie:zimmer1@collective-media.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\RG1E1SUV.txt [ Cookie:zimmer1@ad1.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZSREOIOY.txt [ Cookie:zimmer1@ad.zanox.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@unitymedia.122.2o7[1].txt [ Cookie:zimmer1@unitymedia.122.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@liveperson[3].txt [ Cookie:zimmer1@liveperson.net/hc/72069871 ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad2.adfarm1.adition[1].txt [ Cookie:X@ad2.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\ALT686WF.txt [ Cookie:zimmer1@ad.yieldmanager.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\LH0HXDVK.txt [ Cookie:zimmer1@adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@ads.quartermedia[1].txt [ Cookie:zimmer1@ads.quartermedia.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@ad.adnet[2].txt [ Cookie:zimmer1@ad.adnet.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@imrworldwide[2].txt [ Cookie:X@imrworldwide.com/cgi-bin ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\M0PLENG0.txt [ Cookie:zimmer1@tradedoubler.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\94TEJP5P.txt [ Cookie:zimmer1@webmasterplan.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\6QVJG3TX.txt [ Cookie:zimmer1@track.effiliation.com/servlet/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\CDGU1CAE.txt [ Cookie:zimmer1@traffictrack.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\TSE3R8RW.txt [ Cookie:zimmer1@serving-sys.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\3SEOXTDL.txt [ Cookie:zimmer1@eas.apm.emediate.eu/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\1R4QKV9W.txt [ Cookie:zimmer1@ad.dyntracker.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\T9OGQ2CJ.txt [ Cookie:zimmer1@de.sitestat.com/fah/fah/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@media.ohost[2].txt [ Cookie:zimmer1@media.ohost.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@overture[2].txt [ Cookie:zimmer1@overture.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\A5CSS61A.txt [ Cookie:zimmer1@ads20.wwe-media.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\VO2Z3P3X.txt [ Cookie:zimmer1@pro-market.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\GRBR116C.txt [ Cookie:zimmer1@www.googleadservices.com/pagead/conversion/1071438628/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\YKWR5JJF.txt [ Cookie:zimmer1@amazon-adsystem.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@content.yieldmanager[3].txt [ Cookie:zimmer1@content.yieldmanager.com/ak/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@zbox.zanox[1].txt [ Cookie:zimmer1@zbox.zanox.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\AQFC0T3P.txt [ Cookie:zimmer1@bs.serving-sys.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\JDCNWLBS.txt [ Cookie:zimmer1@adx.chip.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@fidelity.rotator.hadj7.adjuggler[1].txt [ Cookie:zimmer1@fidelity.rotator.hadj7.adjuggler.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\BT6AUJ4M.txt [ Cookie:zimmer1@media6degrees.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@casalemedia[2].txt [ Cookie:zimmer1@casalemedia.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\KNT7QBFH.txt [ Cookie:zimmer1@adform.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@burstnet[2].txt [ Cookie:zimmer1@burstnet.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\2LO8O7JO.txt [ Cookie:zimmer1@deutschepostag.112.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\XQKG3CDC.txt [ Cookie:zimmer1@www.googleadservices.com/pagead/conversion/1071902887/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@www.burstnet[1].txt [ Cookie:zimmer1@www.burstnet.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\2N5386TR.txt [ Cookie:zimmer1@2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\1QJFJUVF.txt [ Cookie:zimmer1@microsoftsto.112.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@tribalfusion[1].txt [ Cookie:zimmer1@tribalfusion.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\1WWZ1XTJ.txt [ Cookie:zimmer1@legolas-media.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@www.usenext[2].txt [ Cookie:zimmer1@www.usenext.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\zimmer1@clickandbuy[1].txt [ Cookie:zimmer1@clickandbuy.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\T10TPBBP.txt [ Cookie:zimmer1@zanox-affiliate.de/ ]
	C:\USERS\X\Cookies\TKYSNWBN.txt [ Cookie:zimmer1@atdmt.com/ ]
	C:\USERS\X\Cookies\B5CLZAFF.txt [ Cookie:zimmer1@c.atdmt.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@tracking.quisma[2].txt [ Cookie:X@tracking.quisma.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@statse.webtrendslive[1].txt [ Cookie:X@statse.webtrendslive.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@user.lucidmedia[1].txt [ Cookie:X@user.lucidmedia.com/clicksense/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@eas4.emediate[1].txt [ Cookie:X@eas4.emediate.eu/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@zbox.zanox[1].txt [ Cookie:X@zbox.zanox.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@invitemedia[2].txt [ Cookie:X@invitemedia.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@vodafonegroup.122.2o7[1].txt [ Cookie:X@vodafonegroup.122.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@moviepilot[1].txt [ Cookie:X@moviepilot.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@stat.aldi[2].txt [ Cookie:X@stat.aldi.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@guj.122.2o7[1].txt [ Cookie:X@guj.122.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@track.adform[1].txt [ Cookie:X@track.adform.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@tracking.hannoversche[1].txt [ Cookie:X@tracking.hannoversche.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adfarm1.adition[1].txt [ Cookie:X@adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad4.adfarm1.adition[2].txt [ Cookie:X@ad4.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@doubleclick[2].txt [ Cookie:X@doubleclick.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ru4[2].txt [ Cookie:X@ru4.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad1.adfarm1.adition[2].txt [ Cookie:X@ad1.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@tracking.mlsat02[1].txt [ Cookie:X@tracking.mlsat02.de/tmobile/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@www.googleadservices[2].txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1018622939/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@www.googleadservices[1].txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1072574438/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@traffictrack[2].txt [ Cookie:X@traffictrack.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad.yieldmanager[2].txt [ Cookie:X@ad.yieldmanager.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adserver.kino-zeit[2].txt [ Cookie:X@adserver.kino-zeit.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@tradedoubler[1].txt [ Cookie:X@tradedoubler.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@bs.serving-sys[1].txt [ Cookie:X@bs.serving-sys.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@test.wiredminds[1].txt [ Cookie:X@test.wiredminds.de/track/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@unitymedia[2].txt [ Cookie:X@unitymedia.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@smartadserver[1].txt [ Cookie:X@smartadserver.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@content.yieldmanager[3].txt [ Cookie:X@content.yieldmanager.com/ak/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@track.effiliation[3].txt [ Cookie:X@track.effiliation.com/servlet/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@apmebf[2].txt [ Cookie:X@apmebf.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@mediaplex[1].txt [ Cookie:X@mediaplex.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ww251.smartadserver[2].txt [ Cookie:X@ww251.smartadserver.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@xiti[1].txt [ Cookie:X@xiti.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@specificclick[2].txt [ Cookie:X@specificclick.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@stats.sozialwahl[2].txt [ Cookie:X@stats.sozialwahl.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad3.adfarm1.adition[1].txt [ Cookie:X@ad3.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad2.adfarm1.adition[2].txt [ Cookie:X@ad2.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@statcounter[1].txt [ Cookie:X@statcounter.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adform[2].txt [ Cookie:X@adform.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adtech[1].txt [ Cookie:X@adtech.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@clickaider[1].txt [ Cookie:X@clickaider.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@a.revenuemax[1].txt [ Cookie:X@a.revenuemax.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@zanox-affiliate[2].txt [ Cookie:X@zanox-affiliate.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad.adnet[3].txt [ Cookie:X@ad.adnet.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@serving-sys[1].txt [ Cookie:X@serving-sys.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@webmasterplan[1].txt [ Cookie:X@webmasterplan.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@de.sitestat[2].txt [ Cookie:X@de.sitestat.com/ndr/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@track.effiliation[1].txt [ Cookie:X@track.effiliation.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adviva[1].txt [ Cookie:X@adviva.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@stat.aldi[1].txt [ Cookie:X@stat.aldi.com/dcsfq2jxwixy5f1mioa8p9lnl_5x1d ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad.adnet[1].txt [ Cookie:X@ad.adnet.biz/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@2o7[2].txt [ Cookie:X@2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adbrite[1].txt [ Cookie:X@adbrite.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adserver1.mokono[1].txt [ Cookie:X@adserver1.mokono.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@imrworldwide[2].txt [ Cookie:X@imrworldwide.com/cgi-bin ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@casalemedia[1].txt [ Cookie:X@casalemedia.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@atdmt[1].txt [ Cookie:X@atdmt.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adviva[2].txt [ Cookie:X@adviva.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@www.googleadservices[5].txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1044936344/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@eas4.emediate[2].txt [ Cookie:X@eas4.emediate.eu/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@tracking.klicktel[2].txt [ Cookie:X@tracking.klicktel.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@studivz.adfarm1.adition[2].txt [ Cookie:X@studivz.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@www.etracker[1].txt [ Cookie:X@www.etracker.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@www.googleadservices[2].txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1030291149/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@traffictrack[2].txt [ Cookie:X@traffictrack.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@track.effiliation[3].txt [ Cookie:X@track.effiliation.com/servlet/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@www.googleadservices[4].txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1071318677/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad4.adfarm1.adition[2].txt [ Cookie:X@ad4.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad3.adfarm1.adition[2].txt [ Cookie:X@ad3.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adtech[2].txt [ Cookie:X@adtech.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@track.adform[1].txt [ Cookie:X@track.adform.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@eas.apm.emediate[1].txt [ Cookie:X@eas.apm.emediate.eu/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@tracking.hannoversche[1].txt [ Cookie:X@tracking.hannoversche.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ww251.smartadserver[2].txt [ Cookie:X@ww251.smartadserver.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@zanox[2].txt [ Cookie:X@zanox.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad.yieldmanager[2].txt [ Cookie:X@ad.yieldmanager.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@track.effiliation[1].txt [ Cookie:X@track.effiliation.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adform[2].txt [ Cookie:X@adform.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@collective-media[2].txt [ Cookie:X@collective-media.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@2o7[1].txt [ Cookie:X@2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@www.zanox-affiliate[1].txt [ Cookie:X@www.zanox-affiliate.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adfarm1.adition[1].txt [ Cookie:X@adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@www.googleadservices[1].txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1064075388/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@statcounter[1].txt [ Cookie:X@statcounter.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@tracking.quisma[1].txt [ Cookie:X@tracking.quisma.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@webmasterplan[2].txt [ Cookie:X@webmasterplan.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@e-2dj6wjliemc5aao.stats.esomniture[1].txt [ Cookie:X@e-2dj6wjliemc5aao.stats.esomniture.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@mediaplex[1].txt [ Cookie:X@mediaplex.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@im.banner.t-online[1].txt [ Cookie:X@im.banner.t-online.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad.zanox[2].txt [ Cookie:X@ad.zanox.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adbrite[1].txt [ Cookie:X@adbrite.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@smartadserver[1].txt [ Cookie:X@smartadserver.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ad.adserver01[2].txt [ Cookie:X@ad.adserver01.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\C8TMVHD4.txt [ Cookie:X@atdmt.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\7CGNTJ2E.txt [ Cookie:X@accounts.google.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@dc.tremormedia[1].txt [ Cookie:X@dc.tremormedia.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\M1ZCI4BL.txt [ Cookie:X@ad.adnet.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adserver[1].txt [ Cookie:X@adserver.gs/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\B9WASU5S.txt [ Cookie:X@adviva.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\3DAAQ77V.txt [ Cookie:X@atdmt.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\VIUKHISD.txt [ Cookie:X@tracking.klicktel.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@studivz.adfarm1.adition[2].txt [ Cookie:X@studivz.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\DQYCKCFG.txt [ Cookie:X@toplist.eu/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\AWYO4S5K.txt [ Cookie:X@banner.testberichte.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\SWWPTVHD.txt [ Cookie:X@traffictrack.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@nl.sitestat[1].txt [ Cookie:X@nl.sitestat.com/hallmark/hallmarknl/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\6GHNFEVN.txt [ Cookie:X@track.effiliation.com/servlet/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\MDP7AVP6.txt [ Cookie:X@ad4.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@advertising[2].txt [ Cookie:X@advertising.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\QP16USMG.txt [ Cookie:X@yadro.ru/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\XFFBUTKO.txt [ Cookie:X@adtech.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\KW4KBDQJ.txt [ Cookie:X@ad3.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\K5N6GLHZ.txt [ Cookie:X@track.adform.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@media.inspirationalfilms[2].txt [ Cookie:X@media.inspirationalfilms.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\QGH38PNU.txt [ Cookie:X@eas.apm.emediate.eu/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\QQX9O40Z.txt [ Cookie:X@fl01.ct2.comclick.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@atrack.allposters[1].txt [ Cookie:X@atrack.allposters.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\L3Y4BORK.txt [ Cookie:X@interclick.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\04V0P519.txt [ Cookie:X@zanox.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\ICRHG0QO.txt [ Cookie:X@ad.yieldmanager.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\JEPCAXZC.txt [ Cookie:X@track.effiliation.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\V96COX1P.txt [ Cookie:X@adform.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@s1.trafficmaxx[1].txt [ Cookie:X@s1.trafficmaxx.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\585ETCVR.txt [ Cookie:X@2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adxpose[1].txt [ Cookie:X@adxpose.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@nhl.112.2o7[1].txt [ Cookie:X@nhl.112.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\O3549SJ6.txt [ Cookie:X@adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\P2TCZ90P.txt [ Cookie:X@zbox.zanox.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\4AP90D4T.txt [ Cookie:X@statcounter.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\3A29XKTU.txt [ Cookie:X@tracking.quisma.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\KKT3JJ7U.txt [ Cookie:X@webmasterplan.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\QLMYWSXV.txt [ Cookie:X@ad1.adfarm1.adition.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\VCM2F9VE.txt [ Cookie:X@mediaplex.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\B3ZKOEZ8.txt [ Cookie:X@im.banner.t-online.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\V3AFDVPJ.txt [ Cookie:X@discounto.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\JJNRO7AI.txt [ Cookie:X@ad.zanox.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@de.sitestat[2].txt [ Cookie:X@de.sitestat.com/ndr/ts/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@zieltrack[1].txt [ Cookie:X@zieltrack.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@adbrite[1].txt [ Cookie:X@adbrite.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@a.revenuemax[1].txt [ Cookie:X@a.revenuemax.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\LJW21X07.txt [ Cookie:X@tribalfusion.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\S6VC06PY.txt [ Cookie:X@microsoftwlsearchcrm.112.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\GD49A28B.txt [ Cookie:X@fastclick.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@guj.122.2o7[1].txt [ Cookie:X@guj.122.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\SRB2BBOL.txt [ Cookie:X@server.adform.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@ads20.wwe-media[1].txt [ Cookie:X@ads20.wwe-media.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\UPES7BOE.txt [ Cookie:X@imrworldwide.com/cgi-bin ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\PODMOPQ8.txt [ Cookie:X@de.sitestat.com/sueddeutsche/sueddeutsche/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@clickandbuy[1].txt [ Cookie:X@clickandbuy.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZS7VJE1E.txt [ Cookie:X@www.etracker.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\ITHEUXSN.txt [ Cookie:X@toplist.cz/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\GV1AE3NH.txt [ Cookie:X@dyntracker.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@tracking.hrs[1].txt [ Cookie:X@tracking.hrs.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\UNY1IRMO.txt [ Cookie:X@www.google.com/accounts ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\VHF9J6QJ.txt [ Cookie:X@partners.webmasterplan.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@de.sitestat[3].txt [ Cookie:X@de.sitestat.com/ndr/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\X@de.sitestat[1].txt [ Cookie:X@de.sitestat.com/fah/fah/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\OTHEI0KZ.txt [ Cookie:X@secmedia.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\95XO8N26.txt [ Cookie:X@ww251.smartadserver.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\IB93D9DW.txt [ Cookie:X@kantarmedia.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\OS162J3I.txt [ Cookie:X@partnersearchmetrics.sbx1.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z6B8K7H4.txt [ Cookie:X@wissende.122.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\T49E75R6.txt [ Cookie:X@www.zanox-affiliate.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\TSI00WLN.txt [ Cookie:X@weborama.fr/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\E783UZYT.txt [ Cookie:X@ad1.emediate.dk/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\U8FQQ139.txt [ Cookie:X@www.hxtrack.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\1UHD13M3.txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1072620100/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\N5PGDP0B.txt [ Cookie:X@microsoftoffice.112.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZNT50IAC.txt [ Cookie:X@www.devk.de/ad/haftpflichtversicherung.jsp ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\4W3O0ZA1.txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1045904156/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\JXLZIRE7.txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1069628296/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\C77M14CI.txt [ Cookie:X@track.webtrekk.de/565556556123999/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\TF5QTG05.txt [ Cookie:X@amazon-adsystem.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\SK07PH7S.txt [ Cookie:X@aimfar.solution.weborama.fr/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\KC4YG176.txt [ Cookie:X@smartadserver.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\5UFQMIVH.txt [ Cookie:X@urbia.wwe-media.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\UT3WDZRM.txt [ Cookie:X@www.leserservice-tracking.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\N2PXVUYR.txt [ Cookie:X@germanwings.112.2o7.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\L2STK7HA.txt [ Cookie:X@akamai.interclickproxy.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\HCZNA4F9.txt [ Cookie:X@eas4.emediate.eu/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\CJ2UVQ4B.txt [ Cookie:X@media6degrees.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\R7M62EPG.txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1015028999/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\XV8N1ON7.txt [ Cookie:X@a1.interclick.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\6WLAVVXS.txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1041372293/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\NPBZI3B0.txt [ Cookie:X@adx.chip.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\0PL19FF9.txt [ Cookie:X@kursnet-finden.arbeitsagentur.de/kurs/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\KA67L6Z3.txt [ Cookie:X@accounts.google.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\RBSJRNOM.txt [ Cookie:X@hightraffic.hugoboss.com/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\0PBWBSY7.txt [ Cookie:X@counter.devk.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\VNP6SVHS.txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1067646656/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\44YD86GN.txt [ Cookie:X@discounter-in-deutschland.de/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\BMROG7T3.txt [ Cookie:X@mm.chitika.net/ ]
	C:\USERS\X\AppData\Roaming\Microsoft\Windows\Cookies\Low\3DPDBS9T.txt [ Cookie:X@www.googleadservices.com/pagead/conversion/1014173760/ ]
	C:\USERS\X\Cookies\C8TMVHD4.txt [ Cookie:X@atdmt.com/ ]
	C:\USERS\X\Cookies\7CGNTJ2E.txt [ Cookie:X@accounts.google.com/ ]
	.doubleclick.net [ C:\USERS\ADMINISTRATOR.X-PC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\US0Z0L8W.DEFAULT\COOKIES.SQLITE ]
	.adx.chip.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8KP3459I.DEFAULT\COOKIES.SQLITE ]
	.apmebf.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8KP3459I.DEFAULT\COOKIES.SQLITE ]
	.doubleclick.net [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8KP3459I.DEFAULT\COOKIES.SQLITE ]
	.imrworldwide.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8KP3459I.DEFAULT\COOKIES.SQLITE ]
	.imrworldwide.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8KP3459I.DEFAULT\COOKIES.SQLITE ]
	.mediaplex.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8KP3459I.DEFAULT\COOKIES.SQLITE ]
	C:\USERS\X\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\X@IM.BANNER.T-ONLINE[1].TXT [ /IM.BANNER.T-ONLINE ]
	C:\USERS\X\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\X@SPECIFICCLICK[1].TXT [ /SPECIFICCLICK ]
	.amazon-adsystem.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.amazon-adsystem.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.doubleclick.net [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.ad.adnet.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.ad.adnet.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.unitymedia.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.unitymedia.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.tracking.quisma.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.adtech.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.atdmt.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.atdmt.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	ad2.adfarm1.adition.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.tracking.quisma.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.zanox.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	ad1.adfarm1.adition.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	ad4.adfarm1.adition.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.serving-sys.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.serving-sys.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.serving-sys.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.serving-sys.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.tracking.quisma.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	www.etracker.de [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.webmasterplan.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.webmasterplan.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.adxvalue.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	ad.zanox.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.doubleclick.net [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.2o7.net [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	.2o7.net [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\X\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SLIDLFWT.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-SoftonicDownloader
	C:\USERS\X\DOWNLOADS\SOFTONICDOWNLOADER_FUER_CDBURNERXP-PRO.EXE
         

Zu 7: Eset Online Scanner

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b0704c31591d4e4687870f5aebd75cd4
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-02-17 04:18:14
# local_time=2012-02-17 05:18:14 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 1295319 1295319 0 0
# compatibility_mode=5893 16776574 100 94 9868600 81123908 0 0
# compatibility_mode=8192 67108863 100 0 3811 3811 0 0
# scanned=99305
# found=0
# cleaned=0
# scan_time=2776